Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41612

GRANT on a routine stores the user name in mysql.procs_priv re-encoded from latin1

    XMLWordPrintable

Details

    • Can result in unexpected behaviour

    Description

      Description

      replace_routine_table() in sql/sql_acl.cc stores Host, Db, User, Routine_name and Grantor into mysql.procs_priv with &my_charset_latin1, while replace_table_table(), replace_column_table() and replace_db_table() use system_charset_info. For an account whose name has bytes outside ASCII the row holds the UTF-8 bytes converted a second time (D1 82 for "т" becomes C3 91 E2 80 9A). SHOW GRANTS shows the grant until the next FLUSH PRIVILEGES or restart; after the reload the row belongs to a user that does not exist and the account has lost EXECUTE on every routine. DROP FUNCTION / DROP PROCEDURE go through the same function, find only the re-encoded row, and a row corrected by hand stays behind; REVOKE ALL then fails with ER_NONEXISTING_GRANT. Unchanged since MySQL 5.5, present in 10.6 .. main.

      Fix: store the five strings with system_charset_info, as the other grant tables do.

      Release Notes

      GRANT ... ON FUNCTION/PROCEDURE to an account with a non-ASCII user name no longer writes a double-encoded name into mysql.procs_priv; such grants now survive FLUSH PRIVILEGES and are removed by DROP of the routine.

      How can this PR be tested?

      set names utf8mb3;
      create user 'юзер'@'localhost';
      create function f() returns int deterministic return 1;
      create procedure p() select 1;
      grant execute on function test.f to 'юзер'@'localhost';
      grant execute on procedure test.p to 'юзер'@'localhost';
      grant select on test.* to 'юзер'@'localhost';
      # The stored bytes must equal the bytes of the name, as in mysql.db
      select hex(User) = hex('юзер') as ok, Routine_name from mysql.procs_priv where User like 'юзер' order by Routine_name;
      

      Attachments

        Activity

          People

            gkodinov Georgi Kodinov
            gkodinov Georgi Kodinov
            Georgi Kodinov Georgi Kodinov
            Sergei Golubchik Sergei Golubchik
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.