[MDEV-22378] load_data() always takes invoker FILE privileges in view Created: 2020-04-27  Updated: 2023-04-27

Status: Open
Project: MariaDB Server
Component/s: Views
Affects Version/s: 5.5, 10.1, 10.2, 10.3, 10.4, 10.5
Fix Version/s: 10.4, 10.5

Type: Bug Priority: Major
Reporter: Oleksandr Byelkin Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-22374 VIEW with security definer require FI... Stalled

 Description   

create table t1 (a int);
insert into t1 values (1);
 
eval select * into outfile "../../tmp/outfile-test.1" from t1;
 
SELECT load_file("../../tmp/outfile-test.1") as file from t1;
 
create user test@localhost;
grant select on test.* to test@localhost;
 
create definer=test@localhost sql security definer view v1 as select * from t1;
 
SELECT load_file("../../tmp/outfile-test.1") as file from v1;
 
drop view v1;
 
create definer=test@localhost sql security definer view v1 as select load_file("../../tmp/outfile-test.1") as file from t1;
 
--echo # should be an error, but no
SELECT  * from v1;
 
drop view v1;
create definer=root@localhost sql security definer view v1 as select * from t1;
 
connect (con1,localhost,test,,);
 
SELECT load_file("../../tmp/outfile-test.1") as file from v1;
 
connection default;
 
drop view v1;
create definer=root@localhost sql security definer view v1 as select load_file("../../tmp/outfile-test.1") as file from t1;
 
connection con1;
 
SELECT  * from v1;
 
connection default;
disconnect con1;
 
drop view v1;
drop table t1;
drop user test@localhost;

result:

create table t1 (a int);
insert into t1 values (1);
select * into outfile "../../tmp/outfile-test.1" from t1;
SELECT load_file("../../tmp/outfile-test.1") as file from t1;
file
1
 
create user test@localhost;
grant select on test.* to test@localhost;
create definer=test@localhost sql security definer view v1 as select * from t1;
SELECT load_file("../../tmp/outfile-test.1") as file from v1;
file
1
 
drop view v1;
create definer=test@localhost sql security definer view v1 as select load_file("../../tmp/outfile-test.1") as file from t1;
# should be an error, but no
SELECT  * from v1;
file
1
 
drop view v1;
create definer=root@localhost sql security definer view v1 as select * from t1;
SELECT load_file("../../tmp/outfile-test.1") as file from v1;
file
NULL
drop view v1;
create definer=root@localhost sql security definer view v1 as select load_file("../../tmp/outfile-test.1") as file from t1;
SELECT  * from v1;
file
NULL
drop view v1;
drop table t1;
drop user test@localhost;

for EXEC priviledge everything is correct:

create table t1 (a int);
insert into t1 values (1);
 
create function one1() returns int return 1;
 
 
SELECT one1() as func from t1;
 
create user test@localhost;
grant select on test.* to test@localhost;
 
create definer=test@localhost sql security definer view v1 as select * from t1;
 
SELECT one1() as func from v1;
 
drop view v1;
 
create definer=test@localhost sql security definer view v1 as select one1() as func from t1;
create definer=root@localhost sql security definer view v2 as select one1() as func from t1;
 
SELECT * from v2;
--error ER_VIEW_INVALID
SELECT * from v1;
 
drop view v1;
create definer=root@localhost sql security definer view v1 as select * from t1;
 
connect (con1,localhost,test,,);
 
--error ER_PROCACCESS_DENIED_ERROR
SELECT one1() as func from v1;
 
connection default;
 
drop view v1,v2;
create definer=test@localhost sql security definer view v1 as select one1() as func from t1;
 
create definer=root@localhost sql security definer view v2 as select one1() as func from t1;
 
connection con1;
 
--error ER_VIEW_INVALID
SELECT  * from v1;
SELECT  * from v2;
 
connection default;
disconnect con1;
 
drop view v1,v2;
drop table t1;
drop function one1;
drop user test@localhost;


Generated at Thu Feb 08 09:14:17 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.