[MDEV-23086] Error codes/messages provide information about table structure to unauthorized parties Created: 2020-07-03  Updated: 2023-04-27

Status: Open
Project: MariaDB Server
Component/s: Authentication and Privilege System
Affects Version/s: 5.5, 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Sergei Golubchik
Resolution: Unresolved Votes: 0
Labels: upstream-fixed


 Description   

create database db;
create table db.t (a int, b int);
create user foo;
grant select (a) on db.t to foo;
 
--connect (con1,localhost,foo,,)
select a from db.t;
--error ER_COLUMNACCESS_DENIED_ERROR
select b from db.t;
select c from db.t;
 
 
# Cleanup
--disconnect con1
--connection default
drop database db;
drop user foo;

6cee9b1953

MariaDB [test]> select b from db.t;
ERROR 1143 (42000): SELECT command denied to user 'foo'@'localhost' for column 'b' in table 't'
MariaDB [test]> select c from db.t;
ERROR 1054 (42S22): Unknown column 'c' in 'field list'

Reproducible on all of 5.5-10.5 and MySQL 5.6. Fixed in MySQL 5.7, which now returns ER_COLUMNACCESS_DENIED_ERROR in both cases.


Generated at Thu Feb 08 09:19:44 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.