[MDEV-32500] Information schema leaks table names and structure to unauthorized users Created: 2023-10-17 Updated: 2023-10-23 Resolved: 2023-10-23 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Authentication and Privilege System, Information Schema |
| Affects Version/s: | 10.4, 10.5, 10.6, 10.10, 10.11, 11.0, 11.1, 11.2 |
| Fix Version/s: | 10.4.32, 10.5.23, 10.6.16, 10.10.7, 10.11.6, 11.0.4, 11.1.3, 11.2.2 |
| Type: | Bug | Priority: | Major |
| Reporter: | Elena Stepanova | Assignee: | Sergei Golubchik |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||
| Description |
|
InnoDB is used to get a foreign key, otherwise it is not specific to InnoDB.
The expected result is probably only to return one row to the first query and nothing else, but maybe it's trickier than that. |
| Comments |
| Comment by Sergei Golubchik [ 2023-10-18 ] |
|
| Comment by Elena Stepanova [ 2023-10-18 ] |
Yes, I would expect SHOW commands behave consistently with I_S views with similar semantics (key_column_usage seems a good candidate at the first glance), but since I_S itself is all over the place, I couldn't even formulate it this way. Note that there is also case 2a (not to break your numeration completely), referential_constraints. Its specifics is that shows the referenced table, to which the user has no privileges at all. |
| Comment by Sergei Golubchik [ 2023-10-18 ] |
|
Right, sorry. Missed that.
|
| Comment by Elena Stepanova [ 2023-10-18 ] |
|
Yes, in case of referential constraints the doubt is not about the column name, but about the table t1 itself. A user without any grants for a table normally isn't allowed to know about its existence at all. |