[MDEV-33119] User is case insensitive in INFORMATION_SCHEMA.VIEWS Created: 2023-12-25  Updated: 2024-01-19

Status: Open
Project: MariaDB Server
Component/s: Authentication and Privilege System, Character Sets, Information Schema, Views
Affects Version/s: 10.4, 11.4
Fix Version/s: 10.4, 11.4

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Alexander Barkov
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-31340 Remove MY_COLLATION_HANDLER::strcasec... In Review

 Description   

I run this MTR test:

CREATE USER foo;
CREATE USER FOO;
GRANT SELECT ON test.* TO foo;
GRANT SELECT ON test.* TO FOO;
 
CREATE DEFINER=foo SQL SECURITY INVOKER VIEW v1 AS SELECT 1 AS c1;
 
--connect (FOO, localhost, FOO, , test)
--connection FOO
 
SELECT CURRENT_USER;
--vertical_results
--query_vertical SELECT * FROM INFORMATION_SCHEMA.VIEWS
--horizontal_results
 
--disconnect FOO
--connection default
 
DROP VIEW v1;
DROP USER foo;
DROP USER FOO;

It produces the following outout:

...
SELECT CURRENT_USER;
CURRENT_USER
FOO@%
SELECT * FROM INFORMATION_SCHEMA.VIEWS;
TABLE_CATALOG	def
TABLE_SCHEMA	test
TABLE_NAME	v1
VIEW_DEFINITION	select 1 AS `c1`
CHECK_OPTION	NONE
IS_UPDATABLE	NO
DEFINER	foo@%
SECURITY_TYPE	INVOKER
CHARACTER_SET_CLIENT	latin1
COLLATION_CONNECTION	latin1_swedish_ci
...

Notice, the colum VIEW_DEFINITION is not empty, which is wrong:

  • The view belongs to user 'foo' (with all lower case letters)
  • The user querying I_S.VIEW is 'FOO' (with all upper case letters) - it's a different user!

Generated at Thu Feb 08 10:36:32 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.