[MDEV-33402] Calling a private package routine by its 3-step name does not fail Created: 2024-02-07  Updated: 2024-02-07

Status: Open
Project: MariaDB Server
Component/s: Stored routines
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5
Fix Version/s: 10.5

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Unassigned
Resolution: Unresolved Votes: 0
Labels: security

Issue Links:
Problem/Incident
is caused by MDEV-10591 Oracle-style packages Closed
Relates
relates to MDEV-32101 CREATE PACKAGE [BODY] for sql_mode=DE... Closed

 Description   

I create the following package with a private procedure and try to call the procedure from outside of the package:

SET sql_mode=ORACLE;
 
CREATE OR REPLACE DATABASE db1;
 
 
 
DELIMITER $$
 
CREATE OR REPLACE PACKAGE db1.pkg AS
 
  PROCEDURE p1;
 
END;
 
$$
 
CREATE PACKAGE BODY db1.pkg AS
 
  PROCEDURE p0 AS BEGIN SELECT 5; END;
 
  PROCEDURE p1 AS BEGIN CALL p0(); END;
 
END;
 
$$
 
DELIMITER ;
 
USE db1;
 
CALL pkg.p0() /* This fails, correct */;


ERROR 1305 (42000): PROCEDURE pkg.p0 does not exist

The CALL statement correctly fails, because pkg.p0 is a private routine.

Now I use a 3-step procedure name notation:

CALL db1.pkg.p0() /* This succeeds, wrong */;


+---+
 
| 5 |
 
+---+
 
| 5 |
 
+---+

The above is wrong. It should fail in the same way with the first CALL.

 Comments   
Comment by Alexander Barkov [ 2024-02-07 ]

In sql_mode=DEFAULT it also works incorrectly:

SET sql_mode=DEFAULT;
 
CREATE OR REPLACE DATABASE db1;
 
 
 
DELIMITER $$
 
CREATE OR REPLACE PACKAGE db1.pkg
 
  PROCEDURE p1();
 
END;
 
$$
 
CREATE PACKAGE BODY db1.pkg
 
  PROCEDURE p0() SELECT 5;
 
  PROCEDURE p1() CALL p0();
 
END;
 
$$
 
DELIMITER ;
 
USE db1;
 
CALL pkg.p0() /* This fails, correct */;


ERROR 1305 (42000): PROCEDURE pkg.p0 does not exist

The CALL statement correctly fails, because pkg.p0 is a private routine.

Now I use a 3-step procedure notation:

CALL db1.pkg.p0() /* This succeeds, wrong */;


+---+
 
| 5 |
 
+---+
 
| 5 |
 
+---+

Generated at Thu Feb 08 10:38:38 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.