[MDEV-6382] ANALYZE $stmt and security Created: 2014-06-25 Updated: 2015-04-09 Resolved: 2015-04-09 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Optimizer |
| Fix Version/s: | 10.1.4 |
| Type: | Task | Priority: | Major |
| Reporter: | Sergei Petrunia | Assignee: | Sergei Petrunia |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | analyze-stmt | ||
| Attachments: |
|
||||||||||||||||||||
| Issue Links: |
|
||||||||||||||||||||
| Description |
|
(filing this based on discussion with Sanja) EXPLAIN has a special relationship with security. EXPLAIN over query with ANALYZE-statement produces EXPLAIN output, so it should require the same permissions. It needs to also require permissions that are needed for execution. See also: view_grant.test |
| Comments |
| Comment by Elena Stepanova [ 2014-11-14 ] |
|
Attached two files, mdev6382_before.test and mdev6382_after.test. It's exactly the same test, only the 'before' variant is adjusted to pass on the current 10.1 tree, while in the 'after' variant all adjustments related to There are more adjustments in the test to work around unrelated legacy bugs; the are commented with the corresponding JIRA numbers, search or grep for 'MDEV' to find all of them. The test is lengthy line-wise, but it's very cheap time-wise, even under valgrind, so I didn't feel the urge to optimize the number of statements in there. Here is what the test does: INSERT ... VALUES and EXPLAIN and ANALYZE for each query. The goal is to check that ANALYZE cannot be executed when either the query or EXPLAIN cannot. The variations of grants used in the test are only a tiny share of the entire pool of possible combinations, and is by no means 100% coverage, but it should present the most basic cases. |