database/doris
2
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

[fix](auth)create view check select_priv of table instead of column (#49268)

Browse Source
This commit is contained in:
zhangdong
2025-03-20 23:08:58 +08:00
committed by GitHub
parent 2560a8ec56
commit 54b3000de5
6 changed files with 28 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
fe/fe-core/src/main/java/org/apache/doris/analysis/AlterViewStmt.java
View File

@ -74,7 +74,7 @@ public class AlterViewStmt extends BaseViewStmt {
viewDefStmt.setNeedToSql(true);
Analyzer viewAnalyzer = new Analyzer(analyzer);
viewDefStmt.analyze(viewAnalyzer);
checkQueryAuth();
checkQueryAuth(viewAnalyzer);
createColumnAndViewDefs(analyzer);
}

32
fe/fe-core/src/main/java/org/apache/doris/analysis/BaseViewStmt.java
View File

@ -18,7 +18,7 @@
package org.apache.doris.analysis;
import org.apache.doris.catalog.Column;
import org.apache.doris.catalog.Env;
import org.apache.doris.catalog.TableIf;
import org.apache.doris.catalog.Type;
import org.apache.doris.common.AnalysisException;
import org.apache.doris.common.DdlException;
@ -27,19 +27,18 @@ import org.apache.doris.common.ErrorReport;
import org.apache.doris.common.UserException;
import org.apache.doris.common.util.SqlParserUtils;
import org.apache.doris.common.util.ToSqlContext;
import org.apache.doris.datasource.InternalCatalog;
import org.apache.doris.mysql.privilege.PrivPredicate;
import org.apache.doris.qe.ConnectContext;
import com.google.common.base.Preconditions;
import com.google.common.collect.Lists;
import com.google.common.collect.Maps;
import com.google.common.collect.Sets;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import java.io.StringReader;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.stream.Collectors;
@ -92,26 +91,11 @@ public class BaseViewStmt extends DdlStmt {
return inlineViewDef;
}
protected void checkQueryAuth() throws UserException {
for (int i = 0; i < viewDefStmt.getBaseTblResultExprs().size(); ++i) {
Expr expr = viewDefStmt.getBaseTblResultExprs().get(i);
if (!(expr instanceof SlotRef)) {
continue;
}
SlotRef slotRef = (SlotRef) expr;
TableName queryTableName = slotRef.getTableName();
if (queryTableName == null) {
continue;
}
String queryColumnName = slotRef.getColumnName();
String ctlName = StringUtils.isEmpty(queryTableName.getCtl()) ? InternalCatalog.INTERNAL_CATALOG_NAME
: queryTableName.getCtl();
// check privilege
Env.getCurrentEnv().getAccessManager()
.checkColumnsPriv(ConnectContext.get().getCurrentUserIdentity(), ctlName,
queryTableName.getDb(), queryTableName.getTbl(), Sets.newHashSet(queryColumnName),
PrivPredicate.SELECT);
}
protected void checkQueryAuth(Analyzer analyzer) throws UserException {
Map<Long, TableIf> tableMap = Maps.newTreeMap();
Set<String> parentViewNameSet = Sets.newHashSet();
// not really want to obtain tables, but rather use the authentication logic in this method
viewDefStmt.getTables(analyzer, false, tableMap, parentViewNameSet);
}
/**

2
fe/fe-core/src/main/java/org/apache/doris/analysis/CreateViewStmt.java
View File

@ -96,7 +96,7 @@ public class CreateViewStmt extends BaseViewStmt {
Analyzer viewAnalyzer = new Analyzer(analyzer);
viewDefStmt.forbiddenMVRewrite();
viewDefStmt.analyze(viewAnalyzer);
checkQueryAuth();
checkQueryAuth(viewAnalyzer);
createColumnAndViewDefs(viewAnalyzer);
} finally {
// must reset this flag, otherwise, all following query statement in this connection