database/doris
2
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

[fix](nereids) check table privilege when it's needed (#21130)

Browse Source 
check privilege on LogicalOlapScan, LogicalEsScan, LogicalFileScan and LogicalSchemaScan
This commit is contained in:
starocean999
2023-06-25 18:35:39 +08:00
committed by GitHub
parent 46f0295b78
commit b6c9feb458
1 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
fe/fe-core/src/main/java/org/apache/doris/nereids/rules/analysis/UserAuthentication.java
View File

@ -23,13 +23,23 @@ import org.apache.doris.nereids.exceptions.AnalysisException;
import org.apache.doris.nereids.rules.Rule;
import org.apache.doris.nereids.rules.RuleType;
import org.apache.doris.nereids.trees.plans.Plan;
import org.apache.doris.nereids.trees.plans.logical.LogicalEsScan;
import org.apache.doris.nereids.trees.plans.logical.LogicalFileScan;
import org.apache.doris.nereids.trees.plans.logical.LogicalOlapScan;
import org.apache.doris.nereids.trees.plans.logical.LogicalRelation;
import org.apache.doris.nereids.trees.plans.logical.LogicalSchemaScan;
import org.apache.doris.qe.ConnectContext;
import com.google.common.collect.Sets;
import java.util.Set;
/**
* Check whether a user is permitted to scan specific tables.
*/
public class UserAuthentication extends OneAnalysisRuleFactory {
Set<Class<?>> relationsToCheck = Sets.newHashSet(LogicalOlapScan.class, LogicalEsScan.class,
LogicalFileScan.class, LogicalSchemaScan.class);
@Override
public Rule build() {
@ -43,15 +53,20 @@ public class UserAuthentication extends OneAnalysisRuleFactory {
if (connectContext.getSessionVariable().isPlayNereidsDump()) {
return relation;
}
String dbName = !relation.getQualifier().isEmpty() ? relation.getQualifier().get(0) : null;
String tableName = relation.getTable().getName();
if (!connectContext.getEnv().getAccessManager()
.checkTblPriv(connectContext, dbName, tableName, PrivPredicate.SELECT)) {
String message = ErrorCode.ERR_TABLEACCESS_DENIED_ERROR.formatErrorMsg("SELECT",
ConnectContext.get().getQualifiedUser(), ConnectContext.get().getRemoteIP(),
dbName + ": " + tableName);
throw new AnalysisException(message);
if (relationsToCheck.contains(relation.getClass())) {
String dbName =
!relation.getQualifier().isEmpty() ? relation.getQualifier().get(0) : null;
String tableName = relation.getTable().getName();
if (!connectContext.getEnv().getAccessManager().checkTblPriv(connectContext, dbName,
tableName, PrivPredicate.SELECT)) {
String message = ErrorCode.ERR_TABLEACCESS_DENIED_ERROR.formatErrorMsg("SELECT",
ConnectContext.get().getQualifiedUser(), ConnectContext.get().getRemoteIP(),
dbName + ": " + tableName);
throw new AnalysisException(message);
}
}
return relation;
}
}