cockroachdb / cockroachdb/cockroach

sql: VIEWACTIVITYREDACTED leaks indexed column values through crdb_internal.ranges_no_leases

Open
#106,682 1 comment 0 reactions 1 assignee Claimed by @xinhaoz View on GitHub
A-cluster-observability A-sql-privileges C-bug T-observability
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**Describe the problem**

A user with only the role option `VIEWACTIVITYREDACTED` should only see non-sensitive information.

However, the following API surfaces will leak **range keys** which contain literal values from indexed columns:

- `crdb_internal.ranges`
- `crdb_internal.ranges_no_leases`
- `SHOW RANGES`
- anything else that happens to list range keys under the hood

**Expected behavior**

Either these surfaces are not available under the role option `VIEWACTIVITYREDACTED`, or they hide the range keys.

:warning: beware of a naive implementation that only hides the column values "at the end of the processing". An user with just VIEWACTIVITYREDACTED could then still use a query execution trace to reveal the values.

xref #103443

Jira issue: CRDB-29676

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.