pingcap / pingcap/tidb

missing privilege check for function `tidb_decode_sql_digests` when plan cache is enabled

Open
#49,321 0 comments 0 reactions 1 assignee Claimed by @hawkingrei View on GitHub
severity/moderate sig/planner type/bug
Dominant language
Go
Stars
40.5k
Forks
6.2k
PR merge metrics
PR metrics pending

Description

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

Prepare row

```
mysql> create table t1(a varchar(128));
Query OK, 0 rows affected (0.03 sec)

mysql> insert into t values('["e5796985ccafe2f71126ed6c0ac939ffa015a8c0744a24b7aee6d587103fd2f7"]');
Query OK, 1 row affected (0.00 sec)

mysql> create user u1 IDENTIFIED BY '';
Query OK, 0 rows affected (0.02 sec)

mysql> grant select on *.* to u1;
Query OK, 0 rows affected (0.01 sec)

mysql> grant process on *.* to u1;
Query OK, 0 rows affected (0.01 sec)
```

login in another session with u1: `mysql --comments --host 127.0.0.1 -P4000 -uu1`

```mysql
> set @@tidb_enable_prepared_plan_cache=1;
> use test;
> prepare s from "select tidb_decode_sql_digests(a) from t";
> execute s;
--- in root session revoke process privilege by `revoke process on *.* from u1`
> execute s;
```

### 2. What did you expect to see? (Required)

The second `execute` should fail with "Access denied" error because privilege is revoked

```
mysql> execute s;
+----------------------------+
| tidb_decode_sql_digests(a) |
+----------------------------+
| ["select * from `t`"] |
+----------------------------+
1 row in set (0.00 sec)

mysql> execute s;
ERROR 1227 (42000): Access denied; you need (at least one of) the PROCESS privilege(s) for this operation
```

### 3. What did you see instead (Required)

The second `execute` still successed

```
mysql> execute s;
+----------------------------+
| tidb_decode_sql_digests(a) |
+----------------------------+
| ["select * from `t`"] |
+----------------------------+
1 row in set (0.00 sec)

mysql> execute s;
+----------------------------+
| tidb_decode_sql_digests(a) |
+----------------------------+
| ["select * from `t`"] |
+----------------------------+
1 row in set (0.01 sec)
```

### 4. What is your TiDB version? (Required)

master

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.