pingcap / pingcap/tidb

Privilege check is mistakenly skipped for the plan cache point get special path

Open
#62,159 1 comment 0 reactions 1 assignee Claimed by @time-and-fate View on GitHub
affects-6.1 affects-6.5 affects-7.1 affects-7.5 affects-8.1 affects-8.5 severity/major sig/planner type/bug
Dominant language
Go
Stars
40.5k
Forks
6.2k
PR merge metrics
PR metrics pending

Description

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

conn1
`mysql -h 127.0.0.1 -P 4000 -u root`
```sql
use test;
CREATE USER 'testuser'@'%';
CREATE TABLE test.t1 (a INT, b INT, PRIMARY KEY(a));
GRANT SELECT ON test.t1 TO 'testuser'@'%';
```

conn2
`mysql -h 127.0.0.1 -P 4000 -u testuser`
```sql
use test;
PREPARE stmt1 FROM 'SELECT * FROM test.t1 WHERE a = 0';
EXECUTE stmt1;
```

conn1
```
REVOKE SELECT ON test.t1 FROM 'testuser'@'%';
```

conn2
```
EXECUTE stmt1;
```

### 2. What did you expect to see? (Required)

`ERROR 1142 (42000): SELECT command denied to user 'testuser'@'127.0.0.1' for table 't1'`

### 3. What did you see instead (Required)

Successfully executed.

### 4. What is your TiDB version? (Required)

From v4.0 until the latest nightly (pre v9.0)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.