information_schema.placement_policies allows unauthorized data access
- Dominant language
- Go
- Stars
- 40.5k
- Forks
- 6.2k
- PR merge metrics
- PR metrics pending
Description
## Bug Report
Please answer these questions before submitting your issue. Thanks!
### 1. Minimal reproduce step (Required)
```
-- connect as root
CREATE PLACEMENT POLICY `p_root_secret`
LEADER_CONSTRAINTS='["+idc=Root-Tokyo"]'
FOLLOWER_CONSTRAINTS='["+idc=Root-Tokyo"]'
FOLLOWERS=2;
-- -- connect as foo
SELECT POLICY_NAME, PRIMARY_REGION, REGIONS, CONSTRAINTS
FROM information_schema.placement_policies
WHERE POLICY_NAME = 'p_root_secret';
```
### 2. What did you expect to see? (Required)
```
MySQL [(none)]> SELECT POLICY_NAME, PRIMARY_REGION, REGIONS, CONSTRAINTS
-> FROM information_schema.placement_policies
-> WHERE POLICY_NAME = 'p_root_secret';
Empty set (0.001 sec)
```
### 3. What did you see instead (Required)
```
MySQL [(none)]> SELECT POLICY_NAME, PRIMARY_REGION, REGIONS, CONSTRAINTS
-> FROM information_schema.placement_policies
-> WHERE POLICY_NAME = 'p_root_secret';
+---------------+----------------+---------+-------------+
| POLICY_NAME | PRIMARY_REGION | REGIONS | CONSTRAINTS |
+---------------+----------------+---------+-------------+
| p_root_secret | | | |
+---------------+----------------+---------+-------------+
1 row in set (0.001 sec)
```
### 4. What is your TiDB version? (Required)
```
Release Version: v9.0.0-beta.1
Edition: Community
Git Commit Hash: 7aff918dcbfa6facf2adef9ade9961c40f217421
Git Branch: HEAD
UTC Build Time: 2025-03-24 09:09:55
GoVersion: go1.23.7
Race Enabled: false
Check Table Before Drop: false
Store: unistore
```
Contributor guide
Assessment
This issue has not been assessed yet.