pingcap / pingcap/tidb

CREATE USER ... WITH MAX_QUERIES_PER_HOUR is accepted but TiDB does not enforce the per-user resource limit

Open
#70,994 0 comments 0 reactions 0 assignees View on GitHub
affects-9.0 component/privilege found-by-ai may-affects-25.10 may-affects-26.3 may-affects-7.5 may-affects-8.1 may-affects-8.5 severity/major sig/sql-infra type/bug
Dominant language
Go
Stars
40.5k
Forks
6.2k
PR merge metrics
PR metrics pending

Description

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

```sql
CREATE USER 'repro_res_limit'@'%' IDENTIFIED BY 'p' WITH MAX_QUERIES_PER_HOUR 1;

-- Connect as repro_res_limit:
SELECT 1;
SELECT 1;
```

Probe output:

```text
MYSQL_USER_RC=1
MYSQL_USER_ERR=ERROR 1226 (42000) at line 1: User 'repro_res_limit' has exceeded the 'max_questions' resource (current value: 1)
MYSQL_USER_RESOURCE_LIMIT_ENFORCED

TIDB_USER_RC=0
TIDB_USER_OUT='1'
TIDB_USER_RESOURCE_LIMIT_PATH_OK

TIDB_USER_RC=0
TIDB_USER_OUT='1\n1'
TIDB_USER_RESOURCE_LIMIT_IGNORED
```

MySQL rejects the limited user with error 1226; TiDB allows both queries.

### 2. What did you expect to see? (Required)

A user limited to `MAX_QUERIES_PER_HOUR 1` must be rejected with MySQL error 1226 once the limit is exceeded. If TiDB does not implement the other resource limits, `CREATE USER`/`ALTER USER` must reject those clauses instead of accepting them.

### 3. What did you see instead (Required)

MySQL: limited user SELECT 1; SELECT 1; -> ERROR 1226. TiDB: same user -> 1 and 1 with rc 0.

### 4. What is your TiDB version? (Required)

```text
Release Version: v8.4.0-this-is-a-placeholder
Edition: Community
Git Commit Hash: None
Git Branch: None
UTC Build Time: None
GoVersion: go1.25.12
Race Enabled: false
Check Table Before Drop: false
Store: unistore
Kernel Type: Classic
```

Built from source commit `a514a92784c9654502686e6ee6efc9e0aeda8afa` (pingcap/tidb master, 2026-09-07).

### 5. Root cause (optional)

- pkg/executor/simple.go:107-115 says only MAX_USER_CONNECTIONS is implemented
- pkg/executor/simple.go:840-846 parses maxQueriesPerHour/maxUpdatesPerHour/maxConnectionsPerHour
- pkg/executor/simple.go:1256 and 2132-2138 only use maxUserConnections

Contributor guide

Open the contributing guide

Research direction

Start with the resource-limit comments and parsing paths in pkg/executor/simple.go, especially lines 107-115 and 840-846, then trace the uses around lines 1256 and 2132-2138. Reproduce the issue with the supplied CREATE USER and two SELECT statements. Done means MAX_QUERIES_PER_HOUR is enforced with MySQL error 1226, or unsupported resource-limit clauses are rejected rather than accepted.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, mysql
Domain
databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.