mrhhsg opened a new pull request, #67343:
URL: https://github.com/apache/doris/pull/67343
### What problem does this PR solve?
Issue Number: None
Related PR: #66218
Problem Summary:
`SHOW DICTIONARIES` and `EXPLAIN DICTIONARY` did not check any privilege. Any
user who can `USE` a database (which only needs a privilege on some table of
that database) could list every dictionary of the database together with its
source table name, status and BE data distribution, and describe its columns.
`REFRESH DICTIONARY` only failed inside the internal `INSERT INTO`, after the
dictionary had been looked up and switched to `LOADING`.
This is inconsistent with `SHOW TABLES`, which hides tables the user cannot
show, and with `CREATE/DROP DICTIONARY`, which already require privileges on
the
dictionary name (#66218).
Dictionaries are authorized like tables of the internal catalog, so:
- `SHOW DICTIONARIES` now skips dictionaries the user has no `SHOW` privilege
on, the same way `SHOW TABLES` filters tables.
- `EXPLAIN DICTIONARY` requires `SHOW` on the dictionary, like `DESCRIBE` on
a
table.
- `REFRESH DICTIONARY` checks `LOAD` on the dictionary up front. This is the
privilege the internal `INSERT INTO` already required, so nobody loses the
ability to refresh; the check now happens before the dictionary is resolved
and before its status is flipped to `LOADING`.
The checks run before the dictionary is looked up, so a denied user cannot
probe whether a dictionary exists either.
### Release note
None
### Check List (For Author)
- Test
- [x] Regression test: `auth_call/test_ddl_dictionary_auth` now covers a
user with a privilege on another table of the database (must not see,
describe or refresh the dictionary), `SHOW_VIEW` on the database (sees
the dictionary and its source table, may describe it, still cannot
refresh), and `LOAD` on the database (may refresh).
- [ ] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- Behavior changed:
- [ ] No.
- [x] Yes. Users without `SHOW` on a dictionary no longer see it in
`SHOW DICTIONARIES` and cannot `EXPLAIN DICTIONARY` it. `REFRESH
DICTIONARY` still needs `LOAD` on the dictionary, but is now rejected
before the dictionary is touched.
- Does this need documentation?
- [ ] No.
- [x] Yes. The privilege requirements of the three statements should be
documented.
https://claude.ai/code/session_01X9KukfTLYxHmP6iYyEnQtW
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
