You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iotdb.apache.org by ja...@apache.org on 2025/02/11 01:20:15 UTC
(iotdb) branch master updated: fix auth parser error with grant all on root.** from non-root user.
This is an automated email from the ASF dual-hosted git repository.
jackietien pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/master by this push:
new 2eea334b93c fix auth parser error with grant all on root.** from non-root user.
2eea334b93c is described below
commit 2eea334b93ca3a5d2478b3998dc8c44aedd0d9e4
Author: Colin Lee <10...@users.noreply.github.com>
AuthorDate: Tue Feb 11 09:20:09 2025 +0800
fix auth parser error with grant all on root.** from non-root user.
---
.../org/apache/iotdb/db/it/auth/IoTDBAuthIT.java | 25 ++++++++++++++++++++++
.../db/queryengine/plan/parser/ASTVisitor.java | 3 +++
.../plan/parser/StatementGeneratorTest.java | 3 +++
3 files changed, 31 insertions(+)
diff --git a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
index 277dda1fa10..a03f0333e22 100644
--- a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
+++ b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
@@ -21,6 +21,7 @@ package org.apache.iotdb.db.it.auth;
import org.apache.iotdb.commons.auth.entity.PrivilegeType;
import org.apache.iotdb.commons.schema.column.ColumnHeaderConstant;
+import org.apache.iotdb.db.it.utils.TestUtils;
import org.apache.iotdb.it.env.EnvFactory;
import org.apache.iotdb.it.framework.IoTDBTestRunner;
import org.apache.iotdb.itbase.category.ClusterIT;
@@ -155,6 +156,30 @@ public class IoTDBAuthIT {
Assert.assertThrows(
SQLException.class,
() -> userStmt.execute("GRANT USER tempuser PRIVILEGES WRITE_SCHEMA ON root.a"));
+
+ adminStmt.execute("GRANT ALL ON root.** TO USER tempuser WITH GRANT OPTION");
+ userStmt.execute("CREATE USER testuser 'password'");
+ userStmt.execute("GRANT ALL ON root.** TO USER testuser WITH GRANT OPTION");
+ ResultSet dataSet = userStmt.executeQuery("LIST PRIVILEGES OF USER testuser");
+
+ Set<String> ansSet =
+ new HashSet<>(
+ Arrays.asList(
+ ",,MANAGE_USER,true,",
+ ",,MANAGE_ROLE,true,",
+ ",,USE_TRIGGER,true,",
+ ",,USE_UDF,true,",
+ ",,USE_CQ,true,",
+ ",,USE_PIPE,true,",
+ ",,USE_MODEL,true,",
+ ",,EXTEND_TEMPLATE,true,",
+ ",,MANAGE_DATABASE,true,",
+ ",,MAINTAIN,true,",
+ ",root.**,READ_DATA,true,",
+ ",root.**,WRITE_DATA,true,",
+ ",root.**,READ_SCHEMA,true,",
+ ",root.**,WRITE_SCHEMA,true,"));
+ TestUtils.assertResultSetEqual(dataSet, "Role,Scope,Privileges,GrantOption,", ansSet);
}
}
}
diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java
index 23288a8cb35..6735b4c0a5d 100644
--- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java
+++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java
@@ -2521,6 +2521,9 @@ public class ASTVisitor extends IoTDBSqlParserBaseVisitor<Statement> {
continue;
} else if (priv.equalsIgnoreCase("ALL")) {
for (PrivilegeType type : PrivilegeType.values()) {
+ if (type.isRelationalPrivilege()) {
+ continue;
+ }
privSet.add(type.toString());
}
continue;
diff --git a/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/parser/StatementGeneratorTest.java b/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/parser/StatementGeneratorTest.java
index 06b51954d53..30024d5e59c 100644
--- a/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/parser/StatementGeneratorTest.java
+++ b/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/parser/StatementGeneratorTest.java
@@ -783,6 +783,9 @@ public class StatementGeneratorTest {
// 1. test complex privilege on single path :"root.**"
Set<String> allPriv = new HashSet<>();
for (PrivilegeType type : PrivilegeType.values()) {
+ if (type.isRelationalPrivilege()) {
+ continue;
+ }
allPriv.add(type.toString());
}