You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by kx...@apache.org on 2023/06/25 14:37:59 UTC
[doris] 02/05: [fix](nereids) check table privilege when it's needed (#21130)
This is an automated email from the ASF dual-hosted git repository.
kxiao pushed a commit to branch branch-2.0
in repository https://gitbox.apache.org/repos/asf/doris.git
commit e173d309db63eed01912fae588302c7db9da3c14
Author: starocean999 <40...@users.noreply.github.com>
AuthorDate: Sun Jun 25 18:35:39 2023 +0800
[fix](nereids) check table privilege when it's needed (#21130)
check privilege on LogicalOlapScan, LogicalEsScan, LogicalFileScan and LogicalSchemaScan
---
.../nereids/rules/analysis/UserAuthentication.java | 31 ++++++++++++++++------
1 file changed, 23 insertions(+), 8 deletions(-)
diff --git a/fe/fe-core/src/main/java/org/apache/doris/nereids/rules/analysis/UserAuthentication.java b/fe/fe-core/src/main/java/org/apache/doris/nereids/rules/analysis/UserAuthentication.java
index 48356ea3a4..b88108cbc9 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/nereids/rules/analysis/UserAuthentication.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/nereids/rules/analysis/UserAuthentication.java
@@ -23,13 +23,23 @@ import org.apache.doris.nereids.exceptions.AnalysisException;
import org.apache.doris.nereids.rules.Rule;
import org.apache.doris.nereids.rules.RuleType;
import org.apache.doris.nereids.trees.plans.Plan;
+import org.apache.doris.nereids.trees.plans.logical.LogicalEsScan;
+import org.apache.doris.nereids.trees.plans.logical.LogicalFileScan;
+import org.apache.doris.nereids.trees.plans.logical.LogicalOlapScan;
import org.apache.doris.nereids.trees.plans.logical.LogicalRelation;
+import org.apache.doris.nereids.trees.plans.logical.LogicalSchemaScan;
import org.apache.doris.qe.ConnectContext;
+import com.google.common.collect.Sets;
+
+import java.util.Set;
+
/**
* Check whether a user is permitted to scan specific tables.
*/
public class UserAuthentication extends OneAnalysisRuleFactory {
+ Set<Class<?>> relationsToCheck = Sets.newHashSet(LogicalOlapScan.class, LogicalEsScan.class,
+ LogicalFileScan.class, LogicalSchemaScan.class);
@Override
public Rule build() {
@@ -43,15 +53,20 @@ public class UserAuthentication extends OneAnalysisRuleFactory {
if (connectContext.getSessionVariable().isPlayNereidsDump()) {
return relation;
}
- String dbName = !relation.getQualifier().isEmpty() ? relation.getQualifier().get(0) : null;
- String tableName = relation.getTable().getName();
- if (!connectContext.getEnv().getAccessManager()
- .checkTblPriv(connectContext, dbName, tableName, PrivPredicate.SELECT)) {
- String message = ErrorCode.ERR_TABLEACCESS_DENIED_ERROR.formatErrorMsg("SELECT",
- ConnectContext.get().getQualifiedUser(), ConnectContext.get().getRemoteIP(),
- dbName + ": " + tableName);
- throw new AnalysisException(message);
+
+ if (relationsToCheck.contains(relation.getClass())) {
+ String dbName =
+ !relation.getQualifier().isEmpty() ? relation.getQualifier().get(0) : null;
+ String tableName = relation.getTable().getName();
+ if (!connectContext.getEnv().getAccessManager().checkTblPriv(connectContext, dbName,
+ tableName, PrivPredicate.SELECT)) {
+ String message = ErrorCode.ERR_TABLEACCESS_DENIED_ERROR.formatErrorMsg("SELECT",
+ ConnectContext.get().getQualifiedUser(), ConnectContext.get().getRemoteIP(),
+ dbName + ": " + tableName);
+ throw new AnalysisException(message);
+ }
}
+
return relation;
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org