Document the read privileges CREATE TABLE ... FROM SOURCE requires - #38491
Merged
maheshwarip merged 1 commit intoAug 27, 2026
Merged
Conversation
### Motivation `CREATE TABLE ... FROM SOURCE` populates the new table from an existing ingestion, so creating it reads that source's data. #38480 makes the privilege requirements match that, fixing a case where `CREATE` on the destination schema alone was enough to read a source the role had been denied (SQL-655, 2026 penetration test finding H02). The privileges include for `CREATE TABLE` still lists only the schema and type requirements, so it understates what the statement needs. ### Description Add the read requirement to `create-table.md`, the single include used by all five `CREATE TABLE` pages and by the generated privileges appendix: `SELECT` on the source plus `USAGE` on its schema. The note about scope is the part worth reading. The source is the authorization boundary, so `SELECT` on it permits attaching any reference that source ingests, including references with no existing table and columns some existing table omitted. An admin deciding whether to grant it needs that sentence. Split out from #38480 so that fix, which is an urgent security finding, is not gated on a second CODEOWNERS scope. It is accurate to merge this either before or after #38480: before, it documents a requirement that is about to exist; after, it closes a gap where the docs understate what is enforced. ### Verification Prose only. Rendering is unchanged in shape, four bullets where there were three.
tonydu-mz
force-pushed
the
tonydu/sql-655-docs-create-table-from-source-privileges
branch
from
August 27, 2026 01:37
d02ca65 to
c85b10d
Compare
tonydu-mz
marked this pull request as ready for review
August 27, 2026 02:46
kay-kim
approved these changes
Aug 27, 2026
maheshwarip
deleted the
tonydu/sql-655-docs-create-table-from-source-privileges
branch
August 27, 2026 13:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Document the read privileges CREATE TABLE ... FROM SOURCE requires
Motivation
CREATE TABLE ... FROM SOURCEpopulates the new table from an existingingestion, so creating it reads that source's data.
#38480 makes the privilege requirements match that,
fixing a case where
CREATEon the destination schema alone was enough to reada source the role had been denied (SQL-655, 2026 penetration test finding H02).
The privileges include for
CREATE TABLEstill lists only the schema and typerequirements, so it understates what the statement needs.
Description
Add the read requirement to
create-table.md, the single include used by allfive
CREATE TABLEpages and by the generated privileges appendix:SELECTonthe source plus
USAGEon its schema.The note about scope is the part worth reading. The source is the authorization
boundary, so
SELECTon it permits attaching any reference that source ingests,including references with no existing table and columns some existing table
omitted. An admin deciding whether to grant it needs that sentence.
Split out from #38480 so that fix, which is an urgent security finding, is not
gated on a second CODEOWNERS scope. It is accurate to merge this either before
or after #38480: before, it documents a requirement that is about to exist;
after, it closes a gap where the docs understate what is enforced.
Verification
Prose only. Rendering is unchanged in shape, four bullets where there were three.