[bug](http) MetaInfoAction.getAllDatabases() leaks unfiltered db list, bypassing SHOW privilege

[wenzhenghu]

Summary

MetaInfoAction.getAllDatabases() (the v1 HTTP metadata interface) returns the full list of database names regardless of the caller's SHOW privilege. The privilege-filtered result (dbNameSet) is computed but never used; the method sorts and returns the unfiltered dbNames.

This is distinct from PR #65126 — it is a pre-existing master bug, not introduced by that PR. The only change PR #65126 made to this method was the line:

- List<String> dbNames = catalog.getDbNames();
+ List<String> dbNames = new ArrayList<>(catalog.getDbNames());

which was needed to fix an UnsupportedOperationException after getDbNames() started returning an immutable list. It is unrelated to the privilege-filtering bug.

Affected code

fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/MetaInfoAction.java

List<String> dbNames = new ArrayList<>(catalog.getDbNames());   // L108 all db names
List<String> dbNameSet = Lists.newArrayList();                  // L109
for (String db : dbNames) {
    if (!Env.getCurrentEnv().getAccessManager()
            .checkDbPriv(ConnectContext.get(), InternalCatalog.INTERNAL_CATALOG_NAME, db,
                    PrivPredicate.SHOW)) {
        continue;                                                // skip db without SHOW
    }
    dbNameSet.add(db);                                           // L116 filtered result
}

Collections.sort(dbNames);                                       // L119 sorts dbNames (unfiltered)

Pair<Integer, Integer> fromToIndex = getFromToIndex(request, dbNames.size());
return ResponseEntityBuilder.ok(dbNames.subList(...));           // L123 returns UNFILTERED dbNames

dbNameSet is dead code; the response returns the unfiltered, all-privilege dbNames.

Auth surface / impact

• checkWithCookie always requires a valid authenticated session (Authorization header or valid cookie), so this is not anonymous access.
• enable_all_http_auth defaults to false in most deployments. With the default, any authenticated non-admin user hitting /api/meta/{ns}/databases can enumerate every database name in the catalog, bypassing SHOW privilege.
• When enable_all_http_auth = true, only admin can reach the endpoint, so the leakage is limited to admins.

Impact: information disclosure / privilege bypass at the metadata-enumeration level (database names only; table/column data is gated by other checks).

Correct reference (v2)

MetaInfoActionV2.getAllDatabases() does this correctly — it accumulates into filteredDbNames, sorts it, and returns it:

fe/fe-core/src/main/java/org/apache/doris/httpv2/restv2/MetaInfoActionV2.java (lines ~130–145)

List<String> filteredDbNames = Lists.newArrayList();
// ... checkDbPriv(SHOW) -> filteredDbNames.add(db)
Collections.sort(filteredDbNames);
return ResponseEntityBuilder.ok(filteredDbNames.subList(...));

Suggested fix

Align v1 with v2: return the privilege-filtered (and sorted) dbNameSet / filteredDbNames instead of dbNames, and drop the dead code. This is outside the scope of PR #65126 (external metadata cache refactor) and is tracked separately here.

Related

• PR [refactor](meta cache) Refactor external metadata cache with MetaCacheEntry #65126 ([refactor](meta cache) Refactor external metadata cache with MetaCacheEntry)

[Doris-Breakwater]

Breakwater initial analysis

Verdict: confirmed, actionable authorization bug. This is a deterministic control-flow error in the v1 FE HTTP handler, not a hypothesis that needs logs or a Doris profile to validate.

What the code confirms

• On the checked master (27cb451229c), MetaInfoAction.getAllDatabases() obtains every name from catalog.getDbNames(), correctly evaluates SHOW for each name, and appends allowed names to dbNameSet. It then ignores that result: sorting, pagination sizing, and the returned subList all use the original unfiltered dbNames.
• checkWithCookie(..., false) does not mean unauthenticated access. BaseController.checkWithCookie still validates either the Authorization header or a PALO_SESSION_ID session and installs the authenticated identity in ConnectContext; the boolean controls the additional admin/node check. Config.enable_all_http_auth defaults to false.
• With that default, a valid restricted user can therefore discover database names for which SHOW fails. With enable_all_http_auth=true, this handler additionally calls checkAdminAuth, so restricted users are rejected before enumeration.
• The scoped disclosure is database-name existence through this method. The v1 table-list and schema paths have separate table privilege checks.
• Current history supports the report's attribution: blame shows the filtered-list construction and the unfiltered sort/return have coexisted since the original endpoint implementation in 2020. The mutable-copy adjustment discussed in PR [refactor](meta cache) Refactor external metadata cache with MetaCacheEntry #65126 only prevents sorting an immutable source list and does not create this privilege bypass.
• This is in scope under the repository threat model: a restricted authenticated user is an in-scope actor, and discovering objects outside grant scope is explicitly an RBAC violation. Severity/CVE handling should still be decided through the project's security process.

Important fix detail

The v2 implementation is a correct reference for using the filtered list, but it should not be copied literally for catalog authorization. Both v1 and v2 currently call:

checkDbPriv(..., InternalCatalog.INTERNAL_CATALOG_NAME, db, PrivPredicate.SHOW)

even when {ns} names an external catalog. Since AccessControllerManager.checkDbPriv selects/checks authorization using the supplied catalog, this can check grants for an internal database with the same name instead of the requested external catalog. That can produce both false denial and cross-catalog name disclosure.

The v1 fix should therefore:

1. Normalize default_cluster to InternalCatalog.INTERNAL_CATALOG_NAME once as catalogName.
2. Use catalogName for both catalog lookup and checkDbPriv.
3. Collect into a clearly named filteredDbNames, sort that new list, compute pagination from filteredDbNames.size(), and return its subList.
4. Avoid sorting the collection returned by catalog.getDbNames(); this also makes the fix compatible with immutable name snapshots without an otherwise unnecessary mutable copy.

The same hard-coded catalog argument should be audited in MetaInfoActionV2.getAllDatabases() and MetaInfoActionV2.getTables() as follow-up/same-fix scope.

Tests recommended before merge

• With enable_all_http_auth=false, authenticate as a non-admin user that has SHOW on one database but not another; the v1 endpoint must return only the allowed database.
• A user with no applicable database privilege must receive an empty list.
• Exercise limit and offset with hidden names before/between visible names to prove pagination is applied after filtering and cannot reveal or distort results.
• Cover both default_cluster/internal-catalog normalization and an external catalog, verifying that the requested catalog name is passed to authorization.
• Preserve the enable_all_http_auth=true admin-only behavior.
• Add a focused regression for the equivalent hard-coded-catalog issue in v2 if it is fixed in the same change.

Missing information / maintainer follow-up

• The issue currently has no labels, type, assignee, milestone, or linked fix. Please add the appropriate FE/HTTP bug and security-triage metadata according to project convention.
• The exact supported-release/backport matrix is not stated. The bug is present on checked master and is historically old, so supported release branches containing this endpoint should be inspected rather than assuming only master is affected.
• A black-box reproduction transcript is absent, but it is not blocking confirmation because the source path is conclusive. It would still be useful as the basis of the regression test.
• No logs, runtime profile, or additional environment details are needed for root-cause confirmation. If external catalogs are intentionally unsupported by this v1 database-list route, that contract should be enforced explicitly; otherwise the catalog-aware privilege check above is required.

Please route the security-sensitive RBAC bypass according to SECURITY.md while coordinating the public issue.

Breakwater-GitHub-Analysis-Slot: slot_e15af872105b