Commits on Apr 27, 2023

1. opt: check privileges after data sources in memo staleness check …

   Previously, the `opt.Metadata` staleness check would check the access
   privileges for a data source immediately after checking that the data
   source still resolves as it originally did. This meant that the privilege
   check for one data source could occur before checking staleness of other
   data sources. Before #96045 this wasn't a problem, since these checks
   would happen in the order in which the data sources were resolved. But
   after #96045, the data sources were stored in a map instead of a slice,
   which made the order in which the checks are performed nondeterministic.
   
   This change in behavior can cause queries to return insufficient privilege
   errors even when the current user has access privileges on all data sources
   referenced by the query. This is because the query may *implicitly*
   reference a table by ID if there is a foreign key relation from an explicitly
   referenced data source. If the database is changed, this ID reference will
   still resolve the same, but if the user is changed to one without privileges
   on that table, the staleness check will result in an error. This wasn't a
   problem before because the referencing table would always be checked first,
   causing the staleness check to finish without an error.
   
   This patch fixes the bug by moving the privilege checks until after all
   data source resolution checks have succeeded.
   
   Fixes #102375
   
   Release note (bug fix): Fixed a bug introduced in versions 22.1.19,
   22.2.8, and pre-release versions of 23.1 that could cause queries to
   return spurious insufficient privilege errors. For the bug to occur,
   two databases would need to have duplicate tables each with a foreign key
   reference to another table. The error would then occur if the same SQL
   string was executed against both databases concurrently by users that have
   privileges over only one of the tables.

   

   DrewKimball committed Apr 27, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 09a105d
   • Browse repository at this point

   Copy the full SHA

   09a105d View commit details

   Browse the repository at this point in the history