Use a subquery when filtering information_schema.tables by table_name.

[arthurschreiber]

Summary

This is a workaround for a MySQL bug we've encountered when using a database user that only has been granted SELECT permissions on a subset of the tables that exist in a given database.

When requesting data from the information_schema.tables without specifying a table name explicitly, MySQL only returns data for tables that can be accessed by the current user.

But when requested data with specifying a condition for a specific table, MySQL will return data even if the specified table can not be accessed by the current user.

We found out that using a subquery would make MySQL behave as expected. 🙈

Here's an example:

SELECT table_name FROM information_schema.tables WHERE table_schema = database()

This query will only return table names for tables where the current user has been granted SELECT.

SELECT table_name FROM information_schema.tables WHERE table_schema = database() AND table_name = 'some_table'

This query will return a single row containing 'some_table', if some_table exists but the current user has not been granted SELECT on it.

SELECT table_name FROM (SELECT * FROM information_schema.tables WHERE table_schema = database()) _subquery WHERE _subquery.table_name = 'some_table'

This query will return an empty result set if some_table exists but the current user has not been granted SELECT on it.

Other Information

We're not sure which versions of MySQL are affected by this (we know it exists on MySQL 5.7.28), but the proposed change should be compatible with all versions of MySQL

[arthurschreiber]

/cc @eileencodes

[eileencodes]

Sorry I was unclear on your PR at GitHub. This should point at the master branch and then I'll backport to 6.0.

It looks like there's an issue with this, the mysql2 build is failing

/usr/local/bundle/gems/mysql2-0.5.3/lib/mysql2/client.rb:131:in `_query': Mysql2::Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 (ActiveRecord::StatementInvalid)

[arthurschreiber]

Sorry I was unclear on your PR at GitHub. This should point at the master branch and then I'll backport to 6.0.

I've changed this to point against master. 👍

It looks like there's an issue with this, the mysql2 build is failing

Yeah, there was a typo that I just fixed.

[eileencodes]

I'm trying to think of a way to add a test for this but creating a user in a test to test this would be difficult. Do you know if the bug in mysql is documented? I think we should link to the bug if there is a report for it somewhere.

[arthurschreiber]

Do you know if the bug in mysql is documented?

I don't think it is. I tried googling a bit, but could not find anything. I'll see if I can get around to open a report against MySQL as well.

[arthurschreiber]

I filed a bug report with MySQL at https://bugs.mysql.com/bug.php?id=99981 with an easily reproducible test case. I also tested this against MySQL 8, and it looks like this particular bug was fixed starting 8.0.0.

[eileencodes]

Merged and backported to 6.0 in 0793a14