Insufficient access control checks in system.metadata.table_comments when redirections enabled

[findepi]

the code

trino/core/trino-main/src/main/java/io/trino/connector/system/TableCommentSystemTable.java

Lines 134 to 157 in 2cbd054

	private Optional<String> getComment(
	Session session,
	QualifiedTablePrefix prefix,
	SchemaTableName name,
	Map<SchemaTableName, ViewInfo> views,
	Map<SchemaTableName, ViewInfo> materializedViews)
	{
	ViewInfo materializedViewDefinition = materializedViews.get(name);
	if (materializedViewDefinition != null) {
	return materializedViewDefinition.getComment();
	}
	ViewInfo viewInfo = views.get(name);
	if (viewInfo != null) {
	return viewInfo.getComment();
	}
	QualifiedObjectName tableName = new QualifiedObjectName(prefix.getCatalogName(), name.getSchemaName(), name.getTableName());
	return metadata.getRedirectionAwareTableHandle(session, tableName).tableHandle()
	.map(handle -> metadata.getTableMetadata(session, handle))
	.map(metadata -> metadata.getMetadata().getComment())
	.orElseGet(() -> {
	// A previously listed table might have been dropped concurrently
	LOG.warn("Failed to get metadata for table: %s", name);
	return Optional.empty();
	});

doesn't consult AccessControl for redirected table.
non-redirected tables are passed thru io.trino.security.AccessControl#filterTables inside io.trino.metadata.MetadataListing#listTables.

[findepi]

@lukasz-walkiewicz can you consider picking this up?

[lukasz-walkiewicz]

I can take a look.

[findepi]

@mosabua @colebow i can't find it. do the docs say whether access control is consulted before redirection, after, or both?

[mosabua]

I dont think we have any security related info about redirection