thevar1able/ClickHouse
1
0
Fork 0
mirror of https://github.com/ClickHouse/ClickHouse.git synced 2024-11-23 08:02:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #64320 from ClickHouse/backport/24.3/64079

Browse Source 
Backport #64079 to 24.3: Fix SQL security access checks with analyzer
This commit is contained in:
robot-ch-test-poll1 2024-05-24 02:53:22 +04:00 committed by GitHub
commit a11519a15b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 48 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Processors/Transforms/buildPushingToViewsChain.cpp
View File

@ -414,7 +414,8 @@ std::optional<Chain> generateViewChain(
out.getInputHeader(),
view_id,
nullptr,
std::move(runtime_stats)});
std::move(runtime_stats),
insert_context});
if (type == QueryViewsLogElement::ViewType::MATERIALIZED)
{
@ -590,7 +591,7 @@ Chain buildPushingToViewsChain(
static QueryPipeline process(Block block, ViewRuntimeData & view, const ViewsData & views_data)
{
const auto & context = views_data.context;
const auto & context = view.context;
/// We create a table with the same name as original table and the same alias columns,
/// but it will contain single block (that is INSERT-ed into main table).

3
src/Processors/Transforms/buildPushingToViewsChain.h
View File

@ -33,6 +33,9 @@ struct ViewRuntimeData
/// Info which is needed for query views log.
std::unique_ptr<QueryViewsLogElement::ViewRuntimeStats> runtime_stats;
/// An overridden context bounded to this view with the correct SQL security grants.
ContextPtr context;
void setException(std::exception_ptr e)
{
exception = e;

3
tests/queries/0_stateless/02884_create_view_with_sql_security_option.reference
View File

@ -24,6 +24,9 @@ OK
2
OK
OK
OK
100
100
===== TestGrants =====
OK
OK

40
tests/queries/0_stateless/02884_create_view_with_sql_security_option.sh
View File

@ -159,6 +159,45 @@ ${CLICKHOUSE_CLIENT} --query "REVOKE SELECT ON $db.test_table FROM $user1"
(( $(${CLICKHOUSE_CLIENT} --user $user2 --query "SELECT * FROM $db.test_mv_4" 2>&1 | grep -c "Not enough privileges") >= 1 )) && echo "OK" || echo "UNEXPECTED"
(( $(${CLICKHOUSE_CLIENT} --query "INSERT INTO $db.test_table VALUES ('foo'), ('bar');" 2>&1 | grep -c "Not enough privileges") >= 1 )) && echo "OK" || echo "UNEXPECTED"
${CLICKHOUSE_CLIENT} --multiquery <<EOF
CREATE TABLE $db.source
(
a UInt64
)
ENGINE = MergeTree
ORDER BY a;
CREATE TABLE $db.destination1
(
a UInt64
)
ENGINE = MergeTree
ORDER BY a;
CREATE TABLE $db.destination2
(
a UInt64
)
ENGINE = MergeTree
ORDER BY a;
CREATE MATERIALIZED VIEW $db.mv1 TO $db.destination1
AS SELECT *
FROM $db.source;
ALTER TABLE $db.mv1 MODIFY DEFINER=default SQL SECURITY DEFINER;
CREATE MATERIALIZED VIEW $db.mv2 TO $db.destination2
AS SELECT *
FROM $db.destination1;
EOF
(( $(${CLICKHOUSE_CLIENT} --user $user2 --query "INSERT INTO source SELECT * FROM generateRandom() LIMIT 100" 2>&1 | grep -c "Not enough privileges") >= 1 )) && echo "OK" || echo "UNEXPECTED"
${CLICKHOUSE_CLIENT} --query "GRANT INSERT ON $db.source TO $user2"
${CLICKHOUSE_CLIENT} --user $user2 --query "INSERT INTO source SELECT * FROM generateRandom() LIMIT 100"
${CLICKHOUSE_CLIENT} --query "SELECT count() FROM destination1"
${CLICKHOUSE_CLIENT} --query "SELECT count() FROM destination2"
echo "===== TestGrants ====="
${CLICKHOUSE_CLIENT} --query "GRANT CREATE ON *.* TO $user1"
@ -192,7 +231,6 @@ ${CLICKHOUSE_CLIENT} --user $user1 --query "
${CLICKHOUSE_CLIENT} --query "GRANT SET DEFINER ON $user2 TO $user1"
echo "===== TestRowPolicy ====="
${CLICKHOUSE_CLIENT} --multiquery <<EOF
CREATE TABLE $db.test_row_t (x Int32, y Int32) ENGINE = MergeTree ORDER BY x;