Uploaded image for project: 'Derby'
  1. Derby
  2. DERBY-3333

User name corresponding to authentication identifier PUBLIC must be rejected

    Details

    • Type: Bug
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 10.0.2.0, 10.0.2.1, 10.1.1.0, 10.1.2.1, 10.1.3.1, 10.2.1.6, 10.2.2.0, 10.3.1.4, 10.3.2.1, 10.4.1.3
    • Fix Version/s: None
    • Component/s: SQL
    • Urgency:
      Normal
    • Issue & fix info:
      Release Note Needed
    • Bug behavior facts:
      Security

      Description

      SQL Standard (foundation) says:

      Section 5.4 SR 20) No <authorization identifier> shall specify "PUBLIC".

      This is a syntax rule which implies a 42xxx SQL state but I wonder if 'invalid authorization specification.' (28xxx) makes more sense?
      Maybe it's 28xxx when used in a connection request and 42xxx in a SQL statement?

      Needs to be disallowed on:
      JDBC connection requests
      GRANT statements, ie. using "PUBLIC" as a delimited identifier.

      Existing application impact if the exists a user with an authorization identifier of PUBLIC in an existing system.

        Attachments

        1. DERBY-3333-roles.diff
          6 kB
          Dag H. Wanvik
        2. DERBY-3333-roles.stat
          0.4 kB
          Dag H. Wanvik

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                djd Daniel John Debrunner
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated: