Derby
  1. Derby
  2. DERBY-4191

Lack of SELECT privilege does not prevent SELECT COUNT(*)

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 10.4.2.0, 10.5.1.1
    • Fix Version/s: 10.3.3.1, 10.4.2.1, 10.5.3.1, 10.6.1.0
    • Component/s: SQL
    • Labels:
      None
    • Urgency:
      Normal
    • Issue & fix info:
      Release Note Needed
    • Bug behavior facts:
      Security, Wrong query result

      Description

      A user that does not have SELECT privilege on a table can still perform a SELECT COUNT on that table. Counting a specific column (e.g., SELECT COUNT(X)) is prevented.

      1. DERBY4191_ColumnLevelCheckInStatmentColumnPerm_diff_patch2.txt
        20 kB
        Mamta A. Satoor
      2. DERBY4191_ColumnLevelCheckInStatmentColumnPerm_stat_patch2.txt
        0.7 kB
        Mamta A. Satoor
      3. DERBY4191_ColumnLevelCheckInStatmentTablePerm_diff_patch1.txt
        20 kB
        Mamta A. Satoor
      4. DERBY4191_countStar_privilege_diff_patch1.txt
        11 kB
        Mamta A. Satoor
      5. DERBY4191_miniumSelectPriv_CursorNode_And_Subquery_diff_patch6.txt
        34 kB
        Mamta A. Satoor
      6. DERBY4191_miniumSelectPriv_CursorNode_And_Subquery_stat_patch6.txt
        0.7 kB
        Mamta A. Satoor
      7. DERBY4191_miniumSelectPrivOnAllTables_And_Subquery_diff_patch5.txt
        34 kB
        Mamta A. Satoor
      8. DERBY4191_miniumSelectPrivOnAllTables_And_Subquery_stat_patch5.txt
        0.8 kB
        Mamta A. Satoor
      9. DERBY4191_miniumSelectPrivOnAllTables_diff_patch3.txt
        24 kB
        Mamta A. Satoor
      10. DERBY4191_miniumSelectPrivOnAllTables_diff_patch4.txt
        25 kB
        Mamta A. Satoor
      11. DERBY4191_miniumSelectPrivOnAllTables_stat_patch3.txt
        0.7 kB
        Mamta A. Satoor
      12. DERBY4191_miniumSelectPrivOnAllTables_stat_patch4.txt
        0.8 kB
        Mamta A. Satoor
      13. releaseNote.html
        4 kB
        Rick Hillegas
      14. releaseNote.html
        3 kB
        Mamta A. Satoor
      15. repro.sql
        0.2 kB
        Knut Anders Hatlen

        Issue Links

          Activity

          Knut Anders Hatlen made changes -
          Link This issue is related to DERBY-6411 [ DERBY-6411 ]
          Gavin made changes -
          Workflow jira [ 12461856 ] Default workflow, editable Closed status [ 12802407 ]
          Gavin made changes -
          Link This issue is depended upon by DERBY-4522 [ DERBY-4522 ]
          Gavin made changes -
          Link This issue blocks DERBY-4522 [ DERBY-4522 ]
          Knut Anders Hatlen made changes -
          Status Resolved [ 5 ] Closed [ 6 ]
          Mike Matrigali made changes -
          Status Reopened [ 4 ] Resolved [ 5 ]
          Resolution Fixed [ 1 ]
          Lily Wei made changes -
          Resolution Fixed [ 1 ]
          Status Closed [ 6 ] Reopened [ 4 ]
          Lily Wei made changes -
          Link This issue is required by DERBY-4728 [ DERBY-4728 ]
          Mamta A. Satoor made changes -
          Fix Version/s 10.3.3.1 [ 12313143 ]
          Mamta A. Satoor made changes -
          Fix Version/s 10.4.2.1 [ 12313401 ]
          Mamta A. Satoor made changes -
          Fix Version/s 10.5.3.1 [ 12314182 ]
          Knut Anders Hatlen made changes -
          Status Resolved [ 5 ] Closed [ 6 ]
          Rick Hillegas made changes -
          Attachment releaseNote.html [ 12442312 ]
          Mamta A. Satoor made changes -
          Status Open [ 1 ] Resolved [ 5 ]
          Resolution Fixed [ 1 ]
          Kim Haase made changes -
          Component/s Documentation [ 11406 ]
          Kim Haase made changes -
          Link This issue blocks DERBY-4522 [ DERBY-4522 ]
          Mamta A. Satoor made changes -
          Component/s Documentation [ 11406 ]
          Mamta A. Satoor made changes -
          Attachment releaseNote.html [ 12430699 ]
          Mamta A. Satoor made changes -
          Fix Version/s 10.6.0.0 [ 12313727 ]
          Issue & fix info [Release Note Needed, Patch Available] [Release Note Needed]
          Mamta A. Satoor made changes -
          Issue & fix info [Patch Available] [Patch Available, Release Note Needed]
          Mamta A. Satoor made changes -
          Mamta A. Satoor made changes -
          Issue & fix info [Patch Available]
          Mamta A. Satoor made changes -
          Mamta A. Satoor made changes -
          Mamta A. Satoor made changes -
          Assignee Mamta A. Satoor [ mamtas ]
          Rick Hillegas made changes -
          Bug behavior facts [Security, Wrong query result]
          Urgency Normal
          Knut Anders Hatlen made changes -
          Field Original Value New Value
          Attachment repro.sql [ 12406524 ]
          Knut Anders Hatlen created issue -

            People

            • Assignee:
              Mamta A. Satoor
              Reporter:
              Knut Anders Hatlen
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development