Uploaded image for project: 'Derby'
  1. Derby
  2. DERBY-4191

Lack of SELECT privilege does not prevent SELECT COUNT(*)

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 10.4.2.0, 10.5.1.1
    • Fix Version/s: 10.3.3.1, 10.4.2.1, 10.5.3.1, 10.6.1.0
    • Component/s: SQL
    • Labels:
      None
    • Urgency:
      Normal
    • Issue & fix info:
      Release Note Needed
    • Bug behavior facts:
      Security, Wrong query result

      Description

      A user that does not have SELECT privilege on a table can still perform a SELECT COUNT on that table. Counting a specific column (e.g., SELECT COUNT(X)) is prevented.

        Attachments

        1. repro.sql
          0.2 kB
          Knut Anders Hatlen
        2. releaseNote.html
          3 kB
          Mamta A. Satoor
        3. releaseNote.html
          4 kB
          Rick Hillegas
        4. DERBY4191_miniumSelectPrivOnAllTables_stat_patch4.txt
          0.8 kB
          Mamta A. Satoor
        5. DERBY4191_miniumSelectPrivOnAllTables_stat_patch3.txt
          0.7 kB
          Mamta A. Satoor
        6. DERBY4191_miniumSelectPrivOnAllTables_diff_patch4.txt
          25 kB
          Mamta A. Satoor
        7. DERBY4191_miniumSelectPrivOnAllTables_diff_patch3.txt
          24 kB
          Mamta A. Satoor
        8. DERBY4191_miniumSelectPrivOnAllTables_And_Subquery_stat_patch5.txt
          0.8 kB
          Mamta A. Satoor
        9. DERBY4191_miniumSelectPrivOnAllTables_And_Subquery_diff_patch5.txt
          34 kB
          Mamta A. Satoor
        10. DERBY4191_miniumSelectPriv_CursorNode_And_Subquery_stat_patch6.txt
          0.7 kB
          Mamta A. Satoor
        11. DERBY4191_miniumSelectPriv_CursorNode_And_Subquery_diff_patch6.txt
          34 kB
          Mamta A. Satoor
        12. DERBY4191_countStar_privilege_diff_patch1.txt
          11 kB
          Mamta A. Satoor
        13. DERBY4191_ColumnLevelCheckInStatmentTablePerm_diff_patch1.txt
          20 kB
          Mamta A. Satoor
        14. DERBY4191_ColumnLevelCheckInStatmentColumnPerm_stat_patch2.txt
          0.7 kB
          Mamta A. Satoor
        15. DERBY4191_ColumnLevelCheckInStatmentColumnPerm_diff_patch2.txt
          20 kB
          Mamta A. Satoor

          Issue Links

            Activity

              People

              • Assignee:
                mamtas Mamta A. Satoor
                Reporter:
                knutanders Knut Anders Hatlen
              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: