Derby
  1. Derby
  2. DERBY-4191

Lack of SELECT privilege does not prevent SELECT COUNT(*)

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 10.4.2.0, 10.5.1.1
    • Fix Version/s: 10.3.3.1, 10.4.2.1, 10.5.3.1, 10.6.1.0
    • Component/s: SQL
    • Labels:
      None
    • Urgency:
      Normal
    • Issue & fix info:
      Release Note Needed
    • Bug behavior facts:
      Security, Wrong query result

      Description

      A user that does not have SELECT privilege on a table can still perform a SELECT COUNT on that table. Counting a specific column (e.g., SELECT COUNT(X)) is prevented.

      1. DERBY4191_ColumnLevelCheckInStatmentColumnPerm_diff_patch2.txt
        20 kB
        Mamta A. Satoor
      2. DERBY4191_ColumnLevelCheckInStatmentColumnPerm_stat_patch2.txt
        0.7 kB
        Mamta A. Satoor
      3. DERBY4191_ColumnLevelCheckInStatmentTablePerm_diff_patch1.txt
        20 kB
        Mamta A. Satoor
      4. DERBY4191_countStar_privilege_diff_patch1.txt
        11 kB
        Mamta A. Satoor
      5. DERBY4191_miniumSelectPriv_CursorNode_And_Subquery_diff_patch6.txt
        34 kB
        Mamta A. Satoor
      6. DERBY4191_miniumSelectPriv_CursorNode_And_Subquery_stat_patch6.txt
        0.7 kB
        Mamta A. Satoor
      7. DERBY4191_miniumSelectPrivOnAllTables_And_Subquery_diff_patch5.txt
        34 kB
        Mamta A. Satoor
      8. DERBY4191_miniumSelectPrivOnAllTables_And_Subquery_stat_patch5.txt
        0.8 kB
        Mamta A. Satoor
      9. DERBY4191_miniumSelectPrivOnAllTables_diff_patch3.txt
        24 kB
        Mamta A. Satoor
      10. DERBY4191_miniumSelectPrivOnAllTables_diff_patch4.txt
        25 kB
        Mamta A. Satoor
      11. DERBY4191_miniumSelectPrivOnAllTables_stat_patch3.txt
        0.7 kB
        Mamta A. Satoor
      12. DERBY4191_miniumSelectPrivOnAllTables_stat_patch4.txt
        0.8 kB
        Mamta A. Satoor
      13. releaseNote.html
        4 kB
        Rick Hillegas
      14. releaseNote.html
        3 kB
        Mamta A. Satoor
      15. repro.sql
        0.2 kB
        Knut Anders Hatlen

        Issue Links

          Activity

          No work has yet been logged on this issue.

            People

            • Assignee:
              Mamta A. Satoor
              Reporter:
              Knut Anders Hatlen
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development