morrySnow opened a new pull request, #67703: URL: https://github.com/apache/doris/pull/67703
## Problem Statistics collection builds internal SQL from catalog, database, table, index, partition, and column names. Names containing an embedded backtick could terminate a template-owned quoted identifier. Since statistics statements execute through an internal privileged context, the remaining name text could be interpreted as SQL and access objects unavailable to the initiating user. ## Root cause The SQL templates owned the surrounding backticks while callers substituted raw names, or only partially escaped selected column names. This split ownership was inconsistent across full, sampled, partition, external-table, plugin-driven, and histogram collection paths. It also made it easy for a newly added template expression to consume an unescaped name. ## How to reproduce 1. Create a low-privilege user that can create and analyze tables in one database but cannot read a table in another database. 2. In the permitted database, create a table whose quoted name contains an embedded backtick followed by a crafted SQL fragment such as a `UNION` query against the inaccessible table. 3. Trigger synchronous statistics collection for that table. 4. Before this change, the embedded backtick closes the template's identifier and the remaining text is parsed in the privileged statistics context. Values from the inaccessible table can consequently appear in the attacker's statistics rows. ## Fix - Build every object-name fragment with `SqlUtils.getIdentSql`, so embedded backticks are doubled and the complete value remains one identifier. - Make templates consume already quoted identifier fragments instead of adding their own backticks. - Apply the same model to OLAP, external-table, plugin-driven sample, partition, index, and histogram SQL generation. - Keep metadata values used as string literals on a separate SQL-literal escaping path. - Add unit coverage for catalog, database, table, index, partition, and column names containing embedded backticks, including a column name that also contains an apostrophe. ## Tests - `./run-fe-ut.sh --run org.apache.doris.statistics.analysis.OlapAnalysisTaskTest` (25 tests, 0 failures, 0 errors) - `./run-fe-ut.sh --run org.apache.doris.statistics.analysis.HistogramTaskTest` (2 tests, 0 failures, 0 errors) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
