Knut Anders Hatlen created DERBY-6439:
-----------------------------------------
Summary: Privileges not checked before scalar subquery is
materialized
Key: DERBY-6439
URL: https://issues.apache.org/jira/browse/DERBY-6439
Project: Derby
Issue Type: Bug
Components: SQL
Affects Versions: 10.10.1.1
Reporter: Knut Anders Hatlen
Seen when testing DERBY-6429:
ij version 10.11
ij> connect 'jdbc:derby:memory:db;create=true;user=dbo';
ij> call
syscs_util.syscs_set_database_property('derby.database.sqlAuthorization',
'true');
0 rows inserted/updated/deleted
ij> connect 'jdbc:derby:memory:db;shutdown=true';
ERROR 08006: Database 'memory:db' shutdown.
ij> connect 'jdbc:derby:memory:db;user=u1' as u1;
WARNING 01J14: SQL authorization is being used without first enabling
authentication.
ij(U1)> create table t1(x int);
0 rows inserted/updated/deleted
ij(U1)> create table t2(x int);
0 rows inserted/updated/deleted
ij(U1)> insert into t2 values 1, 2;
2 rows inserted/updated/deleted
ij(U1)> grant update on t1 to u2;
0 rows inserted/updated/deleted
ij(U1)> connect 'jdbc:derby:memory:db;user=u2' as u2;
WARNING 01J14: SQL authorization is being used without first enabling
authentication.
ij(U2)> update u1.t1 set x = (select x from u1.t2);
ERROR 21000: Scalar subquery is only allowed to return a single row.
The UPDATE statement should fail with a privilege error because U2 does not
have SELECT permission on U1.T2.X.
Can also be seen without UPDATE:
ij(U2)> values (select x from u1.s);
ERROR 21000: Scalar subquery is only allowed to return a single row.
--
This message was sent by Atlassian JIRA
(v6.1.5#6160)
