fix: support GRANT/REVOKE on VIEW with DEFINER/INVOKER security type#24195
Open
ck89119 wants to merge 11 commits intomatrixorigin:3.0-devfrom
Open
fix: support GRANT/REVOKE on VIEW with DEFINER/INVOKER security type#24195ck89119 wants to merge 11 commits intomatrixorigin:3.0-devfrom
ck89119 wants to merge 11 commits intomatrixorigin:3.0-devfrom
Conversation
1. Fix view access bypass via base table ALL/OWNERSHIP: convert predefined TableAll/TableOwnership entries from bare General entries to Compound entries carrying originViews/directView, so they go through view-chain privilege verification. 2. Fix CREATE SQL SECURITY VIEW ignoring explicit security type: add SecurityType field to tree.CreateView, pass it from parser, and override session variable in plan layer when DDL explicitly specifies it. 3. Fix SHOW CREATE VIEW / ALTER VIEW not preserving security type: splice SecurityType into SHOW output when missing from Stmt; ALTER VIEW now inherits old view's SecurityType when not explicitly specified. 4. Fix DEFINER path not expanding role inheritance: add verifyPrivilegeWithRoleInheritance() to BFS-traverse mo_role_grant when the effective role differs from the session role. 5. Update BVT expected results for changed error message wording.
…behavior SHOW CREATE VIEW should only replay the stored Stmt text as-is, not auto-inject SQL SECURITY. This matches MySQL behavior where SHOW CREATE VIEW only shows SQL SECURITY if the original DDL explicitly included it. Remove findViewKeyword() and the splice logic from buildShowCreateView(). Update BVT tests to use explicit DDL syntax (CREATE SQL SECURITY INVOKER VIEW) instead of session variable for SecurityType verification. Revert the 34 result file changes from the previous commit.
2dfbb9c to
a61614e
Compare
…MySQL compat 1. GRANT ON VIEW with wildcard levels (db.*, *.*, *) now filters WGO check by obj_type (table vs view), preventing table-level WGO from being used to issue view wildcard grants. 2. Restore SHOW CREATE VIEW SQL SECURITY splice logic to match MySQL behavior: MySQL always shows SQL SECURITY in SHOW CREATE VIEW output. Use findViewKeyword() with whitespace boundary matching. Update 34 result files for SQL SECURITY DEFINER in output. 3. Add SHOW CREATE VIEW test for session-variable-created INVOKER view (v_invoker) to cover the implicit SecurityType path.
heni02
approved these changes
Apr 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
Which issue(s) this PR fixes:
issue #24187
What this PR does / why we need it:
Support view-level privilege control with
GRANT/REVOKE ON VIEWsyntax, including:objectTypeViewto distinguish view privileges from table privilegesDEFINERandINVOKERsecurity types for views viaview_security_typesession variableviewChain,directView) in plan nodes for privilege checking at execution timeSecurityTypein view metadata (ViewData)