Issue Details (XML | Word | Printable)

Key: CORE-6335
Type: Bug Bug
Status: Resolved Resolved
Resolution: Fixed
Priority: Minor Minor
Assignee: Dmitry Yemanov
Reporter: Dmitry Yemanov
Votes: 0
Watchers: 3
Operations

If you were logged in you would be able to see more operations.
Firebird Core

INSERT ... RETURNING does not require a SELECT privilege

Created: 17/Jun/20 10:30 AM   Updated: 30/Jun/20 09:19 AM
Component/s: Engine
Affects Version/s: 2.5.1, 2.5.2, 2.5.2 Update 1, 2.5.3, 2.5.3 Update 1, 2.5.4, 2.5.5, 4.0 Initial, 3.0.0, 2.5.6, 3.0.1, 2.5.7, 3.0.2, 4.0 Alpha 1, 2.5.8, 3.0.3, 3.0.4, 4.0 Beta 1, 2.5.9, 3.0.5, 4.0 Beta 2
Fix Version/s: 4.0 RC 1

QA Status: Covered by another test(s)
Test Details:
See functional/tabloid/dml-privileges-sufficiency.fbt


 Description  « Hide
While UPDATE ... RETURNING and DELETE ... RETURNING require a SELECT privilege, INSERT ... RETURNING does not enforce that. It may look logical from the first glance, as there is usually no implicit cursor (that always exists for UPDATE/DELETE) and there's no OLD context for INSERT, so you can read only values from the row being inserted by yourself. However, some fields may be assigned implicitly (DEFAULT clause, GENERATED AS IDENTITY clause, BEFORE INSERT triggers) and the fact they can be read using the RETURNING clause looks like a minor security issue.

RETURNING is a non-standard extension, but the SQl specification includes <data change delta table> which is derived from rows changed by INSERT/UPDATE/DELETE statements, And it's explicitly specified that any column referenced in <data change delta table> require a SELECT permission on the target table for underlying INSERT/UPDATE/DELETE.

I suspect there may be a backward compatibility issue for those using INSERT ... RETURNING <generated PK> without a SELECT privilege granted. Thus backporting into v3 is questionable, I need other opinions in this regard.

 All   Comments   Change History   Subversion Commits      Sort Order: Ascending order - Click to sort in descending order
Jiri Cincura added a comment - 30/Jun/20 09:15 AM
Probably good for 4.0 only. Given it has been like this for some versions, I don't think it's a good idea to backport to 3.0.