Tarantool development patches archive
 help / color / mirror / Atom feed
From: Kirill Yukhin <kyukhin@tarantool.org>
To: vdavydov.dev@gmail.com
Cc: tarantool-patches@freelists.org, Kirill Yukhin <kyukhin@tarantool.org>
Subject: [PATCH v2 0/4] Check read access while executing SQL query
Date: Thu, 25 Oct 2018 11:17:08 +0300	[thread overview]
Message-ID: <cover.1540388902.git.kyukhin@tarantool.org> (raw)

Since SQL front-end is not using box API,
no checkes for read access are performed by VDBE engine.
Fix this by introducing dedicated opcode which is executed
to perform read access check.
Note, that there's is no need to perform DML/DDL checkes as
they're performed by Tarantool's core.

Closes #2362
---
https://github.com/tarantool/tarantool/commits/kyukhin/gh-2362-sql-read-access-check
https://github.com/tarantool/tarantool/issues/2362
https://travis-ci.org/tarantool/tarantool/builds/445664874

Changes against v1:
  - Split addition of space_name->space_ptr mapping into 3 patches:
    a. Refactor cache replace/delete machinery.
    b. Introduce space_by_name() API.
    c. Use new API throughout SQL front-end.
  - Change argument order for space_cache_replace().
  - Move assert() into space_cache_replace(), make it return void.

Kirill Yukhin (4):
  schema: refactor space_cache API
  schema: add space names cache
  sql: use space_by_name in SQL
  sql: check read access while executing SQL query

 src/box/alter.cc                               |  26 +++---
 src/box/schema.cc                              | 108 ++++++++++++++++++------
 src/box/schema.h                               |  17 ++--
 src/box/sql/alter.c                            |  11 ++-
 src/box/sql/analyze.c                          |  44 ++++------
 src/box/sql/build.c                            |  57 +++++--------
 src/box/sql/delete.c                           |  26 +++---
 src/box/sql/insert.c                           |   7 +-
 src/box/sql/pragma.c                           |  32 +++----
 src/box/sql/vdbe.c                             |   5 ++
 test/box/stat.result                           |   6 +-
 test/sql/gh-2362-select-access-rights.result   | 110 +++++++++++++++++++++++++
 test/sql/gh-2362-select-access-rights.test.lua |  42 ++++++++++
 13 files changed, 326 insertions(+), 165 deletions(-)
 create mode 100644 test/sql/gh-2362-select-access-rights.result
 create mode 100644 test/sql/gh-2362-select-access-rights.test.lua

-- 
2.11.0

             reply	other threads:[~2018-10-25  8:17 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-25  8:17 Kirill Yukhin [this message]
2018-10-25  8:17 ` [PATCH v2 1/4] schema: refactor space_cache API Kirill Yukhin
2018-10-25 14:48   ` Vladimir Davydov
2018-10-25 15:31     ` Kirill Yukhin
2018-10-25 16:09       ` Vladimir Davydov
2018-10-25  8:17 ` [PATCH v2 2/4] schema: add space names cache Kirill Yukhin
2018-10-26 20:55   ` Vladimir Davydov
2018-11-01 11:34     ` [tarantool-patches] " Konstantin Osipov
2018-10-25  8:17 ` [PATCH v2 3/4] sql: use space_by_name in SQL Kirill Yukhin
2018-10-26 21:00   ` Vladimir Davydov
2018-10-25  8:17 ` [PATCH v2 4/4] sql: check read access while executing SQL query Kirill Yukhin
2018-10-26 21:04   ` Vladimir Davydov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=cover.1540388902.git.kyukhin@tarantool.org \
    --to=kyukhin@tarantool.org \
    --cc=tarantool-patches@freelists.org \
    --cc=vdavydov.dev@gmail.com \
    --subject='Re: [PATCH v2 0/4] Check read access while executing SQL query' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox