Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[bug](http) MetaInfoAction.getAllDatabases() leaks unfiltered db list, bypassing SHOW privilege

Open Beginner friendly
  • Is something wrong?
#66,024 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java
Domain
api, security

Research direction

Start in fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/MetaInfoAction.java at getAllDatabases(), then compare the filtering and pagination flow in fe/fe-core/src/main/java/org/apache/doris/httpv2/restv2/MetaInfoActionV2.java. Done means the v1 endpoint sorts and returns only database names permitted by SHOW, without using the unfiltered list in its response.

Written by the indexing model from the issue text.

Description

Summary

MetaInfoAction.getAllDatabases() (the v1 HTTP metadata interface) returns the full list of database names regardless of the caller's SHOW privilege. The privilege-filtered result (dbNameSet) is computed but never used; the method sorts and returns the unfiltered dbNames.

This is distinct from PR #65126 — it is a pre-existing master bug, not introduced by that PR. The only change PR #65126 made to this method was the line:

- List<String> dbNames = catalog.getDbNames();
+ List<String> dbNames = new ArrayList<>(catalog.getDbNames());

which was needed to fix an UnsupportedOperationException after getDbNames() started returning an immutable list. It is unrelated to the privilege-filtering bug.

Affected code

fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/MetaInfoAction.java

List<String> dbNames = new ArrayList<>(catalog.getDbNames());   // L108 all db names
List<String> dbNameSet = Lists.newArrayList();                  // L109
for (String db : dbNames) {
    if (!Env.getCurrentEnv().getAccessManager()
            .checkDbPriv(ConnectContext.get(), InternalCatalog.INTERNAL_CATALOG_NAME, db,
                    PrivPredicate.SHOW)) {
        continue;                                                // skip db without SHOW
    }
    dbNameSet.add(db);                                           // L116 filtered result
}

Collections.sort(dbNames);                                       // L119 sorts dbNames (unfiltered)

Pair<Integer, Integer> fromToIndex = getFromToIndex(request, dbNames.size());
return ResponseEntityBuilder.ok(dbNames.subList(...));           // L123 returns UNFILTERED dbNames

dbNameSet is dead code; the response returns the unfiltered, all-privilege dbNames.

Auth surface / impact

  • checkWithCookie always requires a valid authenticated session (Authorization header or valid cookie), so this is not anonymous access.
  • enable_all_http_auth defaults to false in most deployments. With the default, any authenticated non-admin user hitting /api/meta/{ns}/databases can enumerate every database name in the catalog, bypassing SHOW privilege.
  • When enable_all_http_auth = true, only admin can reach the endpoint, so the leakage is limited to admins.

Impact: information disclosure / privilege bypass at the metadata-enumeration level (database names only; table/column data is gated by other checks).

Correct reference (v2)

MetaInfoActionV2.getAllDatabases() does this correctly — it accumulates into filteredDbNames, sorts it, and returns it:

fe/fe-core/src/main/java/org/apache/doris/httpv2/restv2/MetaInfoActionV2.java (lines ~130–145)

List<String> filteredDbNames = Lists.newArrayList();
// ... checkDbPriv(SHOW) -> filteredDbNames.add(db)
Collections.sort(filteredDbNames);
return ResponseEntityBuilder.ok(filteredDbNames.subList(...));

Suggested fix

Align v1 with v2: return the privilege-filtered (and sorted) dbNameSet / filteredDbNames instead of dbNames, and drop the dead code. This is outside the scope of PR #65126 (external metadata cache refactor) and is tracked separately here.

Related

  • PR #65126 ([refactor](meta cache) Refactor external metadata cache with MetaCacheEntry)
Dominant language
Java
Stars
16k
Forks
4k
Avg merge
2d 1m
Merged PRs (30d)
637

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/doris

All issues in apache/doris

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.