Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[bug](http) MetaInfoAction.getAllDatabases() leaks unfiltered db list, bypassing SHOW privilege

Abierto Apto para principiantes
  • ¿Algo no está bien?
#66,024 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Tranquilo
Stack tecnológico
java
Área
api, security

Línea de trabajo

Comienza en fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/MetaInfoAction.java, en getAllDatabases(), y luego compara el flujo de filtrado y paginación en fe/fe-core/src/main/java/org/apache/doris/httpv2/restv2/MetaInfoActionV2.java. Se considera terminado cuando el endpoint v1 ordena y devuelve únicamente los nombres de bases de datos permitidos por SHOW, sin utilizar la lista sin filtrar en su respuesta.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

MetaInfoAction.getAllDatabases() (the v1 HTTP metadata interface) returns the full list of database names regardless of the caller's SHOW privilege. The privilege-filtered result (dbNameSet) is computed but never used; the method sorts and returns the unfiltered dbNames.

This is distinct from PR #65126 — it is a pre-existing master bug, not introduced by that PR. The only change PR #65126 made to this method was the line:

- List<String> dbNames = catalog.getDbNames();
+ List<String> dbNames = new ArrayList<>(catalog.getDbNames());

which was needed to fix an UnsupportedOperationException after getDbNames() started returning an immutable list. It is unrelated to the privilege-filtering bug.

Affected code

fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/MetaInfoAction.java

List<String> dbNames = new ArrayList<>(catalog.getDbNames());   // L108 all db names
List<String> dbNameSet = Lists.newArrayList();                  // L109
for (String db : dbNames) {
    if (!Env.getCurrentEnv().getAccessManager()
            .checkDbPriv(ConnectContext.get(), InternalCatalog.INTERNAL_CATALOG_NAME, db,
                    PrivPredicate.SHOW)) {
        continue;                                                // skip db without SHOW
    }
    dbNameSet.add(db);                                           // L116 filtered result
}

Collections.sort(dbNames);                                       // L119 sorts dbNames (unfiltered)

Pair<Integer, Integer> fromToIndex = getFromToIndex(request, dbNames.size());
return ResponseEntityBuilder.ok(dbNames.subList(...));           // L123 returns UNFILTERED dbNames

dbNameSet is dead code; the response returns the unfiltered, all-privilege dbNames.

Auth surface / impact

  • checkWithCookie always requires a valid authenticated session (Authorization header or valid cookie), so this is not anonymous access.
  • enable_all_http_auth defaults to false in most deployments. With the default, any authenticated non-admin user hitting /api/meta/{ns}/databases can enumerate every database name in the catalog, bypassing SHOW privilege.
  • When enable_all_http_auth = true, only admin can reach the endpoint, so the leakage is limited to admins.

Impact: information disclosure / privilege bypass at the metadata-enumeration level (database names only; table/column data is gated by other checks).

Correct reference (v2)

MetaInfoActionV2.getAllDatabases() does this correctly — it accumulates into filteredDbNames, sorts it, and returns it:

fe/fe-core/src/main/java/org/apache/doris/httpv2/restv2/MetaInfoActionV2.java (lines ~130–145)

List<String> filteredDbNames = Lists.newArrayList();
// ... checkDbPriv(SHOW) -> filteredDbNames.add(db)
Collections.sort(filteredDbNames);
return ResponseEntityBuilder.ok(filteredDbNames.subList(...));

Suggested fix

Align v1 with v2: return the privilege-filtered (and sorted) dbNameSet / filteredDbNames instead of dbNames, and drop the dead code. This is outside the scope of PR #65126 (external metadata cache refactor) and is tracked separately here.

Related

  • PR #65126 ([refactor](meta cache) Refactor external metadata cache with MetaCacheEntry)
Lenguaje dominante
Java
Estrellas
16k
Forks
4k
Merge medio
2 d 22 h
PR fusionados (30 d)
671

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/doris

Todos los issues de apache/doris

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.