pingcap/tidb

set session level `sql_require_primary_key` didn't check privilege

Open

#61,825 建立於 2025年6月19日

在 GitHub 查看
 (4 留言) (0 反應) (0 負責人)Go (40,090 star) (6,186 fork)batch import
good first issueseverity/moderatesig/sql-infratype/bug

描述

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

mysql> CREATE USER 'test'@'%' IDENTIFIED BY '';
Query OK, 0 rows affected (0.027 sec)

$ mysql -u test -h 127.0.0.1 -P 4000
...
mysql> set sql_require_primary_key = 0;
Query OK, 0 rows affected (0.000 sec)

mysql> set global sql_require_primary_key = 0;
ERROR 1227 (42000): Access denied; you need (at least one of) the SUPER or SYSTEM_VARIABLES_ADMIN privilege(s) for this operation

2. What did you expect to see? (Required)

both session and global level should fail. https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html#sysvar_sql_require_primary_key

3. What did you see instead (Required)

session level has no error

4. What is your TiDB version? (Required)

at least v8.5.2

貢獻者指南

技術棧
gomysql
領域
databasesecurity
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-3 hours
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
fresh
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
basic Gofamiliarity with TiDB privilege system
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
65
研究方向
Investigate the session level setter for `sql require primary key` in TiDB's codebase. Compare with the global setter that correctly denies the operation. Look in `sessionctx/variable` or `privilege` packages for privilege check functions. The fix likely involves adding a privilege check call in the session setter path.
set session level `sql_require_primary_key` didn't check privilege · pingcap/tidb#61825 | Good First Issue