wenzhenghu opened a new issue, #66024:
URL: https://github.com/apache/doris/issues/66024
## Summary
`MetaInfoAction.getAllDatabases()` (the v1 HTTP metadata interface) returns
the **full** list of database names regardless of the caller's `SHOW`
privilege. The privilege-filtered result (`dbNameSet`) is computed but never
used; the method sorts and returns the unfiltered `dbNames`.
This is distinct from PR #65126 — it is a **pre-existing master bug**, not
introduced by that PR. The only change PR #65126 made to this method was the
line:
```java
- List<String> dbNames = catalog.getDbNames();
+ List<String> dbNames = new ArrayList<>(catalog.getDbNames());
```
which was needed to fix an `UnsupportedOperationException` after
`getDbNames()` started returning an immutable list. It is unrelated to the
privilege-filtering bug.
## Affected code
`fe/fe-core/src/main/java/org/apache/doris/httpv2/rest/MetaInfoAction.java`
```java
List<String> dbNames = new ArrayList<>(catalog.getDbNames()); // L108 all
db names
List<String> dbNameSet = Lists.newArrayList(); // L109
for (String db : dbNames) {
if (!Env.getCurrentEnv().getAccessManager()
.checkDbPriv(ConnectContext.get(),
InternalCatalog.INTERNAL_CATALOG_NAME, db,
PrivPredicate.SHOW)) {
continue; // skip db
without SHOW
}
dbNameSet.add(db); // L116
filtered result
}
Collections.sort(dbNames); // L119
sorts dbNames (unfiltered)
Pair<Integer, Integer> fromToIndex = getFromToIndex(request, dbNames.size());
return ResponseEntityBuilder.ok(dbNames.subList(...)); // L123
returns UNFILTERED dbNames
```
`dbNameSet` is dead code; the response returns the unfiltered, all-privilege
`dbNames`.
## Auth surface / impact
- `checkWithCookie` always requires a valid authenticated session
(Authorization header or valid cookie), so this is not anonymous access.
- `enable_all_http_auth` defaults to `false` in most deployments. With the
default, **any authenticated non-admin user** hitting
`/api/meta/{ns}/databases` can enumerate every database name in the catalog,
bypassing `SHOW` privilege.
- When `enable_all_http_auth = true`, only admin can reach the endpoint, so
the leakage is limited to admins.
Impact: information disclosure / privilege bypass at the
metadata-enumeration level (database names only; table/column data is gated by
other checks).
## Correct reference (v2)
`MetaInfoActionV2.getAllDatabases()` does this correctly — it accumulates
into `filteredDbNames`, sorts it, and returns it:
`fe/fe-core/src/main/java/org/apache/doris/httpv2/restv2/MetaInfoActionV2.java`
(lines ~130–145)
```java
List<String> filteredDbNames = Lists.newArrayList();
// ... checkDbPriv(SHOW) -> filteredDbNames.add(db)
Collections.sort(filteredDbNames);
return ResponseEntityBuilder.ok(filteredDbNames.subList(...));
```
## Suggested fix
Align v1 with v2: return the privilege-filtered (and sorted) `dbNameSet` /
`filteredDbNames` instead of `dbNames`, and drop the dead code. This is outside
the scope of PR #65126 (external metadata cache refactor) and is tracked
separately here.
## Related
- PR #65126 (`[refactor](meta cache) Refactor external metadata cache with
MetaCacheEntry`)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
