morrySnow opened a new pull request, #67880: URL: https://github.com/apache/doris/pull/67880
## Problem A server-side prepared point query can keep a direct short-circuit execution context across executions. If the user's SELECT access or a row-filter/data-mask policy changes after the context is created, direct reuse must not execute with the earlier security decisions. ## Root cause The prepared-statement fast path checked table schema, table name, partition topology, and a relevant session limit before reusing `ShortCircuitQueryContext`. It then called the direct executor without running the normal Nereids privilege and policy analysis passes. The retained context did not capture those security dependencies, so it had no way to detect that authorization had changed. ## Reproduction 1. Enable server-side prepared statements and prepare an eligible unique-key point lookup as a non-administrator user. 2. Execute it twice so the short-circuit context is retained and reused. 3. Add a restrictive row policy, or revoke SELECT from the user. 4. Execute the same prepared statement again. Before this change, the direct cached path could continue using the plan created under the old decisions. ## Fix - Record the planning user identity and exact table/column SELECT checks independently of SQL result-cache settings. - Record complete row-filter results and data-mask results, including empty/no-mask answers so newly added policies are observable. - Snapshot those dependencies when creating the retained short-circuit context and revalidate them before every direct reuse. - Reject reuse when the identity differs, a dependency is missing, a table no longer resolves, authorization is denied, a policy differs, or the authorization source fails. The statement then returns to normal planning for the authoritative check and standard error handling. - Keep the validation fail-closed when the planning identity or privilege dependency was not captured. ## Tests - `./run-fe-ut.sh --run org.apache.doris.nereids.SecurityDependencyContextTest,org.apache.doris.qe.ShortCircuitQueryContextTest,org.apache.doris.nereids.trees.plans.commands.ExecuteCommandTest` (22 tests passed) - `cd fe && mvn -pl fe-core checkstyle:check` (0 violations) - `DISABLE_BUILD_UI=ON ./build.sh --fe` - `prepared_short_circuit_security_refresh` regression suite on a deployed FE, including an EXPLAIN assertion for `SHORT-CIRCUIT`, row-policy add/drop, and SELECT revoke/grant using the same server-prepared statement -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
