trino
trino copied to clipboard
USE statement leaks names of catalogs and schemas that the user has no access to
Bug notice by @dedep
I have configured File-based Access Control with a rules:
{
"catalogs": []
}
so the only visible catalog should be system
but using USE
statement I can guess what catalogs and schemas exists.
trino> USE tpch.tiny;
USE
trino> USE tpch2.tiny;
Query 20220920_064754_00000_5932c failed: Catalog does not exist: tpch2
trino:tiny> USE tpch.tiny2;
Query 20220920_074144_00000_ibcew failed: Schema does not exist: tpch.tiny2