trino icon indicating copy to clipboard operation
trino copied to clipboard

USE statement leaks names of catalogs and schemas that the user has no access to

Open huberty89 opened this issue 2 years ago • 0 comments

Bug notice by @dedep

I have configured File-based Access Control with a rules:

{
    "catalogs": []
}

so the only visible catalog should be system but using USE statement I can guess what catalogs and schemas exists.

trino> USE tpch.tiny;
USE
trino> USE tpch2.tiny;
Query 20220920_064754_00000_5932c failed: Catalog does not exist: tpch2
trino:tiny> USE tpch.tiny2;
Query 20220920_074144_00000_ibcew failed: Schema does not exist: tpch.tiny2

huberty89 avatar Sep 20 '22 07:09 huberty89