Skip to content

[Bug] TRUNCATE TABLE bypasses authorization when statement catalog differs from session catalog #73271

@ruyliu

Description

@ruyliu

Steps to reproduce the behavior (Required)

-- as 'noauth', no privilege on default_catalog.testdb.t
SET CATALOG ext_iceberg;
TRUNCATE TABLE default_catalog.testdb.t;   -- succeeds; rows are gone

Authorization is evaluated against ext_iceberg.testdb.t, while the DDL
executor truncates the real default_catalog.testdb.t.

Expected behavior (Required)

truncate table default_catalog.testdb.t

Real behavior (Required)

truncate table ext_iceberg.testdb.t

StarRocks version (Required)

  • You can get the StarRocks version by executing SQL select current_version()

Metadata

Metadata

Assignees

No one assigned

    Labels

    type/bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions