Add missing SELECT grant check in mergeTreeProjection table function#95480
Merged
alexey-milovidov merged 1 commit intomasterfrom Jan 29, 2026
Merged
Add missing SELECT grant check in mergeTreeProjection table function#95480alexey-milovidov merged 1 commit intomasterfrom
mergeTreeProjection table function#95480alexey-milovidov merged 1 commit intomasterfrom
Conversation
The `mergeTreeProjection` table function was missing an access check, allowing users without SELECT permission on a table to read data from its projections. This fix adds the same access check that `mergeTreeIndex` and `mergeTreeAnalyzeIndexes` already have. Also adds tests for grant checking on all MergeTree introspection functions: `mergeTreeAnalyzeIndexes`, `mergeTreeAnalyzeIndexesUUID`, `mergeTreeIndex`, and `mergeTreeProjection`. Co-Authored-By: Claude Opus 4.5 <[email protected]>
Contributor
|
Workflow [PR], commit [fa3cf80] Summary: ❌
|
Member
|
Looks good. Clean one-liner fix following the same pattern as The CI failure (AST fuzzer) appears to be the known issue #83614, unrelated to this change. This review was drafted by an AI assistant (Claude) on behalf of @pufit. |
pufit
approved these changes
Jan 29, 2026
Member
pufit
left a comment
There was a problem hiding this comment.
Dead Internet Theory
Looks good to me, but I would remove some of the AI comments - they are good to get initial thoughts when you are reviewing AI suggestions, but afterwards they might become overwhelming for other contributors. Some obvious ones, like # Grant SELECT permission above grant queries, are unnecessary. But this is my opinion only.
Member
Author
|
These comments are in tests, I see it as okay. |
robot-clickhouse
added a commit
that referenced
this pull request
Jan 29, 2026
…Projection` table function
robot-clickhouse
added a commit
that referenced
this pull request
Jan 29, 2026
…eProjection` table function
robot-clickhouse
added a commit
that referenced
this pull request
Jan 29, 2026
…eProjection` table function
robot-clickhouse
added a commit
that referenced
this pull request
Jan 29, 2026
…eProjection` table function
robot-clickhouse
added a commit
that referenced
this pull request
Jan 29, 2026
…Projection` table function
clickhouse-gh bot
added a commit
that referenced
this pull request
Jan 29, 2026
Backport #95480 to 26.1: Add missing SELECT grant check in `mergeTreeProjection` table function
clickhouse-gh bot
added a commit
that referenced
this pull request
Feb 19, 2026
Backport #95480 to 25.11: Add missing SELECT grant check in `mergeTreeProjection` table function
pufit
added a commit
that referenced
this pull request
Feb 23, 2026
Backport #95480 to 25.12: Add missing SELECT grant check in `mergeTreeProjection` table function
pufit
added a commit
that referenced
this pull request
Feb 23, 2026
Backport #95480 to 25.8: Add missing SELECT grant check in `mergeTreeProjection` table function
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
mergeTreeProjectiontable function was missing an access check, allowing users without SELECT permission on a table to read data from its projections. This fix adds the same access check thatmergeTreeIndexandmergeTreeAnalyzeIndexesalready have.Also adds tests for grant checking on all MergeTree introspection functions:
mergeTreeAnalyzeIndexes,mergeTreeAnalyzeIndexesUUID,mergeTreeIndex, andmergeTreeProjection.Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):
The
mergeTreeProjectiontable function was missing an access check, allowing users without SELECT permission on a table (but with permissions for table functions) to read data from its projections. This fix adds the same access check thatmergeTreeIndexandmergeTreeAnalyzeIndexesalready have.