Skip to content

Get rid of the unnecessary permissions for implicit domains #8937

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dyemanov wants to merge 4 commits into
base: master
Choose a base branch
from
+63 −47
Open

Get rid of the unnecessary permissions for implicit domains #8937

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8d98b5d
Remove security class and user privileges from the domain being dropp…
dyemanov Mar 10, 2026
eb42053
Fix TDBB_dont_post_dfw usage for procedures/functions. Don't grant US…
dyemanov Mar 10, 2026
d6056d6
Correction after Alex's review
dyemanov Mar 10, 2026
5e4283a
Cleanup, thanks to Alex
dyemanov Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 57 additions & 45 deletions src/dsql/DdlNodes.epp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1111,8 +1111,16 @@ void DdlNode::storeGlobalField(thread_db* tdbb, jrd_tra* transaction, QualifiedN
Arg::Gds(isc_dsql_max_arr_dim_exceeded));
}

bool implicitDomain = false;

if (name.object.isEmpty())
{
DYN_UTIL_generate_field_name(tdbb, name);
implicitDomain = true;
}

// Avoid the security class being assigned for implicit domains
AutoSetRestoreFlag<ULONG> noSecurityClass(&tdbb->tdbb_flags, implicitDomain ? TDBB_no_security_class : 0, true);

AutoCacheRequest requestHandle(tdbb, drq_s_fld_src, DYN_REQUESTS);

Expand Down Expand Up @@ -1198,7 +1206,8 @@ void DdlNode::storeGlobalField(thread_db* tdbb, jrd_tra* transaction, QualifiedN
}
}

storePrivileges(tdbb, transaction, name, obj_field, USAGE_PRIVILEGES);
if (!implicitDomain)
storePrivileges(tdbb, transaction, name, obj_field, USAGE_PRIVILEGES);
}


Expand Down Expand Up @@ -1900,7 +1909,7 @@ void CreateAlterFunctionNode::execute(thread_db* tdbb, DsqlCompilerScratch* dsql
}
else if (alter)
{
if (executeAlter(tdbb, dsqlScratch, transaction, false, true))
if (executeAlter(tdbb, dsqlScratch, transaction, false, false, true))
altered = true;
else
{
Expand All @@ -1915,26 +1924,22 @@ void CreateAlterFunctionNode::execute(thread_db* tdbb, DsqlCompilerScratch* dsql

fb_assert(id);
auto* permanent = MetadataCache::newVersion<Cached::Function>(tdbb, id);

try
{
auto* prc = permanent ? permanent->getVersioned(tdbb, CacheFlag::NOCOMMIT | CacheFlag::MINISCAN) : nullptr;
{
bool dummy = false;
AutoSetRestore compiling(prc ? &(prc->compiling) : &dummy, true);
AutoSetRestore compiling(prc ? &prc->compiling : &dummy, true);

compile(tdbb, dsqlScratch);
}

{ // scope
// avoid modify routine dfw during second pass on CREATE
AutoSetRestoreFlag<ULONG> noDfw(&tdbb->tdbb_flags, altered ? 0 : TDBB_dont_post_dfw, true);

// second pass
if (alterIndividualParameters)
executeAlterIndividualParameters(tdbb, dsqlScratch, transaction, true, false);
else
executeAlter(tdbb, dsqlScratch, transaction, true, false);
}
// second pass
if (alterIndividualParameters)
executeAlterIndividualParameters(tdbb, dsqlScratch, transaction, true, false);
else
executeAlter(tdbb, dsqlScratch, transaction, !altered, true, false);

if (name.package.isEmpty())
{
Expand Down Expand Up @@ -2034,18 +2039,15 @@ bool CreateAlterFunctionNode::executeCreate(thread_db* tdbb, DsqlCompilerScratch
if (name.package.isEmpty())
storePrivileges(tdbb, transaction, name, obj_udf, EXEC_PRIVILEGES);

// avoid modify routine dfw when execute CREATE
AutoSetRestoreFlag<ULONG> noDfw(&tdbb->tdbb_flags, TDBB_dont_post_dfw, true);

executeAlter(tdbb, dsqlScratch, transaction, false, false);
executeAlter(tdbb, dsqlScratch, transaction, true, false, false);

return true;
}

bool CreateAlterFunctionNode::executeAlter(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch,
jrd_tra* transaction, bool secondPass, bool runTriggers)
jrd_tra* transaction, bool create, bool secondPass, bool runTriggers)
{
Attachment* const attachment = transaction->getAttachment();
const auto attachment = transaction->getAttachment();

bool modified = false;
unsigned returnPos = 0;
Expand Down Expand Up @@ -2075,6 +2077,9 @@ bool CreateAlterFunctionNode::executeAlter(thread_db* tdbb, DsqlCompilerScratch*
MetadataCache::oldVersion<Cached::Function>(tdbb, id, CacheFlag::OLD_ALTER);
}

// Avoid modify routine dfw when execute CREATE
AutoSetRestoreFlag<ULONG> noDfw(&tdbb->tdbb_flags, create ? TDBB_dont_post_dfw : 0, true);

MODIFY FUN
if (secondPass)
{
Expand Down Expand Up @@ -2235,14 +2240,16 @@ bool CreateAlterFunctionNode::executeAlter(thread_db* tdbb, DsqlCompilerScratch*

if (!secondPass && modified)
{
// Get all comments and defaults from the old parameter list.
// Get all comments and defaults from the old parameter list

CollectedParameterMap collectedParameters;
collectParameters(tdbb, transaction, collectedParameters);

// delete all old arguments
// Delete all old arguments ...

DropFunctionNode::dropArguments(tdbb, transaction, name);

// and insert the new ones
// ... and insert the new ones

if (returnType && returnType->type)
storeArgument(tdbb, dsqlScratch, transaction, returnPos, true, returnType, NULL);
Expand All @@ -2266,7 +2273,7 @@ bool CreateAlterFunctionNode::executeAlter(thread_db* tdbb, DsqlCompilerScratch*
bool CreateAlterFunctionNode::executeAlterIndividualParameters(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch,
jrd_tra* transaction, bool secondPass, bool runTriggers)
{
Attachment* const attachment = transaction->getAttachment();
const auto attachment = transaction->getAttachment();

bool modified = false;

Expand Down Expand Up @@ -2974,7 +2981,7 @@ void CreateAlterProcedureNode::execute(thread_db* tdbb, DsqlCompilerScratch* dsq
}
else if (alter)
{
if (executeAlter(tdbb, dsqlScratch, transaction, false, true))
if (executeAlter(tdbb, dsqlScratch, transaction, false, false, true))
altered = true;
else
{
Expand All @@ -2989,26 +2996,22 @@ void CreateAlterProcedureNode::execute(thread_db* tdbb, DsqlCompilerScratch* dsq

fb_assert(id);
auto* permanent = MetadataCache::newVersion<Cached::Procedure>(tdbb, id);

try
{
auto* prc = permanent ? permanent->getVersioned(tdbb, CacheFlag::NOCOMMIT | CacheFlag::MINISCAN) : nullptr;
{
bool dummy = false;
AutoSetRestore compiling(prc ? &(prc->compiling) : &dummy, true);
AutoSetRestore compiling(prc ? &prc->compiling : &dummy, true);

compile(tdbb, dsqlScratch);
}

{ // scope
// avoid modify routine dfw during second pass on CREATE
AutoSetRestoreFlag<ULONG> noDfw(&tdbb->tdbb_flags, altered ? 0 : TDBB_dont_post_dfw, true);

// second pass
if (alterIndividualParameters)
executeAlterIndividualParameters(tdbb, dsqlScratch, transaction, true, false);
else
executeAlter(tdbb, dsqlScratch, transaction, true, false);
}
// second pass
if (alterIndividualParameters)
executeAlterIndividualParameters(tdbb, dsqlScratch, transaction, true, false);
else
executeAlter(tdbb, dsqlScratch, transaction, !altered, true, false);

if (name.package.isEmpty())
{
Expand Down Expand Up @@ -3101,18 +3104,16 @@ bool CreateAlterProcedureNode::executeCreate(thread_db* tdbb, DsqlCompilerScratc
if (name.package.isEmpty())
storePrivileges(tdbb, transaction, name, obj_procedure, EXEC_PRIVILEGES);

// avoid modify routine dfw when execute CREATE
AutoSetRestoreFlag<ULONG> noDfw(&tdbb->tdbb_flags, TDBB_dont_post_dfw, true);

executeAlter(tdbb, dsqlScratch, transaction, false, false);
executeAlter(tdbb, dsqlScratch, transaction, true, false, false);

return true;
}

bool CreateAlterProcedureNode::executeAlter(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch,
jrd_tra* transaction, bool secondPass, bool runTriggers)
jrd_tra* transaction, bool create, bool secondPass, bool runTriggers)
{
Attachment* const attachment = transaction->getAttachment();
const auto attachment = transaction->getAttachment();

AutoCacheRequest requestHandle(tdbb, drq_m_prcs2, DYN_REQUESTS);
bool modified = false;

Expand Down Expand Up @@ -3141,6 +3142,9 @@ bool CreateAlterProcedureNode::executeAlter(thread_db* tdbb, DsqlCompilerScratch
MetadataCache::oldVersion<Cached::Procedure>(tdbb, id, CacheFlag::OLD_ALTER);
}

// Avoid modify routine dfw when execute CREATE
AutoSetRestoreFlag<ULONG> noDfw(&tdbb->tdbb_flags, create ? TDBB_dont_post_dfw : 0, true);

MODIFY P
if (secondPass)
{
Expand Down Expand Up @@ -3227,14 +3231,16 @@ bool CreateAlterProcedureNode::executeAlter(thread_db* tdbb, DsqlCompilerScratch

if (!secondPass && modified)
{
// Get all comments and defaults from the old parameter list.
// Get all comments and defaults from the old parameter list

CollectedParameterMap collectedParameters;
collectParameters(tdbb, transaction, collectedParameters);

// Delete all old input and output parameters.
// Delete all old input and output parameters ...

DropProcedureNode::dropParameters(tdbb, transaction, name);

// And insert the new ones.
// ... and insert the new ones

for (FB_SIZE_T i = 0; i < parameters.getCount(); ++i)
{
Expand Down Expand Up @@ -3314,7 +3320,7 @@ bool CreateAlterProcedureNode::executeAlter(thread_db* tdbb, DsqlCompilerScratch
bool CreateAlterProcedureNode::executeAlterIndividualParameters(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch,
jrd_tra* transaction, bool secondPass, bool runTriggers)
{
Attachment* const attachment = transaction->getAttachment();
const auto attachment = transaction->getAttachment();

bool modified = false;

Expand Down Expand Up @@ -10894,6 +10900,12 @@ void DropRelationNode::deleteGlobalField(thread_db* tdbb, jrd_tra* transaction,
ARG.RDB$FIELD_SOURCE EQ FLD.RDB$FIELD_NAME)
{
DropDomainNode::deleteDimensionRecords(tdbb, transaction, globalName);

if (!FLD.RDB$SECURITY_CLASS.NULL)
deleteSecurityClass(tdbb, transaction, FLD.RDB$SECURITY_CLASS);

deletePrivilegesByRelName(tdbb, transaction, globalName, obj_field);

ERASE FLD;
}
END_FOR
Expand Down
4 changes: 2 additions & 2 deletions src/dsql/DdlNodes.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -442,7 +442,7 @@ class CreateAlterFunctionNode final : public DdlNode

bool executeCreate(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch, jrd_tra* transaction);
bool executeAlter(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch, jrd_tra* transaction,
bool secondPass, bool runTriggers);
bool create, bool secondPass, bool runTriggers);
bool executeAlterIndividualParameters(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch, jrd_tra* transaction,
bool secondPass, bool runTriggers);

Expand Down Expand Up @@ -590,7 +590,7 @@ class CreateAlterProcedureNode final : public DdlNode
private:
bool executeCreate(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch, jrd_tra* transaction);
bool executeAlter(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch, jrd_tra* transaction,
bool secondPass, bool runTriggers);
bool create, bool secondPass, bool runTriggers);
bool executeAlterIndividualParameters(thread_db* tdbb, DsqlCompilerScratch* dsqlScratch, jrd_tra* transaction,
bool secondPass, bool runTriggers);

Expand Down
1 change: 1 addition & 0 deletions src/jrd/tdbb.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,7 @@ inline constexpr ULONG TDBB_dfw_cleanup = 4096; // DFW cleanup phase is activ
inline constexpr ULONG TDBB_repl_in_progress = 8192; // Prevent recursion in replication
inline constexpr ULONG TDBB_replicator = 16384; // Replicator
inline constexpr ULONG TDBB_async = 32768; // Async context (set in AST)
inline constexpr ULONG TDBB_no_security_class = 65536; // don't assign a security class to the object being created

class thread_db final : public Firebird::ThreadData
{
Expand Down
3 changes: 3 additions & 0 deletions src/jrd/vio.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7183,6 +7183,9 @@ static bool set_security_class(thread_db* tdbb, Record* record, USHORT field_id)
**************************************/
dsc desc1;

if (tdbb->tdbb_flags & TDBB_no_security_class)
return false;

if (!EVL_field(0, record, field_id, &desc1))
{
const SINT64 value = DYN_UTIL_gen_unique_id(tdbb, drq_g_nxt_sec_id, SQL_SECCLASS_GENERATOR);
Expand Down
Loading