{"action":"created","issue":{"url":"https://api.github.com/repos/scylladb/scylla/issues/1790","repository_url":"https://api.github.com/repos/scylladb/scylla","labels_url":"https://api.github.com/repos/scylladb/scylla/issues/1790/labels{/name}","comments_url":"https://api.github.com/repos/scylladb/scylla/issues/1790/comments","events_url":"https://api.github.com/repos/scylladb/scylla/issues/1790/events","html_url":"https://github.com/scylladb/scylla/issues/1790","id":185753851,"number":1790,"title":"can crash the database with a GRANT command","user":{"login":"glommer","id":331197,"avatar_url":"https://avatars.githubusercontent.com/u/331197?v=3","gravatar_id":"","url":"https://api.github.com/users/glommer","html_url":"https://github.com/glommer","followers_url":"https://api.github.com/users/glommer/followers","following_url":"https://api.github.com/users/glommer/following{/other_user}","gists_url":"https://api.github.com/users/glommer/gists{/gist_id}","starred_url":"https://api.github.com/users/glommer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glommer/subscriptions","organizations_url":"https://api.github.com/users/glommer/orgs","repos_url":"https://api.github.com/users/glommer/repos","events_url":"https://api.github.com/users/glommer/events{/privacy}","received_events_url":"https://api.github.com/users/glommer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-10-27T19:05:52Z","updated_at":"2016-10-27T20:17:28Z","closed_at":null,"body":"We can easily crash the database with a GRANT command.\r\n\r\nSteps:\r\n* Create a user: create user Test with password 'xxxxxxxxxxxxxxxxxxxxx' NOSUPERUSER;\r\n* grant permissions on a non-existent resource: grant select on test_ks to Test\r\n\r\nThat also happens if the column family exists but we don't specify the ks explicitly."},"comment":{"url":"https://api.github.com/repos/scylladb/scylla/issues/comments/256756770","html_url":"https://github.com/scylladb/scylla/issues/1790#issuecomment-256756770","issue_url":"https://api.github.com/repos/scylladb/scylla/issues/1790","id":256756770,"user":{"login":"penberg","id":81939,"avatar_url":"https://avatars.githubusercontent.com/u/81939?v=3","gravatar_id":"","url":"https://api.github.com/users/penberg","html_url":"https://github.com/penberg","followers_url":"https://api.github.com/users/penberg/followers","following_url":"https://api.github.com/users/penberg/following{/other_user}","gists_url":"https://api.github.com/users/penberg/gists{/gist_id}","starred_url":"https://api.github.com/users/penberg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/penberg/subscriptions","organizations_url":"https://api.github.com/users/penberg/orgs","repos_url":"https://api.github.com/users/penberg/repos","events_url":"https://api.github.com/users/penberg/events{/privacy}","received_events_url":"https://api.github.com/users/penberg/received_events","type":"User","site_admin":false},"created_at":"2016-10-27T20:17:28Z","updated_at":"2016-10-27T20:17:28Z","body":"Actually, turns out we have the right validation, but we simply hit that damned `assert` before we get there. The `data_resource` class tries to be too smart with validation and makes the valid case of user specifying a table resource without an explicit keyspace (that either fails validation or uses the default keyspace at upper layers) impossible.\r\n\r\nAnyway, I sent a patch to the mailing list."}}
{"actor":{"display_login":"penberg"}}