禁止普通账号查询mysql.user (hhyo#1202)

[weideguo]

No description provided.

[request-info]

你好!感谢你反馈的问题/bug，但是你的描述好像是空的，我们需要你完整的信息，这样才能帮你解决问题 如果不知道怎么写，在新建issue的时候有若干个模板可供选择，祝好！

[codecov]

Codecov Report

Merging #1208 (c07e05c) into master (38a1c8c) will decrease coverage by 0.01%.
The diff coverage is 40.00%.

@@            Coverage Diff             @@
##           master    #1208      +/-   ##
==========================================
- Coverage   77.95%   77.94%   -0.02%     
==========================================
  Files          76       76              
  Lines       11963    11968       +5     
==========================================
+ Hits         9326     9328       +2     
- Misses       2637     2640       +3     

Impacted Files	Coverage Δ
sql/query.py	70.32% <40.00%> (-1.02%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 38a1c8c...c07e05c. Read the comment docs.

[LeoQuote]

超级用户也不应该看这个表吧, 在 engine 层全封了吧

[weideguo]

实际还是有可能需要在前端查询表mysql.user的，但确实在engine修改会更优雅一些。
如果要这么做使用以下添加

补丁
mysql.py.20211105.patch

diff --git a/sql/engines/mysql.py b/sql/engines/mysql.py
index 415b426..88a4f23 100644
--- a/sql/engines/mysql.py
+++ b/sql/engines/mysql.py
@@ -191,6 +191,12 @@ class MysqlEngine(EngineBase):
             if explain_result.error:
                 result['bad_query'] = True
                 result['msg'] = explain_result.error
+        # 不应该查看mysql.user表
+        if re.match('.*(\\s)+(mysql|`mysql`)(\\s)*\\.(\\s)*(user|`user`)((\\s)*|;).*',sql.lower().replace('\n','')) or\
+           (db_name=="mysql" and  re.match('.*(\\s)+(user|`user`)((\\s)*|;).*',sql.lower().replace('\n',''))):
+            result['bad_query'] = True
+            result['msg'] = '您无权查看该表'
+
         return result
 
     def filter_sql(self, sql='', limit_num=0):

应用补丁

cd /opt/archery 
patch -p1 < mysql.py.20211105.patch

[LeoQuote]

请提交到 pr吧

[hhyo]

#1222