db-derby-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Daniel John Debrunner (JIRA)" <j...@apache.org>
Subject [jira] Updated: (DERBY-2893) INSERT and UPDATES succeed when permission has not been granted.
Date Thu, 05 Jul 2007 17:23:05 GMT

     [ https://issues.apache.org/jira/browse/DERBY-2893?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Daniel John Debrunner updated DERBY-2893:
-----------------------------------------

      Priority: Blocker  (was: Critical)
    Derby Info: [Regression]

I confirmed that adding fail() asserts in the try portion for the assert cases for UPDATE
and INSERT when the privilege was expected not be granted fail on trunk, prior to my cleanup
of the test with revision 552922.

This is an example where  test code like this allowed a serious regression:

try {
  s.execute(command);
}
catch (SQLException e)
{
   assertSQLState("42502", e);
}

That is the test passes if the execution of the statement does not thrown the expected exception,
which should be a failure.

> INSERT and UPDATES succeed when permission has not been granted.
> ----------------------------------------------------------------
>
>                 Key: DERBY-2893
>                 URL: https://issues.apache.org/jira/browse/DERBY-2893
>             Project: Derby
>          Issue Type: Bug
>          Components: Security, SQL
>    Affects Versions: 10.4.0.0
>            Reporter: Daniel John Debrunner
>            Priority: Blocker
>
> GrantRevokeTest had assert methods (assertInsertPrivilege etc.) of the form
> try {
>    s.execute(command)
> } catch (SQLException sqle)
> {
>        if (!hasPrivilege) 
>             assertSQLState("42502", e);
>        else
>              fail(...);
> }
> Note that no fail() assert was in the try portion after the SQL execution. The statement
should not work if hasPrivilege is false, but the test will incorrectly pass if the statement
succeeds. I added fail asserts with revision 552922 like:
> if (!hasPrivilege)
>        fail("expected no INSERT permission on table");
> but these two for INSERT and UPDATE caused the test to fail (about 6 fixtures fail) indicating
that the statement succeeds even if the permission is not granted.
> It could be a test problem but needs some investigation.
> The asserts for assertInsertPrivilege and asserUpdatePrivilege are commented out to stop
the test failing.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message