Avoid drop root user. (#4885)

vesoft-inc · Nov 18, 2022 · afaf442 · afaf442
1 parent 099c6f1
commit afaf442
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 0 deletions.
diff --git a/src/graph/validator/ACLValidator.cpp b/src/graph/validator/ACLValidator.cpp
@@ -5,8 +5,10 @@
 
 #include "graph/validator/ACLValidator.h"
 
+#include "common/base/Status.h"
 #include "graph/planner/plan/Admin.h"
 #include "graph/service/PermissionManager.h"
+#include "graph/validator/Validator.h"
 
 namespace nebula {
 namespace graph {
@@ -44,6 +46,16 @@ Status DropUserValidator::validateImpl() {
   return Status::OK();
 }
 
+Status DropUserValidator::checkPermission() {
+  auto r = Validator::checkPermission();
+  NG_RETURN_IF_ERROR(r);
+  const auto *sentence = static_cast<const DropUserSentence *>(sentence_);
+  if (*sentence->getAccount() == "root") {
+    return Status::SemanticError("Can't drop root user.");
+  }
+  return Status::OK();
+}
+
 Status DropUserValidator::toPlan() {
   auto sentence = static_cast<DropUserSentence *>(sentence_);
   return genSingleNodePlan<DropUser>(sentence->getAccount(), sentence->ifExists());

diff --git a/src/graph/validator/ACLValidator.h b/src/graph/validator/ACLValidator.h
@@ -33,6 +33,8 @@ class DropUserValidator final : public Validator {
  private:
   Status validateImpl() override;
 
+  Status checkPermission() override;
+
   Status toPlan() override;
 };
 

diff --git a/tests/tck/features/bugfix/DropRootUser.feature b/tests/tck/features/bugfix/DropRootUser.feature
@@ -0,0 +1,12 @@
+# Copyright (c) 2022 vesoft inc. All rights reserved.
+#
+# This source code is licensed under Apache 2.0 License.
+Feature: Test drop root user
+
+  # #4879
+  Scenario: Drop root user
+    When executing query:
+      """
+      DROP USER root
+      """
+    Then a SemanticError should be raised at runtime: Can't drop root user.