Repository navigation
fix: parse MySQL account authentication as SHOW CREATE USER prints it - #2863
Merged
manticore-projects merged 1 commit intoOct 28, 2026
Conversation
SHOW CREATE USER prints the authentication plugin as a string literal and, with print_identified_with_as_hex enabled, a hash that contains unprintable characters as a hexadecimal literal. MySQL also accepts CURRENT_USER() wherever a user account is named. The plugin was read only as an identifier, AS took only a string literal, and an account name had no parentheses after CURRENT_USER; ALTER USER CURRENT_USER() also went to the PostgreSQL ALTER ROLE alias. The plugin reuses MySqlAccountNamePart, so it keeps its quote character in UserAuthentication.getPluginName(). The hash after AS may be a HexValue, returned by getCredentialValue(). UserAccount records CURRENT_USER() in user lists; role lists still reject it, as MySQL reads them with role_ident. Signed-off-by: minleejae <mmj9808@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SHOW CREATE USERprints the authentication plugin as a string literal and, withprint_identified_with_as_hexenabled, a hash that contains unprintable characters as a hexadecimal literal, for exampleCREATE USER 'app'@'%' IDENTIFIED WITH 'caching_sha2_password' AS 0x2441…. MySQL also acceptsCURRENT_USER()wherever a user account is named. The parser rejected all three: the plugin was read only as an identifier,AStook only a string literal, and an account name had no parentheses afterCURRENT_USER.ALTER USER CURRENT_USER()was also routed to the PostgreSQLALTER ROLEalias.The plugin now reuses the account-name part production, so it may be unquoted or quoted with
',"or a backtick.UserAuthentication.getPluginName()keeps the quote character andgetPlugin()returns the name. The hash afterASmay be a hexadecimal literal, returned as aHexValuebygetCredentialValue();getCredential()still returns a string-literal credential and is null for a hexadecimal one.UserAccount.isCurrentUserParentheses()recordsCURRENT_USER()in user lists: CREATE, ALTER, DROP and RENAME USER, SET PASSWORD FOR and GRANT … TO. Role lists (CREATE and DROP ROLE, SET ROLE, SET DEFAULT ROLE, granted roles, DEFAULT ROLE) keep rejecting it, because MySQL reads them withrole_ident.Public method signatures are retained. For a backquoted plugin,
getPlugin()now returns the name without its backquotes, as account names do.Syntax reference: MySQL 8.4 CREATE USER, ALTER USER, account names, print_identified_with_as_hex.
Validation:
CreateUserTest,AlterUserTestandMySqlAccountNameTestadd 22 cases. 8 of the 12 statements they parse fail on master5d07ba424; the others pin unquoted names, plainCURRENT_USERand the grantee form that already worked. Further cases pin the rejections: hexadecimal only afterAS, parentheses only after an unquotedCURRENT_USER, andCURRENT_USER()in role lists.check: 12,240 tests, 0 failures, 25 skipped; grammar ambiguity, formatting (Spotless ratchet againstupstream/master), Checkstyle, PMD, SpotBugs and JaCoCo pass. JaCoCo instrumentation headroom ofCCJSqlParser: 967 entries on master, 902 with this change.SHOW CREATE USERoutput of acaching_sha2_passworduser withprint_identified_with_as_hexenabled parses and renders unchanged, and running the rendered statement for another user stores the same plugin and authentication string.ALTER USER CURRENT_USER() IDENTIFIED BY … RETAIN CURRENT PASSWORD,SET PASSWORD FOR CURRENT_USER()and backquoted or double-quoted plugin names are accepted;SET DEFAULT ROLE ALL TO CURRENT_USER()is a syntax error.AI assistance: prepared with Claude Code.