量词比较

chusql-server/src/ChuSQL/Server/Backend.hs

@@ -292,6 +292,7 @@ exprTables expr = case expr of
     ScalarSub sub -> statementTables (subqueryStatement sub)
     ExistsSub sub _ -> statementTables (subqueryStatement sub)
     InSub value sub _ -> exprTables value ++ statementTables (subqueryStatement sub)
+    QuantCmp _ value sub _ -> exprTables value ++ statementTables (subqueryStatement sub)
     InList value items _ -> concatMap exprTables (value : items)
     Add a b -> both a b
     Sub a b -> both a b

chusql-server/test/Spec.hs

@@ -670,6 +670,15 @@ privilegeSpec = describe "server privileges" $ do
         authorizeSql service (Ordinary testAccount) "SELECT name FROM users WHERE id >= (SELECT id FROM orders)"
             `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON orders")
 
+    it "requires the privilege on the table inside a quantifier subquery" $ withPrivileges $ \service root -> do
+        _ <- runPrivilegeCommand service root testDatabase (CreateRoleCommand "reader")
+        _ <- runPrivilegeCommand service root testDatabase (GrantPrivilegesCommand ["select"] "users" "reader" False)
+        _ <- runPrivilegeCommand service root testDatabase (GrantRoleCommand "reader" ["alice"])
+        authorizeSql service (Ordinary testAccount) "SELECT name FROM users WHERE id > ANY (SELECT id FROM users)"
+            `shouldReturn` Right ()
+        authorizeSql service (Ordinary testAccount) "SELECT name FROM users WHERE id > ANY (SELECT id FROM orders)"
+            `shouldReturn` Left (PrivilegeError "forbidden" "permission denied: SELECT ON orders")
+
     it "keeps the role tables on the real storage" $ withIpcStorage $ do
         base <- ipcBackend
         service <- newPrivileges base