SET SESSION AUTHORIZATION allows an unrpivileged user to bypass resource limits

CREATE USER goodguy WITH MAX_QUERIES_PER_HOUR 2;

CREATE USER cheater WITH MAX_QUERIES_PER_HOUR 2;

--connect (con1,localhost,goodguy,,)

SELECT 1 AS goodguy_1;

SELECT 2 AS goodguy_2;

--error ER_USER_LIMIT_REACHED

SELECT 3 AS goodguy_3;

--disconnect con1

--connect (con1,localhost,cheater,,)

SET SESSION AUTHORIZATION cheater@localhost;

SELECT 1 AS cheater_1;

SELECT 2 AS cheater_2;

--echo # Now it should start failing, but it works

SELECT 3 AS cheater_3;

SELECT 4 AS cheater_4;

--disconnect con1

--connection default

DROP USER goodguy;

DROP USER cheater;

SELECT 1 AS goodguy_1;

goodguy_1

1

SELECT 2 AS goodguy_2;

goodguy_2

2

SELECT 3 AS goodguy_3;

ERROR 42000: User 'goodguy' has exceeded the 'max_queries_per_hour' resource (current value: 2)

disconnect con1;

connect  con1,localhost,cheater,,;

SET SESSION AUTHORIZATION cheater@localhost;

SELECT 1 AS cheater_1;

cheater_1

1

SELECT 2 AS cheater_2;

cheater_2

2

# Now it should start failing, but it works

SELECT 3 AS cheater_3;

cheater_3

3

SELECT 4 AS cheater_4;

cheater_4

4