{"record":{"id":"6092b5242060a159","repo":"prestodb/presto","slug":"cannot-select-from-columns-s-in-table-or-view-s","errorCode":null,"errorMessage":"Cannot select from columns %s in table or view %s%s","messagePattern":"Cannot select from columns (.+?) in table or view (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":382,"sourceCode":"\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set catalog session property %s.%s%s\", catalogName, propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String propertyName)\n    {\n        throw new AccessDeniedException(format(\"Cannot set catalog session property %s\", propertyName));\n    }\n\n    public static void denySelectColumns(String tableName, Collection<String> columnNames)\n    {\n        denySelectColumns(tableName, columnNames, null);\n    }\n\n    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from columns %s in table or view %s%s\", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCallProcedure(String procedureName)\n    {\n        denyCallProcedure(procedureName, null);\n    }\n\n    public static void denyCallProcedure(String procedureName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot call procedure %s%s\", procedureName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateRole(String roleName)\n    {\n        throw new AccessDeniedException(format(\"Cannot create role %s\", roleName));\n    }\n\n    public static void denyDropRole(String roleName)","sourceCodeStart":364,"sourceCodeEnd":400,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L364-L400","documentation":"Thrown by denySelectColumns when checkCanSelectColumns denies a read of specific columns of a table or view. Presto supports column-level access control, so a user may see the table but not every column. Column names in the message are sorted; extraInfo may append the denial reason.","triggerScenarios":"SELECT listing one or more columns (not SELECT *) the user is not granted on that table/view, e.g. policy granting only columns (a,b) but the query selects (a,c).","commonSituations":"Wide SELECT * against tables with sensitive columns (PII, salary) under column masking/row-filtering access controls; analytics tools auto-selecting all columns; newly added columns not covered by existing grants.","solutions":["Restrict the SELECT list to explicitly granted columns.","Request a grant for the missing columns from the security admin.","Replace SELECT * with an explicit column list in tools/ORMs that expand all columns.","Confirm table name/catalog; column policies are per table or view."],"exampleFix":"// before (denied: ssn not granted)\nSELECT * FROM hive.secure.employees;\n// after\nSELECT employee_id, name FROM hive.secure.employees;","handlingStrategy":"validation","validationCode":"// Never emit SELECT * when column policies are in effect\nList<String> granted = getGrantedColumns(user, table); // from your grants metadata\nList<String> requested = explicitColumns;\nif (!granted.containsAll(requested)) {\n    throw new IllegalArgumentException(\"Columns not granted: \" + new HashSet<>(requested) .stream().filter(c -> !granted.contains(c)).collect(toSet()));\n}","typeGuard":null,"tryCatchPattern":"try {\n    rs = stmt.executeQuery(selectSql);\n} catch (AccessDeniedException e) {\n    // column-level denial — retry with only explicitly granted columns\n    rs = stmt.executeQuery(buildSelectFromGrantedColumns(table, granted));\n}","preventionTips":["Ban SELECT * in ORM/tooling that touches policy-governed tables.","Sync column grants into app metadata and validate query columns pre-flight.","Re-check grants when new columns are added to governed tables."],"tags":["security","authorization","column-level-security","select"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}