{"record":{"id":"da30d33e4f1c0641","repo":"MyCATApache/Mycat-Server","slug":"host-hoststr-contains-one-root-privileges-us","errorCode":null,"errorMessage":"[host: ${hostStr}] contains one root privileges user: ${user}","messagePattern":"\\[host: (.+?)\\] contains one root privileges user: (.+?)","errorType":"exception","errorClass":"ConfigException","httpStatus":null,"severity":"error","filePath":"src/main/java/io/mycat/config/loader/xml/XMLServerLoader.java","lineNumber":164,"sourceCode":"                String hostStr = e.getAttribute(\"host\").trim();\n                String userStr = e.getAttribute(\"user\").trim();\n                String []hosts = hostStr.split(\",\");\n                for (String host : hosts) {\n                    host = host.trim();\n                    if (this.firewall.existsHost(host)) {\n                        throw new ConfigException(\"host duplicated : \" + host);\n                    }\n                }\n                String []users = userStr.split(\",\");\n                List<UserConfig> userConfigs = new ArrayList<UserConfig>();\n                for(String user : users){\n                    user = user.trim();\n                \tUserConfig uc = this.users.get(user);\n                    if (null == uc) {\n                        throw new ConfigException(\"[user: \" + user + \"] doesn't exist in [host: \" + hostStr + \"]\");\n                    }\n                    if (uc.getSchemas() == null || uc.getSchemas().size() == 0) {\n                        throw new ConfigException(\"[host: \" + hostStr + \"] contains one root privileges user: \" + user);\n                    }\n                    userConfigs.add(uc);\n                }\n                for (String host : hosts) {\n                    host = host.trim();\n                    if (host.contains(\"*\") || host.contains(\"%\")) {\n                        whitehostMask.put(FirewallConfig.getMaskPattern(host), userConfigs);\n                    } else {\n                        whitehost.put(host, userConfigs);\n                    }\n                }\n            }\n        }\n\n        firewall.setWhitehost(whitehost);\n        firewall.setWhitehostMask(whitehostMask);\n\n        WallConfig wallConfig = new WallConfig();","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/MyCATApache/Mycat-Server/blob/65f8d8beb752f935752f2a0eec0ab017facab9ef/src/main/java/io/mycat/config/loader/xml/XMLServerLoader.java#L146-L182","documentation":"Also in loadFirewall: a whitelisted user must have at least one schema assigned (uc.getSchemas() non-null and non-empty). A user with no schemas is treated as a root/full-privilege account, and MyCat refuses to allow such an unrestricted user inside a host whitelist, throwing this ConfigException. This prevents accidentally whitelisting a superuser whose access would bypass schema-level isolation.","triggerScenarios":"server.xml firewall entry lists a <user> whose definition has no <schemas> (or an empty <schemas>) child; the user loaded with no schema restrictions.","commonSituations":"Defining an admin user without schemas for convenience, then adding it to the IP whitelist; a config refactor that dropped the schemas block from a user definition; copying a root user entry into the firewall section.","solutions":["Either add a <schemas> list to the referenced user's definition so it is schema-restricted, or remove that user from the firewall whitelist","Create a dedicated restricted user (with explicit schemas) for whitelist use instead of the root-privilege account","Audit all users referenced by <firewall> entries and confirm each declares non-empty schemas","Restart MyCat after the change"],"exampleFix":"// before\n<user name=\"admin\"><property name=\"password\">x</property></user>\n<host host=\"10.0.0.1\" user=\"admin\"/>\n// after\n<user name=\"admin\"><property name=\"password\">x</property><schemas>db1</schemas></user>","handlingStrategy":"validation","validationCode":"// ensure whitelisted users declare non-empty schemas\nfor each firewall host element:\n    for (String u : e.getAttribute(\"user\").split(\",\")) {\n        Element user = userByName(u.trim());\n        if (user.getElementsByTagName(\"schemas\").getLength() == 0\n            || user.getElementsByTagName(\"schemas\").item(0).getTextContent().trim().isEmpty())\n            throw new IllegalStateException(\"Whitelisted user lacks schemas: \" + u);\n    }","typeGuard":"null","tryCatchPattern":"try {\n    serverLoader.load();\n} catch (ConfigException e) {\n    LOG.error(\"Root-privilege user in firewall whitelist: \" + e.getMessage());\n    throw new ConfigurationException(\"Whitelisted users must declare schemas\", e);\n}","preventionTips":["Always give users an explicit <schemas> list; avoid unrestricted root users in whitelists","Create dedicated restricted accounts for IP-whitelist access","Audit firewall entries after any user-definition refactor"],"tags":["configuration","firewall","privileges"],"backgroundTag":"schema-validation-failed","analyzedSha":"65f8d8beb752f935752f2a0eec0ab017facab9ef","analyzedAt":"2026-09-11T00:12:21.696Z","contentChangedAt":"2026-09-11T00:12:21.696Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}