{"record":{"id":"e1f7f2825f41d41d","repo":"prestodb/presto","slug":"invalid-privilege","errorCode":"INVALID_PRIVILEGE","errorMessage":"Unknown privilege: '%s'","messagePattern":"Unknown privilege: '(.+?)'","errorType":"error_code","errorClass":"SemanticException","httpStatus":null,"severity":"error","filePath":"presto-main-base/src/main/java/com/facebook/presto/execution/GrantTask.java","lineNumber":87,"sourceCode":"\n        // verify current identity has permissions to grant permissions\n        for (Privilege privilege : privileges) {\n            accessControl.checkCanGrantTablePrivilege(session.getRequiredTransactionId(), session.getIdentity(), session.getAccessControlContext(), privilege, tableName, createPrincipal(statement.getGrantee()), statement.isWithGrantOption());\n        }\n\n        metadata.grantTablePrivileges(session, tableName, privileges, createPrincipal(statement.getGrantee()), statement.isWithGrantOption());\n        return immediateFuture(null);\n    }\n\n    private static Privilege parsePrivilege(Grant statement, String privilegeString)\n    {\n        for (Privilege privilege : Privilege.values()) {\n            if (privilege.name().equalsIgnoreCase(privilegeString)) {\n                return privilege;\n            }\n        }\n\n        throw new SemanticException(INVALID_PRIVILEGE, statement, \"Unknown privilege: '%s'\", privilegeString);\n    }\n}\n","sourceCodeStart":69,"sourceCodeEnd":90,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-main-base/src/main/java/com/facebook/presto/execution/GrantTask.java#L69-L90","documentation":"Thrown by GrantTask.parsePrivilege when the privilege string in a GRANT statement does not case-insensitively match any Presto Privilege enum value. The loop over Privilege.values() fails, so the statement is rejected with INVALID_PRIVILEGE.","triggerScenarios":"Executing `GRANT <word> ON table TO user` where <word> is not one of the supported privilege names (e.g. SELECT, INSERT, DELETE, ...). Any unrecognized token (typo, connector-specific privilege, ALL misspelled) hits this path.","commonSituations":"Typing 'READ' or 'WRITE' which Presto does not define; copying ANSI/other-database privilege keywords; forgetting that non-grantable syntax like ALL PRIVILEGES must be written exactly as ALL.","solutions":["Replace the privilege with a supported Presto privilege name (check the Privilege enum / docs)","Use ALL to grant all applicable privileges","For connector-specific grants, use the connector's own security mechanism instead of GRANT"],"exampleFix":"// before\nGRANT READ ON sales.orders TO USER bob;\n// after\nGRANT SELECT ON sales.orders TO USER bob;","handlingStrategy":"validation","validationCode":"Set<String> valid = Arrays.stream(Privilege.values()).map(Enum::name).collect(Collectors.toSet());\nif (!valid.contains(privilegeString.toUpperCase(Locale.ENGLISH))) {\n    throw new IllegalArgumentException(\"Unknown privilege: \" + privilegeString);\n}","typeGuard":null,"tryCatchPattern":"try { executeGrant(stmt); } catch (SemanticException e) { if (e.getCode() == SemanticErrorCode.INVALID_PRIVILEGE) { /* surface allowed privilege names to the user */ } throw e; }","preventionTips":["Whitelist privilege strings against Privilege.values() before building SQL","Never copy privilege keywords from other database dialects without mapping","Use ALL instead of enumerating unknown privilege names"],"tags":["presto","sql","privilege","syntax"],"backgroundTag":"invalid-privilege","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}