privilege: remove any string concat (#22523)

[ti-srebot]

cherry-pick #22523 to release-4.0
You can switch your code base to this Pull Request by using git-extras:

# In tidb repo:
git pr https://github.com/pingcap/tidb/pull/22689

After apply modifications, you can push your change to this PR via:

git push git@github.com:ti-srebot/tidb.git pr/22689:release-4.0-26086b297cad

---

What problem does this PR solve?

Part of https://github.com/pingcap/tidb-test/issues/1152

What is changed and how it works?

What's Changed:

This removes any string concatenation from the privilege package, and changes it to use ExecuteInternal. Because the privilege package loads whole tables and does not need any paramaterized SQL, it should work before/after #22499 is merged.

There was no risk of injection from the previous usage, since the concat did not include any user-supplied data. But it's possible a PR in the future may misunderstand this and introduce a security issue. The new approach is to define the sqls as const. Thus, temptations are reduced.

Related changes

• Need to cherry-pick to the release branch

Check List

Tests

Convered by existing tests.

Side effects

• None

Release note

• No release note

[ti-srebot]

/run-all-tests

[ti-srebot]

@morgo please accept the invitation then you can push to the cherry-pick pull requests.
https://github.com/ti-srebot/tidb/invitations

[morgo]

This depends on #22640 merging.

[xhebox]

LGTM

[ti-chi-bot]

@xhebox: Please use /LGTM instead of LGTM when you want to approve the pull request by comment.
If you use the GitHub review feature, please approve the PR directly, the comment will not take effect in the GitHub review feature.
If you have any qustions please refer to lgtm command help or lgtm plugin design.

If you have approved this PR, please ignore this reply. This reply is being used as a temporary reply during the migration of the new bot and will be removed on April 1.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

[tiancaiamao]

/LGTM

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• tiancaiamao
• xhebox

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by writing /lgtm in a comment.
Reviewer can cancel approval by writing /lgtm cancel in a comment.

[xhebox]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: 12396fe

[ti-chi-bot]

@ti-srebot: Your PR was out of date, I have automatically updated it for you.

At the same time I will also trigger all tests for you:

/run-all-tests

If the CI test fails, you just re-trigger the test that failed and the bot will merge the PR for you after the CI passes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.