You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sentry.apache.org by Alexander Kolbasov <ak...@gmail.com> on 2016/12/06 05:30:18 UTC
Review Request 54409: SENTRY-1476: SentryStore is subject to JDQL
injection
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/54409/
-----------------------------------------------------------
Review request for sentry, Colin Ma, Hao Hao, kalyan kumar kalvagadda, Sravya Tirukkovalur, Vamsee Yarlagadda, and Vadim Spector.
Repository: sentry
Description
-------
SENTRY-1476: SentryStore is subject to JDQL injection
Diffs
-----
pom.xml f5134875420ed5a1156ae24092e5e203b10417c8
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/persistent/SentryStore.java f773a4443e81c5cde3aca0056a2e33d528bf4ec9
sentry-service/sentry-service-server/src/test/java/org/apache/sentry/provider/db/service/persistent/TestSentryStore.java 64df6a5655cf2c121cb44f2274369fbe9d70ec83
Diff: https://reviews.apache.org/r/54409/diff/
Testing
-------
Thanks,
Alexander Kolbasov
Re: Review Request 54409: SENTRY-1476: SentryStore is subject to JDQL
injection
Posted by Vamsee Yarlagadda <va...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/54409/#review159249
-----------------------------------------------------------
Ship it!
LGTM otherwise
- Vamsee Yarlagadda
On Dec. 6, 2016, 5:30 a.m., Alexander Kolbasov wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/54409/
> -----------------------------------------------------------
>
> (Updated Dec. 6, 2016, 5:30 a.m.)
>
>
> Review request for sentry, Colin Ma, Hao Hao, kalyan kumar kalvagadda, Sravya Tirukkovalur, Vamsee Yarlagadda, and Vadim Spector.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> SENTRY-1476: SentryStore is subject to JDQL injection
>
>
> Diffs
> -----
>
> pom.xml f5134875420ed5a1156ae24092e5e203b10417c8
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/persistent/SentryStore.java f773a4443e81c5cde3aca0056a2e33d528bf4ec9
> sentry-service/sentry-service-server/src/test/java/org/apache/sentry/provider/db/service/persistent/TestSentryStore.java 64df6a5655cf2c121cb44f2274369fbe9d70ec83
>
> Diff: https://reviews.apache.org/r/54409/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Alexander Kolbasov
>
>
Re: Review Request 54409: SENTRY-1476: SentryStore is subject to JDQL
injection
Posted by Alexander Kolbasov <ak...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/54409/
-----------------------------------------------------------
(Updated Jan. 5, 2017, 1:22 a.m.)
Review request for sentry, Colin Ma, Hao Hao, kalyan kumar kalvagadda, Sravya Tirukkovalur, Vamsee Yarlagadda, and Vadim Spector.
Bugs: SENTRY-1476
https://issues.apache.org/jira/browse/SENTRY-1476
Repository: sentry
Description
-------
SENTRY-1476: SentryStore is subject to JDQL injection
Diffs
-----
pom.xml f5134875420ed5a1156ae24092e5e203b10417c8
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/persistent/SentryStore.java f773a4443e81c5cde3aca0056a2e33d528bf4ec9
sentry-service/sentry-service-server/src/test/java/org/apache/sentry/provider/db/service/persistent/TestSentryStore.java 64df6a5655cf2c121cb44f2274369fbe9d70ec83
Diff: https://reviews.apache.org/r/54409/diff/
Testing
-------
Thanks,
Alexander Kolbasov
Re: Review Request 54409: SENTRY-1476: SentryStore is subject to JDQL
injection
Posted by Alexander Kolbasov <ak...@gmail.com>.
> On Dec. 14, 2016, 9:26 p.m., Vamsee Yarlagadda wrote:
> > sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/persistent/SentryStore.java, lines 2647-2654
> > <https://reviews.apache.org/r/54409/diff/1/?file=1577433#file1577433line2647>
> >
> > Can't we leverage the method used in SENTRY-1557 to make the query simple to construct?
> >
> > More reference for JDO filter constructs: http://etutorials.org/Programming/Java+data+objects/Chapter+9.+The+JDO+Query+Language/9.6+The+Query+Filter/
I think it is a very good idea, but I'd rather do that as a follow-up fix. The goal of this one is to preserve the existing semantics but move all user strings to parameters. I'll investigate SENTRY-1577 approach in a later change.
- Alexander
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/54409/#review159226
-----------------------------------------------------------
On Dec. 6, 2016, 5:30 a.m., Alexander Kolbasov wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/54409/
> -----------------------------------------------------------
>
> (Updated Dec. 6, 2016, 5:30 a.m.)
>
>
> Review request for sentry, Colin Ma, Hao Hao, kalyan kumar kalvagadda, Sravya Tirukkovalur, Vamsee Yarlagadda, and Vadim Spector.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> SENTRY-1476: SentryStore is subject to JDQL injection
>
>
> Diffs
> -----
>
> pom.xml f5134875420ed5a1156ae24092e5e203b10417c8
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/persistent/SentryStore.java f773a4443e81c5cde3aca0056a2e33d528bf4ec9
> sentry-service/sentry-service-server/src/test/java/org/apache/sentry/provider/db/service/persistent/TestSentryStore.java 64df6a5655cf2c121cb44f2274369fbe9d70ec83
>
> Diff: https://reviews.apache.org/r/54409/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Alexander Kolbasov
>
>
Re: Review Request 54409: SENTRY-1476: SentryStore is subject to JDQL
injection
Posted by Vamsee Yarlagadda <va...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/54409/#review159226
-----------------------------------------------------------
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/persistent/SentryStore.java (lines 2595 - 2602)
<https://reviews.apache.org/r/54409/#comment230167>
Can't we leverage the method used in SENTRY-1557 to make the query simple to construct?
More reference for JDO filter constructs: http://etutorials.org/Programming/Java+data+objects/Chapter+9.+The+JDO+Query+Language/9.6+The+Query+Filter/
- Vamsee Yarlagadda
On Dec. 6, 2016, 5:30 a.m., Alexander Kolbasov wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/54409/
> -----------------------------------------------------------
>
> (Updated Dec. 6, 2016, 5:30 a.m.)
>
>
> Review request for sentry, Colin Ma, Hao Hao, kalyan kumar kalvagadda, Sravya Tirukkovalur, Vamsee Yarlagadda, and Vadim Spector.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> SENTRY-1476: SentryStore is subject to JDQL injection
>
>
> Diffs
> -----
>
> pom.xml f5134875420ed5a1156ae24092e5e203b10417c8
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/persistent/SentryStore.java f773a4443e81c5cde3aca0056a2e33d528bf4ec9
> sentry-service/sentry-service-server/src/test/java/org/apache/sentry/provider/db/service/persistent/TestSentryStore.java 64df6a5655cf2c121cb44f2274369fbe9d70ec83
>
> Diff: https://reviews.apache.org/r/54409/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Alexander Kolbasov
>
>