You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@hive.apache.org by "rtrivedi12 (via GitHub)" <gi...@apache.org> on 2026/08/06 23:02:16 UTC
[PR] HIVE-29804: Include table inputs for HS2 authorization SHOW TBLPROPER… [hive]
rtrivedi12 opened a new pull request, #6683:
URL: https://github.com/apache/hive/pull/6683
…TIES and SHOW TABLE EXTENDED
### What changes were proposed in this pull request?
Align authorization input registration for SHOW TBLPROPERTIES and SHOW TABLE EXTENDED
with other metadata DDL commands (e.g. DESCRIBE TABLE) so the configured HS2
authorizer receives the target table in the compile-time input set.
* ShowTablePropertiesAnalyzer — add ReadEntity(table) before DDLWork is created
* ShowTableStatusAnalyzer — add ReadEntity(table) before DDLWork is created
### Why are the changes needed?
Both analyzers already validate table existence; they were not registering the
authorization checks.
### Does this PR introduce _any_ user-facing change?
Yes, commands will fail if user does not have SELECT access
### How was this patch tested?
authorization_show_tblproperties_nosel.q
authorization_show_tableextended_nosel.q
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29804: Include table inputs for HS2 authorization SHOW TBLPROPER… [hive]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6683:
URL: https://github.com/apache/hive/pull/6683#issuecomment-5210100500
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6683) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6683&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6683&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6683&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6683&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6683&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6683)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29804: Include table inputs for HS2 authorization SHOW TBLPROPERTIES and SHOW TABLE EXTENDED [hive]
Posted by "rtrivedi12 (via GitHub)" <gi...@apache.org>.
rtrivedi12 commented on PR #6683:
URL: https://github.com/apache/hive/pull/6683#issuecomment-6307302751
> @rtrivedi12 - Can you work on fixing the test failures?
@saihemanth-cloudera Most of the test failures were related to out file changes after adding authorization. But there are 4 test failures with `Table not found`. Analyzer's earlier version looked up the `LIKE` argument as a literal table name (`getTable(dbName, pattern, true)`). At runtime, though, `ShowTableStatusOperation` treats it as a SQL `LIKE` pattern (`'jsontab%'`, `src_`, `"%"`, `foo_n_`, ...).
I have updated analyzer now to resolves the pattern the same way the operation does: it lists the tables in the database, filters them with `UDFLike.likePatternToRegExp`, and adds a `ReadEntity` for each match. So every table whose metadata is returned goes through authorization.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29804: Include table inputs for HS2 authorization SHOW TBLPROPERTIES and SHOW TABLE EXTENDED [hive]
Posted by "saihemanth-cloudera (via GitHub)" <gi...@apache.org>.
saihemanth-cloudera commented on PR #6683:
URL: https://github.com/apache/hive/pull/6683#issuecomment-5959145669
@rtrivedi12 - Can you work on fixing the test failures?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29804: Include table inputs for HS2 authorization SHOW TBLPROPERTIES and SHOW TABLE EXTENDED [hive]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6683:
URL: https://github.com/apache/hive/pull/6683#issuecomment-6345489950
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6683) **Quality Gate passed**
Issues
 [1 New issue](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6683&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6683&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6683&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6683&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6683&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6683)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29804: Include table inputs for HS2 authorization SHOW TBLPROPERTIES and SHOW TABLE EXTENDED [hive]
Posted by "saihemanth-cloudera (via GitHub)" <gi...@apache.org>.
saihemanth-cloudera commented on code in PR #6683:
URL: https://github.com/apache/hive/pull/6683#discussion_r4351729459
##########
ql/src/java/org/apache/hadoop/hive/ql/ddl/table/info/show/status/ShowTableStatusAnalyzer.java:
##########
@@ -81,4 +89,24 @@ public void analyzeInternal(ASTNode root) throws SemanticException {
task.setFetchSource(true);
setFetchTask(createFetchTask(ShowTableStatusDesc.SCHEMA));
}
+
+ /**
+ * Register table read inputs for authorization. Resolves the SQL LIKE pattern against the tables
+ * in the database the same way {@link ShowTableStatusOperation} does, so every table whose
+ * metadata is returned is authorized.
+ */
+ private void addReadEntitiesForShowTableExtendedPattern(String dbName, String pattern)
+ throws SemanticException {
+ try {
+ Pattern likePattern = Pattern.compile(UDFLike.likePatternToRegExp(pattern),
+ Pattern.CASE_INSENSITIVE);
+ for (String name : db.getTablesForDb(dbName, null)) {
Review Comment:
The authorized table set is discarded, then execution lists tables again. A newly matching table could be returned without authorization.
##########
ql/src/java/org/apache/hadoop/hive/ql/ddl/table/info/show/status/ShowTableStatusAnalyzer.java:
##########
@@ -81,4 +89,24 @@ public void analyzeInternal(ASTNode root) throws SemanticException {
task.setFetchSource(true);
setFetchTask(createFetchTask(ShowTableStatusDesc.SCHEMA));
}
+
+ /**
+ * Register table read inputs for authorization. Resolves the SQL LIKE pattern against the tables
+ * in the database the same way {@link ShowTableStatusOperation} does, so every table whose
+ * metadata is returned is authorized.
+ */
+ private void addReadEntitiesForShowTableExtendedPattern(String dbName, String pattern)
+ throws SemanticException {
+ try {
+ Pattern likePattern = Pattern.compile(UDFLike.likePatternToRegExp(pattern),
+ Pattern.CASE_INSENSITIVE);
+ for (String name : db.getTablesForDb(dbName, null)) {
+ if (likePattern.matcher(name).matches()) {
+ inputs.add(new ReadEntity(getTable(dbName, name, true)));
Review Comment:
Could we batch these lookups? Broad patterns now fetch every matching table twice.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29804: Include table inputs for HS2 authorization SHOW TBLPROPERTIES and SHOW TABLE EXTENDED [hive]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6683:
URL: https://github.com/apache/hive/pull/6683#issuecomment-6313433096
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6683) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6683&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6683&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6683&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6683&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6683&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6683)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29804: Include table inputs for HS2 authorization SHOW TBLPROPERTIES and SHOW TABLE EXTENDED [hive]
Posted by "rtrivedi12 (via GitHub)" <gi...@apache.org>.
rtrivedi12 commented on code in PR #6683:
URL: https://github.com/apache/hive/pull/6683#discussion_r4354207474
##########
ql/src/java/org/apache/hadoop/hive/ql/ddl/table/info/show/status/ShowTableStatusAnalyzer.java:
##########
@@ -81,4 +89,24 @@ public void analyzeInternal(ASTNode root) throws SemanticException {
task.setFetchSource(true);
setFetchTask(createFetchTask(ShowTableStatusDesc.SCHEMA));
}
+
+ /**
+ * Register table read inputs for authorization. Resolves the SQL LIKE pattern against the tables
+ * in the database the same way {@link ShowTableStatusOperation} does, so every table whose
+ * metadata is returned is authorized.
+ */
+ private void addReadEntitiesForShowTableExtendedPattern(String dbName, String pattern)
+ throws SemanticException {
+ try {
+ Pattern likePattern = Pattern.compile(UDFLike.likePatternToRegExp(pattern),
+ Pattern.CASE_INSENSITIVE);
+ for (String name : db.getTablesForDb(dbName, null)) {
Review Comment:
Thanks @saihemanth-cloudera for pointing this out. I missed this point earlier !
I want to know your thoughts on this approach to fix this -
- Resolve once in the analyzer. List the tables, filter them with `UDFLike.likePatternToRegExp`, sort them, fetch each matching Table, and register a ReadEntity for each one (same as now).
- Pass the resolved list to the operation. Add a List<Table> field to `ShowTableStatusDesc`
This way the set that gets authorized is exactly the set whose metadata is returned. It also takes care of your second comment: each table is fetched once instead of twice. `AlterTableExchangePartitionsDesc` also passes Table objects through a desc in similar way.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org