You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@impala.apache.org by mi...@apache.org on 2026/04/04 03:13:08 UTC
(impala) 02/02: IMPALA-14875: Make a Preconditions check case-insensitive in authorize()
This is an automated email from the ASF dual-hosted git repository.
michaelsmith pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git
commit b650fda439c578d4067bfbc5694c348cb8a8c4e6
Author: Fang-Yu Rao <fa...@cloudera.com>
AuthorDate: Wed Apr 1 22:43:06 2026 -0700
IMPALA-14875: Make a Preconditions check case-insensitive in authorize()
In IMPALA-14507, we slightly revised a Preconditions check that requires
each column-level privilege request has at least one respective
table-level privilege request. However, we found that this introduced a
regression due to which the check would fail in the local catalog mode
if the name of the target table in the CREATE TABLE AS SELECT statement
contains uppercase letters. For instance, a query like the following
would fail in the local catalog mode.
create table alltypes_A as select int_col from functional.alltypes;
One root cause of this was that during the registration of the
column-level INSERT privilege in InsertStmt#analyze(),
table_.getTableName().getTbl() would still contain uppercase letters in
the local catalog mode. As a result, during the Preconditions check in
BaseAuthorizationChecker#authorize(), the key of the same table in the
map from table name to the associated table-level privilege requests
did not match that in the map from table name to the associated
column-level privilege requests, causing the check to fail. In our
example, the key of the target table in the former map would end with
"alltypes_a", whereas that of the latter map ended with "alltypes_A".
To fix the issue, this patch lowercases the table name when constructing
the 2 maps above.
On a related note, the issue only affected the CTAS statement but not
the INSERT statement. This is because during the analysis of the CTAS
statement in the local catalog mode, we create a temporary target table
'table_' such that table_.getTableName().getTbl() could still contain
uppercase letters and then call InsertStmt#analyze() with 'table_' being
the target table. For the INSERT statement, the name of the target table
is already lowercased for both catalog modes.
Testing:
- Added test cases to verify that a CTAS statement could pass the
Preconditions check even though the name of target table has
capital letters.
Change-Id: Idfae24a7de8da683bc0bf28a947188ab96481301
Reviewed-on: http://gerrit.cloudera.org:8080/24165
Reviewed-by: Yida Wu <wy...@gmail.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
Reviewed-by: Michael Smith <mi...@cloudera.com>
---
.../authorization/BaseAuthorizationChecker.java | 9 +++++---
.../queries/QueryTest/create-table-as-select.test | 24 +++++++++++++++++++++-
2 files changed, 29 insertions(+), 4 deletions(-)
diff --git a/fe/src/main/java/org/apache/impala/authorization/BaseAuthorizationChecker.java b/fe/src/main/java/org/apache/impala/authorization/BaseAuthorizationChecker.java
index 9e255e370..2a0e1ba0e 100644
--- a/fe/src/main/java/org/apache/impala/authorization/BaseAuthorizationChecker.java
+++ b/fe/src/main/java/org/apache/impala/authorization/BaseAuthorizationChecker.java
@@ -160,11 +160,13 @@ public abstract class BaseAuthorizationChecker implements AuthorizationChecker {
// CopyTestCaseStmt#analyze().
Preconditions.checkState(ALLOWED_HIER_AUTHZ_TABLE_PRIVILEGES
.contains(privReq.getPrivilege()));
- requests = tablePrivReqs.computeIfAbsent(tableName, k -> new ArrayList<>());
+ requests = tablePrivReqs.computeIfAbsent(tableName.toLowerCase(),
+ k -> new ArrayList<>());
requests.add(privReq);
} else {
Preconditions.checkState(privReq.getAuthorizable().getType() == Type.COLUMN);
- requests = columnPrivReqs.computeIfAbsent(tableName, k -> new ArrayList<>());
+ requests = columnPrivReqs.computeIfAbsent(tableName.toLowerCase(),
+ k -> new ArrayList<>());
requests.add(privReq);
}
}
@@ -177,7 +179,8 @@ public abstract class BaseAuthorizationChecker implements AuthorizationChecker {
// authorizeTableAccess() below.
for (Map.Entry<String, List<PrivilegeRequest>> entry : columnPrivReqs.entrySet()) {
List<PrivilegeRequest> privReqs = tablePrivReqs.get(entry.getKey());
- Preconditions.checkState(privReqs != null);
+ Preconditions.checkState(privReqs != null, "There is no corresponding " +
+ "table-level privilege request for the table: %s", entry.getKey());
privReqs.addAll(entry.getValue());
}
diff --git a/testdata/workloads/functional-query/queries/QueryTest/create-table-as-select.test b/testdata/workloads/functional-query/queries/QueryTest/create-table-as-select.test
index f9123e67c..ba7e21da5 100644
--- a/testdata/workloads/functional-query/queries/QueryTest/create-table-as-select.test
+++ b/testdata/workloads/functional-query/queries/QueryTest/create-table-as-select.test
@@ -209,4 +209,26 @@ describe formatted zsortbytest;
'','sort.order ','ZORDER '
---- TYPES
STRING,STRING,STRING
-====
\ No newline at end of file
+====
+---- QUERY
+# Regression test for IMPALA-14875.
+# Make sure that in the local catalog mode, the CTAS query could pass the Preconditions
+# check that requires each column-level privilege request has at least one corresponding
+# table-level privilege request even if we have capital letters in the target table.
+create table Alltypes_A as select int_col from functional.alltypes;
+---- RESULTS
+'Inserted 7300 row(s)'
+---- TYPES
+STRING
+====
+---- QUERY
+# Regression test for IMPALA-14875.
+# Make sure that in the local catalog mode, the CTAS query could pass the Preconditions
+# check that requires each column-level privilege request has at least one corresponding
+# table-level privilege request even if we have capital letters in the target table.
+create table Alltypes_B as select * from functional.alltypes;
+---- RESULTS
+'Inserted 7300 row(s)'
+---- TYPES
+STRING
+====