You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@kudu.apache.org by "Gabriella Lotz (Jira)" <ji...@apache.org> on 2026/10/22 13:35:00 UTC

[jira] [Updated] (KUDU-3817) REST catalog API: authorize single-table GET

     [ https://issues.apache.org/jira/browse/KUDU-3817?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Gabriella Lotz updated KUDU-3817:
---------------------------------
    Description: The REST catalog endpoint GET /api/v1/tables/<table_id> returns the table object (schema, owner, comment, extra_config) to any authenticated caller. The authenticated user is resolved in HandleApiTableEndpoint but isn't passed to HandleGetTable / PrintTableObject, so no authorization check runs on this path.  (was: The REST catalog endpoint GET /api/v1/tables/<table_id> returns the table
object (schema, owner, comment, extra_config) to any authenticated
caller. The authenticated user is resolved in HandleApiTableEndpoint but
isn't passed to HandleGetTable / PrintTableObject, so no authorization
check runs on this path.)

> REST catalog API: authorize single-table GET
> --------------------------------------------
>
>                 Key: KUDU-3817
>                 URL: https://issues.apache.org/jira/browse/KUDU-3817
>             Project: Kudu
>          Issue Type: Improvement
>            Reporter: Gabriella Lotz
>            Priority: Major
>
> The REST catalog endpoint GET /api/v1/tables/<table_id> returns the table object (schema, owner, comment, extra_config) to any authenticated caller. The authenticated user is resolved in HandleApiTableEndpoint but isn't passed to HandleGetTable / PrintTableObject, so no authorization check runs on this path.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)