You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@kyuubi.apache.org by "jersy (via GitHub)" <gi...@apache.org> on 2023/07/10 14:12:42 UTC
[GitHub] [kyuubi] jersy opened a new issue, #5041: [Bug] [AUTHZ] masked column cannot be used as a filter condition
jersy opened a new issue, #5041:
URL: https://github.com/apache/kyuubi/issues/5041
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
### Search before asking
- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.
### Describe the bug
There is a table named test_student_02, which contains data of students who are around 18 years old. The "age" column has been hashed for data masking. When using the following SQL query, no data can be retrieved.
var ds4 = spark.sql("select * from user02db.test_student_02 where age > 18");
ds4.explain(true);
'Project [*]
+- 'Filter ('age > 18)
+- 'UnresolvedRelation `user02db`.`test_student_02`
== Analyzed Logical Plan ==
id: int, name: string, sex: boolean, age: string, department: string
Project [id#18, name#19, sex#23, age#24, department#22]
+- Filter (cast(age#24 as int) > 18)
+- SubqueryAlias `user02db`.`test_student_02`
+- Filter (department#22 = IS)
+- RowFilterMarker
+- DataMaskingStage0Marker HiveTableRelation `user02db`.`test_student_02`, org.apache.hadoop.hive.ql.io.orc.OrcSerde, [id#18, name#19, sex#20, age#21, department#22]
+- Project [id#18, name#19, (0 = 0) AS sex#23, md5(cast(cast(age#21 as string) as binary)) AS age#24, department#22]
+- Relation[id#18,name#19,sex#20,age#21,department#22] orc
== Optimized Logical Plan ==
Project [id#18, name#19, true AS sex#23, md5(cast(cast(age#21 as string) as binary)) AS age#24, department#22]
+- Filter ((isnotnull(department#22) && (department#22 = IS)) && (cast(md5(cast(cast(age#21 as string) as binary)) as int) > 18))
+- Relation[id#18,name#19,sex#20,age#21,department#22] orc
### Affects Version(s)
master
### Kyuubi Server Log Output
_No response_
### Kyuubi Engine Log Output
_No response_
### Kyuubi Server Configurations
_No response_
### Kyuubi Engine Configurations
_No response_
### Additional context
_No response_
### Are you willing to submit PR?
- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [ ] No. I cannot submit a PR at this time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] jersy commented on issue #5041: [Bug] [AUTHZ] masked column cannot be used as a filter condition
Posted by "jersy (via GitHub)" <gi...@apache.org>.
jersy commented on issue #5041:
URL: https://github.com/apache/kyuubi/issues/5041#issuecomment-1630066008
`(cast(md5(cast(cast(age#21 as string) as binary)) as int) > 18)` in the Optimized Logical Plan is completely wrong now. Its current meaning is to compare the result of the 'age' column after applying the MD5 function with the value 18.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] jersy commented on issue #5041: [Bug] [AUTHZ] masked column cannot be used as a filter condition
Posted by "jersy (via GitHub)" <gi...@apache.org>.
jersy commented on issue #5041:
URL: https://github.com/apache/kyuubi/issues/5041#issuecomment-1630046803
@packyan You didn't really understand what I meant. test_student_02 contains data of students who are over 18 years old. Therefore, regardless of whether or not the 'age' column has been masked, the first step should be to query this data. Secondly, if there is masking, it should be applied to the 'age' column in the query results.
你没有真正理解我表达的意思。 test_student_02包含了“age”大于18岁的数据，所以无论有没有在“age”上进行脱敏，首先应该是要查询出来这些数据的，其次， 如果有脱敏的话，是在查询的结果集上再对“age”进行脱敏。
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] yaooqinn commented on issue #5041: [Bug] [AUTHZ] masked column cannot be used as a filter condition
Posted by "yaooqinn (via GitHub)" <gi...@apache.org>.
yaooqinn commented on issue #5041:
URL: https://github.com/apache/kyuubi/issues/5041#issuecomment-1631805573
As @packyan explained, it's by design.
The data is masked on the leaf scan. A user can not do a filter operation on a column if the admin has set a masker on it for him/her.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] jersy commented on issue #5041: [Bug] [AUTHZ] masked column cannot be used as a filter condition
Posted by "jersy (via GitHub)" <gi...@apache.org>.
jersy commented on issue #5041:
URL: https://github.com/apache/kyuubi/issues/5041#issuecomment-1631782676
@yaooqinn Could you please take a look at this,thx.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] github-actions[bot] commented on issue #5041: [Bug] [AUTHZ] masked column cannot be used as a filter condition
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #5041:
URL: https://github.com/apache/kyuubi/issues/5041#issuecomment-1629060109
Hello @jersy,
Thanks for finding the time to report the issue!
We really appreciate the community's efforts to improve Apache Kyuubi.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
[GitHub] [kyuubi] packyan commented on issue #5041: [Bug] [AUTHZ] masked column cannot be used as a filter condition
Posted by "packyan (via GitHub)" <gi...@apache.org>.
packyan commented on issue #5041:
URL: https://github.com/apache/kyuubi/issues/5041#issuecomment-1630030127
This should be an expected behavior. If the user's condition is age=18, then the user can know which students are exactly 18 years old, which is unreasonable for data security.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org