You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Michael Smith (Code Review)" <ge...@cloudera.org> on 2026/08/31 19:31:33 UTC
[Impala-ASF-CR](branch-4.5.2) IMPALA-15217: Authorize URIs for avro.schema.url when loading
Michael Smith has uploaded this change for review. ( http://gerrit.cloudera.org:8080/24769
Change subject: IMPALA-15217: Authorize URIs for avro.schema.url when loading
......................................................................
IMPALA-15217: Authorize URIs for avro.schema.url when loading
Adds authorization checks for 'avro.schema.url' when creating a table or
altering a table to add the property. If an HTTP URL, checks that the
user has permission to read the specified URL. If any other URL, it also
requires that the path exist.
Authorization is now performed before reading from the source at
'avro.schema.url'; schema parsing for remote schemas moves to
CatalogOpExecutor. New end-to-end tests are added to verify that
CatalogOpExecutor catches the same errors and uses matching schema
reconciliation.
Verification and authorization are now also done when changing the file
format of a table to avro if the 'avro.schema.url' property is present.
Updates ColumnDef#toFieldSchemas to lower-case types for uses where the
results are not subsequently lower-cased. Previously all calls were
later lower-cased through CatalogOpExecutor#buildFieldSchemaList.
New tests are added for authorization of 'avro.schema.url'.
Assisted-by: Claude Sonnet 4.6 (VSCode)
Change-Id: Idf9a9b3e95c495f232057515a047802bc963b555
---
M fe/src/main/java/org/apache/impala/analysis/AlterTableSetFileFormatStmt.java
M fe/src/main/java/org/apache/impala/analysis/AlterTableSetTblProperties.java
M fe/src/main/java/org/apache/impala/analysis/ColumnDef.java
M fe/src/main/java/org/apache/impala/analysis/CreateTableStmt.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/util/AvroSchemaUtils.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeDDLTest.java
M fe/src/test/java/org/apache/impala/authorization/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/common/FrontendFixture.java
M fe/src/test/java/org/apache/impala/common/FrontendTestBase.java
A tests/authorization/test_avro_schema_url.py
11 files changed, 665 insertions(+), 192 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/24769/1
--
To view, visit http://gerrit.cloudera.org:8080/24769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: branch-4.5.2
Gerrit-MessageType: newchange
Gerrit-Change-Id: Idf9a9b3e95c495f232057515a047802bc963b555
Gerrit-Change-Number: 24769
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
[Impala-ASF-CR](branch-4.5.2) IMPALA-15217: Authorize URIs for avro.schema.url when loading
Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Michael Smith has posted comments on this change. ( http://gerrit.cloudera.org:8080/24769 )
Change subject: IMPALA-15217: Authorize URIs for avro.schema.url when loading
......................................................................
Patch Set 1: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/24769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: branch-4.5.2
Gerrit-MessageType: comment
Gerrit-Change-Id: Idf9a9b3e95c495f232057515a047802bc963b555
Gerrit-Change-Number: 24769
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Steve Carlin <sc...@cloudera.com>
Gerrit-Comment-Date: Tue, 01 Sep 2026 03:20:48 +0000
Gerrit-HasComments: No
[Impala-ASF-CR](branch-4.5.2) IMPALA-15217: Authorize URIs for avro.schema.url when loading
Posted by "Michael Smith (Code Review)" <ge...@cloudera.org>.
Michael Smith has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24769 )
Change subject: IMPALA-15217: Authorize URIs for avro.schema.url when loading
......................................................................
IMPALA-15217: Authorize URIs for avro.schema.url when loading
Adds authorization checks for 'avro.schema.url' when creating a table or
altering a table to add the property. If an HTTP URL, checks that the
user has permission to read the specified URL. If any other URL, it also
requires that the path exist.
Authorization is now performed before reading from the source at
'avro.schema.url'; schema parsing for remote schemas moves to
CatalogOpExecutor. New end-to-end tests are added to verify that
CatalogOpExecutor catches the same errors and uses matching schema
reconciliation.
Verification and authorization are now also done when changing the file
format of a table to avro if the 'avro.schema.url' property is present.
Updates ColumnDef#toFieldSchemas to lower-case types for uses where the
results are not subsequently lower-cased. Previously all calls were
later lower-cased through CatalogOpExecutor#buildFieldSchemaList.
New tests are added for authorization of 'avro.schema.url'.
Assisted-by: Claude Sonnet 4.6 (VSCode)
Change-Id: Idf9a9b3e95c495f232057515a047802bc963b555
Reviewed-on: http://gerrit.cloudera.org:8080/24769
Reviewed-by: Joe McDonnell <jo...@cloudera.com>
Tested-by: Michael Smith <mi...@cloudera.com>
---
M fe/src/main/java/org/apache/impala/analysis/AlterTableSetFileFormatStmt.java
M fe/src/main/java/org/apache/impala/analysis/AlterTableSetTblProperties.java
M fe/src/main/java/org/apache/impala/analysis/ColumnDef.java
M fe/src/main/java/org/apache/impala/analysis/CreateTableStmt.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/util/AvroSchemaUtils.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeDDLTest.java
M fe/src/test/java/org/apache/impala/authorization/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/common/FrontendFixture.java
M fe/src/test/java/org/apache/impala/common/FrontendTestBase.java
A tests/authorization/test_avro_schema_url.py
11 files changed, 665 insertions(+), 192 deletions(-)
Approvals:
Joe McDonnell: Looks good to me, approved
Michael Smith: Verified
--
To view, visit http://gerrit.cloudera.org:8080/24769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: branch-4.5.2
Gerrit-MessageType: merged
Gerrit-Change-Id: Idf9a9b3e95c495f232057515a047802bc963b555
Gerrit-Change-Number: 24769
Gerrit-PatchSet: 2
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Steve Carlin <sc...@cloudera.com>
[Impala-ASF-CR](branch-4.5.2) IMPALA-15217: Authorize URIs for avro.schema.url when loading
Posted by "Joe McDonnell (Code Review)" <ge...@cloudera.org>.
Joe McDonnell has posted comments on this change. ( http://gerrit.cloudera.org:8080/24769 )
Change subject: IMPALA-15217: Authorize URIs for avro.schema.url when loading
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/24769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: branch-4.5.2
Gerrit-MessageType: comment
Gerrit-Change-Id: Idf9a9b3e95c495f232057515a047802bc963b555
Gerrit-Change-Number: 24769
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Michael Smith <mi...@cloudera.com>
Gerrit-Reviewer: Steve Carlin <sc...@cloudera.com>
Gerrit-Comment-Date: Mon, 31 Aug 2026 22:25:25 +0000
Gerrit-HasComments: No