You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@paimon.apache.org by "thswlsqls (via GitHub)" <gi...@apache.org> on 2026/09/27 03:52:04 UTC
[PR] [oss] Fix blob presigned URL validation when fs.oss.sld.enabled is set [paimon]
thswlsqls opened a new pull request, #10230:
URL: https://github.com/apache/paimon/pull/10230
### Purpose
fix #10229
- With `fs.oss.sld.enabled=true` the shared OSS client signs path-style URLs (host = endpoint, path = `/bucket/key`), but `OSSBlobPresigner.validatePresignedUrl` always expected `bucket.<endpoint>` and `/key`, so every request failed with "invalid target" (public, internal and PrivateLink endpoints).
- When the client configuration has SLD enabled, expect the endpoint host and `/bucket/key`; bucket, key and HTTPS are still checked. The SLD-off path is unchanged.
- CNAME custom domains are still rejected (out of scope). The Python presigner has the same host assumption but no SLD option today.
### Tests
- Added three `OSSFileIOTest` cases: path-style URLs on public/internal/PrivateLink endpoints (plus wrong-bucket rejection), and SDK-signed URLs for an encoded key and an endpoint port. All three fail without the fix.
- Stubbed `getClientConfiguration()` in 4 existing mock setups (no assertion changes).
- `mvn -pl paimon-filesystems/paimon-oss-impl clean install` (JDK 11) passed: `OSSFileIOTest` 20/20, checkstyle and spotless green.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [oss] Fix blob presigned URL validation when fs.oss.sld.enabled is set [paimon]
Posted by "JingsongLi (via GitHub)" <gi...@apache.org>.
JingsongLi merged PR #10230:
URL: https://github.com/apache/paimon/pull/10230
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [oss] Fix blob presigned URL validation when fs.oss.sld.enabled is set [paimon]
Posted by "JingsongLi (via GitHub)" <gi...@apache.org>.
JingsongLi commented on PR #10230:
URL: https://github.com/apache/paimon/pull/10230#issuecomment-5967510096
+1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [oss] Fix blob presigned URL validation when fs.oss.sld.enabled is set [paimon]
Posted by "JingsongLi (via GitHub)" <gi...@apache.org>.
JingsongLi commented on PR #10230:
URL: https://github.com/apache/paimon/pull/10230#issuecomment-5944653771
Requirement fit: SUPPORTED. Implementation: FINDINGS at `c60393a1c4`.
**[P2] Update the downstream Jindo presigning fixture for the new configuration access**
`OSSBlobPresigner.java:224` now calls `client.getClientConfiguration().isSLDEnabled()`. The existing `JindoFileIOTest#testCreateBlobPresignedUrlUsesOssClient` also reaches this implementation, but its Mockito `OSSClient` leaves that method unstubbed, returning null. The test now throws an IOException caused by a NullPointerException at this new line. This is the actual failure in both the [JDK 8](https://github.com/apache/paimon/actions/runs/36292649326/job/108545592130) and [JDK 11](https://github.com/apache/paimon/actions/runs/36292649326/job/108545592171) Core/integrations CI jobs.
I reproduced the failing Jindo method locally with normal Maven checks. Running the same method with only the presigner implementation restored to the base passes. Please add a `getClientConfiguration()` stub returning `new ClientConfiguration()` to the Jindo fixture, as this PR already does for the OSS fixtures, and rerun the affected CI. This is a test/build regression; real SDK clients have a non-null configuration.
The SLD addressing fix has end-to-end value, and its SDK/security contract looks correct. The full `OSSFileIOTest` suite passes all 20 tests locally on both JDK 8 and JDK 11, including actual SDK-signed encoded-key/port URLs and bucket rejection. Production validation still needs the affected integration checks to pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [oss] Fix blob presigned URL validation when fs.oss.sld.enabled is set [paimon]
Posted by "thswlsqls (via GitHub)" <gi...@apache.org>.
thswlsqls commented on PR #10230:
URL: https://github.com/apache/paimon/pull/10230#issuecomment-5946307064
@JingsongLi Thanks for tracking this down. Fixed — `JindoFileIOTest#testCreateBlobPresignedUrlUsesOssClient` now stubs `getClientConfiguration()` with `new ClientConfiguration()`, matching the OSS fixtures.
On the new head, Core/integrations JDK 11 is green. On JDK 8, `JindoFileIOTest` (5/5) and `OSSFileIOTest` (20/20) passed, but the job later failed because the hosted runner lost communication.
Could you rerun the JDK 8 job when you have a chance?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org