You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by ki...@apache.org on 2026/10/23 02:00:26 UTC
(doris) branch master updated: [fix](fe) Enforce LOCAL TVF privileges before file access (#69323)
This is an automated email from the ASF dual-hosted git repository.
CalvinKirs pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new cc490698369 [fix](fe) Enforce LOCAL TVF privileges before file access (#69323)
cc490698369 is described below
commit cc49069836975cd3a37bcdc9ba3e35a1fca717d3
Author: Calvin Kirs <gu...@selectdb.com>
AuthorDate: Fri Oct 23 10:00:17 2026 +0800
[fix](fe) Enforce LOCAL TVF privileges before file access (#69323)
### What problem does this PR solve?
Issue Number: N/A
Problem Summary:
Nereids could construct a LOCAL TVF and list files or discover their
schema before enforcing the ADMIN/OPERATOR privilege requirement. The
local-storage branch of FILE TVF reached the same constructor.
Check ADMIN or OPERATOR privileges at the start of LOCAL TVF
construction, before property parsing and file access. Recheck these
privileges through `checkAuth` and preserve the inherited Resource USAGE
check. The FILE wrapper uses the same checks.
Add unit coverage for denied access before file-service interactions,
separate ADMIN and OPERATOR access, and permission revocation. Add SQL
regression coverage for LOCAL/FILE through SELECT and EXPLAIN.
### Release note
LOCAL TVF and FILE TVF with local storage require ADMIN or OPERATOR
privileges before file listing or schema discovery.
### Check List (For Author)
- Test
- [ ] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason
Validation: `LocalTableValuedFunctionAuthTest` passed all 5 focused
tests against the compiled FE classes. Checkstyle passed for both
changed Java files. The added `test_local_tvf_privilege` SQL regression
suite has not been executed. Local read-only code review completed with
no findings; it did not rerun tests.
- Behavior changed:
- [ ] No.
- [x] Yes. Ordinary users are rejected before LOCAL TVF file access;
ADMIN and OPERATOR remain allowed.
- Does this need documentation?
- [x] No. Restores the existing privilege requirement.
- [ ] Yes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
---
.../tablefunction/LocalTableValuedFunction.java | 15 +++
.../LocalTableValuedFunctionAuthTest.java | 129 +++++++++++++++++++++
.../account_p0/test_local_tvf_privilege.groovy | 44 +++++++
3 files changed, 188 insertions(+)
diff --git a/fe/fe-core/src/main/java/org/apache/doris/tablefunction/LocalTableValuedFunction.java b/fe/fe-core/src/main/java/org/apache/doris/tablefunction/LocalTableValuedFunction.java
index 271922302b1..b462c395b1c 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/tablefunction/LocalTableValuedFunction.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/tablefunction/LocalTableValuedFunction.java
@@ -21,7 +21,9 @@ import org.apache.doris.analysis.BrokerDesc;
import org.apache.doris.analysis.StorageBackend.StorageType;
import org.apache.doris.catalog.Env;
import org.apache.doris.common.AnalysisException;
+import org.apache.doris.common.ErrorCode;
import org.apache.doris.datasource.storage.StorageAdapter;
+import org.apache.doris.mysql.privilege.PrivPredicate;
import org.apache.doris.proto.InternalService;
import org.apache.doris.proto.InternalService.PGlobResponse;
import org.apache.doris.proto.InternalService.PGlobResponse.PFileInfo;
@@ -61,6 +63,9 @@ public class LocalTableValuedFunction extends ExternalFileTableValuedFunction {
private boolean sharedStorage = false;
public LocalTableValuedFunction(Map<String, String> properties) throws AnalysisException {
+ // Check privileges before listing files or discovering their schema.
+ checkAuth(ConnectContext.get());
+
// 1. analyze common properties
Map<String, String> props = super.parseCommonProperties(properties);
@@ -132,6 +137,16 @@ public class LocalTableValuedFunction extends ExternalFileTableValuedFunction {
}
}
+ @Override
+ public void checkAuth(ConnectContext ctx) {
+ if (!Env.getCurrentEnv().getAccessManager().checkGlobalPriv(ctx, PrivPredicate.ADMIN)
+ && !Env.getCurrentEnv().getAccessManager().checkGlobalPriv(ctx, PrivPredicate.OPERATOR)) {
+ String message = ErrorCode.ERR_SPECIFIC_ACCESS_DENIED_ERROR.formatErrorMsg("ADMIN/OPERATOR");
+ throw new org.apache.doris.nereids.exceptions.AnalysisException(message);
+ }
+ super.checkAuth(ctx);
+ }
+
@Override
public TFileType getTFileType() {
return TFileType.FILE_LOCAL;
diff --git a/fe/fe-core/src/test/java/org/apache/doris/tablefunction/LocalTableValuedFunctionAuthTest.java b/fe/fe-core/src/test/java/org/apache/doris/tablefunction/LocalTableValuedFunctionAuthTest.java
new file mode 100644
index 00000000000..c82cf2eebd9
--- /dev/null
+++ b/fe/fe-core/src/test/java/org/apache/doris/tablefunction/LocalTableValuedFunctionAuthTest.java
@@ -0,0 +1,129 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.doris.tablefunction;
+
+import org.apache.doris.catalog.Env;
+import org.apache.doris.mysql.privilege.AccessControllerManager;
+import org.apache.doris.mysql.privilege.PrivPredicate;
+import org.apache.doris.nereids.exceptions.AnalysisException;
+import org.apache.doris.proto.InternalService.PGlobResponse;
+import org.apache.doris.proto.Types.PStatus;
+import org.apache.doris.qe.ConnectContext;
+import org.apache.doris.qe.SessionVariable;
+import org.apache.doris.rpc.BackendServiceProxy;
+import org.apache.doris.system.Backend;
+import org.apache.doris.system.SystemInfoService;
+import org.apache.doris.thrift.TNetworkAddress;
+
+import com.google.common.collect.ImmutableMap;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+
+public class LocalTableValuedFunctionAuthTest {
+ private static final Map<String, String> PROPERTIES = ImmutableMap.of(
+ "file_path", "local_privilege_test.csv", "backend_id", "1", "format", "csv");
+
+ private final Env env = Mockito.mock(Env.class);
+ private final ConnectContext context = Mockito.mock(ConnectContext.class);
+ private final AccessControllerManager accessManager = Mockito.mock(AccessControllerManager.class);
+ private final SystemInfoService systemInfo = Mockito.mock(SystemInfoService.class);
+ private final BackendServiceProxy proxy = Mockito.mock(BackendServiceProxy.class);
+ private MockedStatic<Env> mockedEnv;
+ private MockedStatic<ConnectContext> mockedContext;
+ private MockedStatic<BackendServiceProxy> mockedProxy;
+
+ @BeforeEach
+ public void setUp() throws Exception {
+ mockedEnv = Mockito.mockStatic(Env.class);
+ mockedEnv.when(Env::getCurrentEnv).thenReturn(env);
+ mockedEnv.when(Env::getCurrentSystemInfo).thenReturn(systemInfo);
+ mockedContext = Mockito.mockStatic(ConnectContext.class);
+ mockedContext.when(ConnectContext::get).thenReturn(context);
+ mockedProxy = Mockito.mockStatic(BackendServiceProxy.class);
+ mockedProxy.when(BackendServiceProxy::getInstance).thenReturn(proxy);
+ Mockito.when(env.getAccessManager()).thenReturn(accessManager);
+ Mockito.when(context.getSessionVariable()).thenReturn(new SessionVariable());
+ Mockito.when(context.getQueryTimeoutS()).thenReturn(60);
+
+ Backend backend = Mockito.mock(Backend.class);
+ Mockito.when(systemInfo.getBackend(1L)).thenReturn(backend);
+ Mockito.when(backend.getBrpcAddress()).thenReturn(new TNetworkAddress("127.0.0.1", 8060));
+ Mockito.when(proxy.glob(Mockito.any(), Mockito.any())).thenReturn(CompletableFuture.completedFuture(
+ PGlobResponse.newBuilder().setStatus(PStatus.newBuilder().setStatusCode(0)).build()));
+ }
+
+ @AfterEach
+ public void tearDown() {
+ mockedProxy.close();
+ mockedContext.close();
+ mockedEnv.close();
+ }
+
+ @Test
+ public void testLocalRejectsUnprivilegedUserBeforeFileAccess() {
+ AnalysisException exception = Assertions.assertThrows(AnalysisException.class,
+ () -> new LocalTableValuedFunction(PROPERTIES));
+ Assertions.assertTrue(exception.getMessage().contains("ADMIN/OPERATOR"));
+ Mockito.verifyNoInteractions(systemInfo, proxy);
+ }
+
+ @Test
+ public void testFileRejectsUnprivilegedLocalAccess() {
+ AnalysisException exception = Assertions.assertThrows(AnalysisException.class,
+ () -> new FileTableValuedFunction(PROPERTIES));
+ Assertions.assertTrue(exception.getMessage().contains("ADMIN/OPERATOR"));
+ Mockito.verifyNoInteractions(systemInfo, proxy);
+ }
+
+ @Test
+ public void testAdminCanAccessLocalFiles() throws Exception {
+ assertPrivilegedAccess(PrivPredicate.ADMIN);
+ }
+
+ @Test
+ public void testOperatorCanAccessLocalFiles() throws Exception {
+ assertPrivilegedAccess(PrivPredicate.OPERATOR);
+ }
+
+ @Test
+ public void testCheckAuthRejectsRevokedPrivileges() throws Exception {
+ Mockito.when(accessManager.checkGlobalPriv(context, PrivPredicate.ADMIN)).thenReturn(true);
+ LocalTableValuedFunction local = new LocalTableValuedFunction(PROPERTIES);
+ FileTableValuedFunction file = new FileTableValuedFunction(PROPERTIES);
+ Mockito.when(accessManager.checkGlobalPriv(context, PrivPredicate.ADMIN)).thenReturn(false);
+
+ Assertions.assertThrows(AnalysisException.class, () -> local.checkAuth(context));
+ Assertions.assertThrows(AnalysisException.class, () -> file.checkAuth(context));
+ }
+
+ private void assertPrivilegedAccess(PrivPredicate privilege) throws Exception {
+ Mockito.when(accessManager.checkGlobalPriv(context, privilege)).thenReturn(true);
+ LocalTableValuedFunction local = new LocalTableValuedFunction(PROPERTIES);
+ FileTableValuedFunction file = new FileTableValuedFunction(PROPERTIES);
+ Assertions.assertDoesNotThrow(() -> local.checkAuth(context));
+ Assertions.assertDoesNotThrow(() -> file.checkAuth(context));
+ Mockito.verify(proxy, Mockito.times(2)).glob(Mockito.any(), Mockito.any());
+ }
+}
diff --git a/regression-test/suites/account_p0/test_local_tvf_privilege.groovy b/regression-test/suites/account_p0/test_local_tvf_privilege.groovy
new file mode 100644
index 00000000000..4dfd4da49c8
--- /dev/null
+++ b/regression-test/suites/account_p0/test_local_tvf_privilege.groovy
@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+suite("test_local_tvf_privilege", "p0") {
+ def user = "local_tvf_privilege_user"
+ sql "DROP USER IF EXISTS '${user}'"
+ sql "CREATE USER '${user}' IDENTIFIED BY 'LocalTvf123!'"
+ sql "GRANT SELECT_PRIV ON *.*.* TO '${user}'"
+
+ if (isCloudMode()) {
+ def cluster = (sql "SHOW CLUSTERS")[0][0]
+ sql "GRANT USAGE_PRIV ON CLUSTER `${cluster}` TO '${user}'"
+ }
+
+ connect(user, "LocalTvf123!", context.config.jdbcUrl) {
+ for (def functionName : ["LOCAL", "FILE"]) {
+ // Reject the user before attempting to resolve the file or its schema.
+ for (def prefix : ["", "EXPLAIN "]) {
+ test {
+ sql """${prefix}SELECT * FROM ${functionName}(
+ "file_path" = "local_tvf_privilege_test.csv",
+ "backend_id" = "0",
+ "format" = "csv"
+ )"""
+ exception "ADMIN/OPERATOR"
+ }
+ }
+ }
+ }
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org