[doris] 11/31: [fix](auth)fix not check udf auth in nereids (#25541)

[kx...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

kxiao pushed a commit to branch branch-2.0
in repository https://gitbox.apache.org/repos/asf/doris.git

commit bf402c3acc172fbbeee0579e5eb317fa4df1d54b
Author: zhangdong <49...@qq.com>
AuthorDate: Wed Oct 18 16:22:36 2023 +0800

    [fix](auth)fix not check udf auth in nereids (#25541)
---
 .../org/apache/doris/catalog/FunctionRegistry.java |  4 +-
 .../suites/javaudf_p0/test_javaudf_auth.groovy     | 69 ++++++++++++++++++++++
 2 files changed, 72 insertions(+), 1 deletion(-)

diff --git a/fe/fe-core/src/main/java/org/apache/doris/catalog/FunctionRegistry.java b/fe/fe-core/src/main/java/org/apache/doris/catalog/FunctionRegistry.java
index 57fcbff6a49..f320f753ec7 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/catalog/FunctionRegistry.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/catalog/FunctionRegistry.java
@@ -18,6 +18,7 @@
 package org.apache.doris.catalog;
 
 import org.apache.doris.cluster.ClusterNamespace;
+import org.apache.doris.mysql.privilege.PrivPredicate;
 import org.apache.doris.nereids.annotation.Developing;
 import org.apache.doris.nereids.exceptions.AnalysisException;
 import org.apache.doris.nereids.trees.expressions.functions.AggStateFunctionBuilder;
@@ -132,7 +133,8 @@ public class FunctionRegistry {
         if (ConnectContext.get() != null) {
             dbName = ClusterNamespace.getFullName(ConnectContext.get().getClusterName(),
                     dbName == null ? ConnectContext.get().getDatabase() : dbName);
-            if (dbName == null) {
+            if (dbName == null || !Env.getCurrentEnv().getAccessManager()
+                    .checkDbPriv(ConnectContext.get(), dbName, PrivPredicate.SELECT)) {
                 scopes = ImmutableList.of(GLOBAL_FUNCTION);
             } else {
                 scopes = ImmutableList.of(dbName, GLOBAL_FUNCTION);
diff --git a/regression-test/suites/javaudf_p0/test_javaudf_auth.groovy b/regression-test/suites/javaudf_p0/test_javaudf_auth.groovy
new file mode 100644
index 00000000000..5d08d8d0bd0
--- /dev/null
+++ b/regression-test/suites/javaudf_p0/test_javaudf_auth.groovy
@@ -0,0 +1,69 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.codehaus.groovy.runtime.IOGroovyMethods
+
+import java.nio.charset.StandardCharsets
+import java.nio.file.Files
+import java.nio.file.Paths
+
+suite("test_javaudf_auth") {
+    def jarPath = """${context.file.parent}/jars/java-udf-case-jar-with-dependencies.jar"""
+    log.info("Jar path: ${jarPath}".toString())
+    File path = new File(jarPath)
+    if (!path.exists()) {
+        throw new IllegalStateException("""${jarPath} doesn't exist! """)
+    }
+
+    def tokens = context.config.jdbcUrl.split('/')
+    def url=tokens[0] + "//" + tokens[2] + "/" + "information_schema" + "?"
+
+    def user = 'udf_auth_user'
+    def pwd = '123456'
+    def dbName = 'udf_auth_db'
+
+    try_sql("DROP USER ${user}")
+    try_sql("DROP FUNCTION IF EXISTS java_udf_auth_test(int);")
+    sql """DROP DATABASE IF EXISTS ${dbName}"""
+
+    sql """CREATE USER '${user}' IDENTIFIED BY '${pwd}'"""
+    sql """CREATE DATABASE ${dbName}"""
+
+    sql """USE ${dbName}"""
+    sql """ CREATE FUNCTION java_udf_auth_test(int) RETURNS int PROPERTIES (
+        "file"="file://${jarPath}",
+        "symbol"="org.apache.doris.udf.IntTest",
+        "type"="JAVA_UDF"
+    ); """
+    connect(user=user, password="${pwd}", url=url) {
+        try {
+            sql "select ${dbName}.java_udf_auth_test(1)"
+            fail()
+        } catch (Exception e) {
+            log.info(e.getMessage())
+        }
+    }
+
+    sql """GRANT SELECT_PRIV ON ${dbName}.* TO ${user}"""
+    connect(user=user, password="${pwd}", url=url) {
+        try {
+            sql "select ${dbName}.java_udf_auth_test(1)"
+        } catch (Exception e) {
+            fail()
+        }
+    }
+}


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org