You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kyuubi.apache.org by aa...@apache.org on 2026/07/17 13:33:28 UTC
(kyuubi) branch branch-1.12 updated: [KYUUBI #7575] Improve access path validation
This is an automated email from the ASF dual-hosted git repository.
aajisaka pushed a commit to branch branch-1.12
in repository https://gitbox.apache.org/repos/asf/kyuubi.git
The following commit(s) were added to refs/heads/branch-1.12 by this push:
new 58a627664e [KYUUBI #7575] Improve access path validation
58a627664e is described below
commit 58a627664e1956e7f43a19fb649a9902497c0e0b
Author: Akira Ajisaka <aa...@apache.org>
AuthorDate: Fri Jul 17 22:33:07 2026 +0900
[KYUUBI #7575] Improve access path validation
### Why are the changes needed?
Normalize config keys before access path validation
### How was this patch tested?
Added unit tests
### Was this patch authored or co-authored using generative AI tooling?
Assisted by: GPT-5.5
Closes #7575 from aajisaka/fix-spark-access-path.
Closes #7575
9c1b47268 [Akira Ajisaka] Improve access path validation
Authored-by: Akira Ajisaka <aa...@apache.org>
Signed-off-by: Akira Ajisaka <aa...@apache.org>
(cherry picked from commit 7066271318b2a1d81e4a3e7b7c89f622b14107ad)
Signed-off-by: Akira Ajisaka <aa...@apache.org>
---
.../kyuubi/engine/KyuubiApplicationManager.scala | 14 ++++++----
.../kyuubi/engine/spark/SparkProcessBuilder.scala | 18 +++++++-----
.../engine/KyuubiApplicationManagerSuite.scala | 32 ++++++++++++++++++++++
3 files changed, 52 insertions(+), 12 deletions(-)
diff --git a/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/KyuubiApplicationManager.scala b/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/KyuubiApplicationManager.scala
index fd3ffbed0a..7f1f8b9c33 100644
--- a/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/KyuubiApplicationManager.scala
+++ b/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/KyuubiApplicationManager.scala
@@ -176,11 +176,15 @@ object KyuubiApplicationManager {
appConf: Map[String, String],
kyuubiConf: KyuubiConf): Unit = {
if (kyuubiConf.get(KyuubiConf.SESSION_LOCAL_DIR_ALLOW_LIST).nonEmpty) {
- (SparkProcessBuilder.PATH_CONFIGS.toSet ++
- kyuubiConf.get(KyuubiConf.SERVER_SPARK_FILE_CONFIG_LIST)).flatMap { key =>
- appConf.get(key).map(_.split(",")).getOrElse(Array.empty)
- }.filter(_.nonEmpty).foreach { path =>
- checkApplicationAccessPath(path, kyuubiConf)
+ val policedKeys = SparkProcessBuilder.PATH_CONFIGS.toSet ++
+ kyuubiConf.get(KyuubiConf.SERVER_SPARK_FILE_CONFIG_LIST)
+ .map(SparkProcessBuilder.convertConfigKey)
+ appConf.foreach { case (key, value) =>
+ if (policedKeys.contains(SparkProcessBuilder.convertConfigKey(key))) {
+ value.split(",").filter(_.nonEmpty).foreach { path =>
+ checkApplicationAccessPath(path, kyuubiConf)
+ }
+ }
}
}
}
diff --git a/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/spark/SparkProcessBuilder.scala b/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/spark/SparkProcessBuilder.scala
index c4b11d0a1c..44606a6bed 100644
--- a/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/spark/SparkProcessBuilder.scala
+++ b/kyuubi-server/src/main/scala/org/apache/kyuubi/engine/spark/SparkProcessBuilder.scala
@@ -101,13 +101,7 @@ class SparkProcessBuilder(
* - Otherwise, the key will be added a `spark.` prefix
*/
protected def convertConfigKey(key: String): String = {
- if (key.startsWith("spark.")) {
- key
- } else if (key.startsWith("hadoop.")) {
- "spark.hadoop." + key
- } else {
- "spark." + key
- }
+ SparkProcessBuilder.convertConfigKey(key)
}
private[kyuubi] def extractSparkCoreScalaVersion(fileNames: Iterable[String]): String = {
@@ -408,6 +402,16 @@ class SparkProcessBuilder(
}
object SparkProcessBuilder {
+ private[kyuubi] def convertConfigKey(key: String): String = {
+ if (key.startsWith("spark.")) {
+ key
+ } else if (key.startsWith("hadoop.")) {
+ "spark.hadoop." + key
+ } else {
+ "spark." + key
+ }
+ }
+
final val APP_KEY = "spark.app.name"
final val TAG_KEY = "spark.yarn.tags"
final val MASTER_KEY = "spark.master"
diff --git a/kyuubi-server/src/test/scala/org/apache/kyuubi/engine/KyuubiApplicationManagerSuite.scala b/kyuubi-server/src/test/scala/org/apache/kyuubi/engine/KyuubiApplicationManagerSuite.scala
index 746b3babc7..08646bf220 100644
--- a/kyuubi-server/src/test/scala/org/apache/kyuubi/engine/KyuubiApplicationManagerSuite.scala
+++ b/kyuubi-server/src/test/scala/org/apache/kyuubi/engine/KyuubiApplicationManagerSuite.scala
@@ -20,6 +20,7 @@ package org.apache.kyuubi.engine
import org.apache.kyuubi.{KyuubiException, KyuubiFunSuite}
import org.apache.kyuubi.config.KyuubiConf
import org.apache.kyuubi.engine.KubernetesApplicationOperation.LABEL_KYUUBI_UNIQUE_KEY
+import org.apache.kyuubi.engine.spark.SparkProcessBuilder
class KyuubiApplicationManagerSuite extends KyuubiFunSuite {
test("application access path") {
@@ -115,6 +116,37 @@ class KyuubiApplicationManagerSuite extends KyuubiFunSuite {
localDirLimitConf.unset(KyuubiConf.SERVER_SPARK_FILE_CONFIG_LIST)
}
+ test("application access path checks unprefixed spark file conf aliases") {
+ val localDirLimitConf = KyuubiConf()
+ .set(KyuubiConf.SESSION_LOCAL_DIR_ALLOW_LIST, Set("/apache/kyuubi"))
+
+ SparkProcessBuilder.PATH_CONFIGS.foreach { canonicalKey =>
+ Seq(canonicalKey, canonicalKey.stripPrefix("spark.")).foreach { key =>
+ val e = intercept[KyuubiException] {
+ KyuubiApplicationManager.checkApplicationAccessPaths(
+ "SPARK",
+ Map(key -> "/etc/passwd"),
+ localDirLimitConf)
+ }
+ assert(e.getMessage.contains("is not in the local dir allow list"), s"key=$key")
+ }
+ }
+
+ Seq("spark.files", "files").foreach { key =>
+ KyuubiApplicationManager.checkApplicationAccessPaths(
+ "SPARK",
+ Map(key -> "/apache/kyuubi/a.jar"),
+ localDirLimitConf)
+ }
+
+ intercept[KyuubiException] {
+ KyuubiApplicationManager.checkApplicationAccessPaths(
+ "SPARK",
+ Map("spark.files" -> "/apache/kyuubi/a.jar", "files" -> "/etc/passwd"),
+ localDirLimitConf)
+ }
+ }
+
test("Test kyuubi application Manager tag spark on kubernetes application") {
val conf: KyuubiConf = KyuubiConf()
val tag = "kyuubi-test-tag"