Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[KYUUBI #5793][AUTHZ][BUG] PVM with nested scalar-subquery should not check src table privilege #5796

Closed
wants to merge 2 commits into from

Conversation

AngersZhuuuu
Copy link
Contributor

@AngersZhuuuu AngersZhuuuu commented Nov 30, 2023

🔍 Description

Issue References 🔗

This pull request fixes #5793

Describe Your Solution 🔧

For SQL have nested scalar-subquery, since the scalar-subquery in scalar-subquery was not wrapped by PVM, this pr fix this.
Note :This bug is not imported by #5780

Types of changes 🔖

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Test Plan 🧪

Behavior Without This Pull Request ⚰️

CREATE VIEW $db1.$view1
AS
SELECT id, name, max(scope) as max_scope, sum(age) sum_age
FROM $db1.$table2
WHERE scope in (
    SELECT max(scope) max_scope
    FROM $db1.$table1
   WHERE id IN (SELECT id FROM $db1.$table3)
)
GROUP BY id, name

when we query $db1.$view1 and if we have view1's privilege, it will throw

Permission denied: user [user_perm_view_only] does not have [select] privilege on [default/table3/id]
org.apache.kyuubi.plugin.spark.authz.AccessControlException: Permission denied: user [user_perm_view_only] does not have [select] privilege on [default/table3/id]
   at org.apache.kyuubi.plugin.spark.authz.ranger.SparkRangerAdminPlugin$.verify(SparkRangerAdminPlugin.scala:167)

Behavior With This Pull Request 🎉

Won't request table3's privilege

Related Unit Tests


Checklists

📝 Author Self Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • This patch was not authored or co-authored using Generative Tooling

📝 Committer Pre-Merge Checklist

  • Pull request title is okay.
  • No license issues.
  • Milestone correctly set?
  • Test coverage is ok
  • Assignees are selected.
  • Minimum number of approvals
  • No changes are requested

Be nice. Be informative.

@AngersZhuuuu
Copy link
Contributor Author

ping @yaooqinn

@turboFei turboFei changed the title [KYUUBI #5793][BUG] PVM with nested scalar-subquery should not check src table privilege [KYUUBI #5793][AUTHZ][BUG] PVM with nested scalar-subquery should not check src table privilege Dec 1, 2023
@yaooqinn yaooqinn added this to the v1.9.0 milestone Dec 1, 2023
@yaooqinn yaooqinn closed this in 44d194d Dec 1, 2023
@yaooqinn
Copy link
Member

yaooqinn commented Dec 1, 2023

thanks, merged to master

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[TASK][EASY] PVM with nested scala-subquery will check internal src table privilege
2 participants