CalvinKirs commented on code in PR #65987:
URL: https://github.com/apache/doris/pull/65987#discussion_r3649455627
##########
fe/fe-common/src/main/java/org/apache/doris/common/Config.java:
##########
@@ -3256,9 +3256,11 @@ public static int metaServiceRpcRetryTimes() {
@ConfField(mutable = true)
public static int mow_calculate_delete_bitmap_retry_times = 10;
- @ConfField(mutable = true, description = {
+ @ConfField(description = {
Review Comment:
Turning a previously-mutable config non-mutable inherently has a transient
mixed-version window during a rolling upgrade — this is common to this whole
class of change in Doris. The three keys here (S3/JDBC allowlists and SQL
Server encryption) are security-sensitive, which is exactly why we want them
fixed to `fe.conf`.
The failure is transient and self-correcting once all FEs are upgraded, and
the command returns an explicit failure rather than silently succeeding. We
consider that an acceptable trade-off versus adding a bespoke
preflight/rollback protocol for these keys.
##########
fe/fe-connector/fe-connector-jdbc/src/main/java/org/apache/doris/connector/jdbc/JdbcConnectorProvider.java:
##########
@@ -58,6 +58,11 @@ public void validateProperties(Map<String, String>
properties) {
}
}
+ // 1b. Mandatory, non-configurable driver_url security rule.
checkProperties() runs this on
+ // both CREATE and ALTER CATALOG (both !isReplay), so a malicious
driver_url cannot be
+ // introduced by either; metadata replay of existing catalogs is never
affected.
+ JdbcDorisConnector.checkDriverUrlSecurityRule(resolve(properties,
JdbcConnectorProperties.DRIVER_URL));
Review Comment:
This is intentional rather than delta-aware. When an existing catalog is
altered, we re-validate its `driver_url` under the current rule even if the
ALTER targets another property: once a catalog is administratively modified, we
want it to conform to the create-time security rule.
Unmodified catalogs are never re-validated — replay and lazy access skip the
rule entirely (see acf842e830), so existing catalogs keep working untouched. A
driver name that predates the rule only needs to be normalized the next time
the catalog is altered.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
