github-actions[bot] commented on code in PR #69528:
URL: https://github.com/apache/doris/pull/69528#discussion_r4366084340
##########
be/src/io/fs/local_file_system.cpp:
##########
@@ -455,28 +455,142 @@ const std::shared_ptr<LocalFileSystem>&
global_local_filesystem() {
Status LocalFileSystem::canonicalize_local_file(const std::string& dir,
const std::string& file_path,
std::string* full_path) {
- const std::string absolute_path = dir + "/" + file_path;
+ // An empty root would turn a relative request into an unrestricted
absolute path.
+ if (dir.empty()) {
+ return Status::InvalidArgument("user_files_secure_path must not be
empty");
+ }
+ // Reject embedded NULs before passing paths to filesystem APIs that use C
strings.
+ if (file_path.empty() || file_path.find('\0') != std::string::npos) {
+ return Status::InvalidArgument("local file path must not be empty or
contain NUL");
+ }
+ // URI schemes are ASCII case-insensitive; do not alter spelling in bare
paths.
+ const bool is_file_uri = file_path.size() >= 5 &&
+ (file_path[0] == 'f' || file_path[0] == 'F') &&
+ (file_path[1] == 'i' || file_path[1] == 'I') &&
+ (file_path[2] == 'l' || file_path[2] == 'L') &&
+ (file_path[3] == 'e' || file_path[3] == 'E') &&
file_path[4] == ':';
+ std::string local_input = file_path;
+ if (is_file_uri) {
+ local_input.replace(0, 4, "file");
+ // File URLs treat raw backslashes as separators, including before the
authority.
+ // Do this before conversion; percent-encoded backslashes must remain
literal.
+ for (size_t i = 5; i < local_input.size(); ++i) {
+ if (local_input[i] == '\\') {
+ local_input[i] = '/';
+ }
+ }
+ }
+ Path local_path;
+ // Convert file: URIs to filesystem paths and reject remote schemes before
any reader opens them.
+ RETURN_IF_ERROR(convert_to_abs_path(local_input, local_path));
Review Comment:
[P2] Preserve Lance file-URI parsing before resolving local paths
With `enable_local_tvf=true`, an ADMIN/OPERATOR and
`user_files_secure_path=/secure`, `file_path="file:///secure/sample.lance "`
(one raw trailing space) previously opened `/secure/sample.lance`: [Lance
parses the URI
first](https://github.com/lance-format/lance/blob/68c12dfd7efe02f90ad2d7f3a239a7eb64884e57/rust/lance-io/src/object_store.rs#L494-L502),
and its [URL parser trims trailing
spaces](https://github.com/servo/rust-url/blob/v2.5.8/url/src/parser.rs#L206-L220).
This conversion instead preserves the space and canonicalizes
`/secure/sample.lance `, a different directory. With same-schema datasets
holding different rows at those two locations, schema discovery and scans now
silently select the second dataset; if only the original exists, schema
discovery fails. FE property parsing and LanceSplit retain the original URI,
and Hadoop accepts this absolute form, so the input reaches both BE paths. This
differs from the existing percent/dot threads: no escapes, dot segments or sym
links are involved. Apply SDK-compatible parsing to actual `file:` URIs before
containment, retain literal bare-path whitespace, and add a schema/scan
collision test with different rows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
