github-actions[bot] commented on code in PR #69527:
URL: https://github.com/apache/doris/pull/69527#discussion_r4366876841
##########
fe/fe-core/src/main/java/org/apache/doris/tablefunction/S3TableValuedFunction.java:
##########
@@ -63,6 +76,11 @@ public S3TableValuedFunction(Map<String, String> properties,
List<TBrokerFileSta
} catch (UserException e) {
throw new RuntimeException(e);
}
+ // Validate the final URI, including when BrokerProperties passes it
through unchanged.
+ // A local dataset must not bypass the LOCAL switch, privileges or BE
secure directory.
+ if (isLanceFormat() && !isRemoteLanceUri(filePath)) {
Review Comment:
[P1] Reject local fragment bases inside remote Lance manifests
With enable_local_tvf=false, an ordinary S3 caller can supply a valid
s3://bucket/clone.lance manifest with a base_paths entry pointing to
file:///srv/private/source.lance and a DataFile.base_id referencing it. Use a
plain BIGINT schema, recorded physical row counts, and a known existing
BE-readable fragment. FE's Lance 12 [supports this manifest
metadata](https://github.com/lance-format/lance/blob/cbeec97cb893a66ad6b3db87f25a57ab0093f358/protos/table.proto#L231-L260),
so BASIC metadata loading succeeds without opening the local data. This guard
accepts the remote primary URI, and TVFScanNode sends FILE_S3 with a positive
version, bypassing resolve_dataset_uri's LOCAL validation. The pinned SDK then
[selects an object store from the manifest base
URI](https://github.com/lance-format/lance/blob/68c12dfd7efe02f90ad2d7f3a239a7eb64884e57/rust/lance/src/dataset.rs#L2441-L2503)
and [opens the fragment through
it](https://github.com/lance-format/lance/blob/68c12dfd7efe02f90ad2d7f3a239a7e
b64884e57/rust/lance/src/dataset/fragment.rs#L1404-L1454), exposing BE-local
rows without LOCAL opt-in, ADMIN/OPERATOR, or secure-root containment. This is
distinct from the existing malformed-authority and LOCAL descendant-symlink
threads: the primary URI is valid remote and no symlink is involved. Reject
local manifest base providers for remote TVFs before delegated reads and add
this negative case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
