github-actions[bot] commented on code in PR #69741:
URL: https://github.com/apache/doris/pull/69741#discussion_r4398679531
##########
fe/fe-core/src/main/java/org/apache/doris/service/FrontendServiceImpl.java:
##########
@@ -2265,6 +2265,26 @@ private static int nextGroupCommitFollowerIndex(int
followerCount) {
return Math.floorMod(GROUP_COMMIT_FOLLOWER_INDEX.getAndIncrement(),
followerCount);
}
+ private void checkGroupCommitStreamLoadAuth(TStreamLoadPutRequest request)
throws AuthenticationException {
+ // Explicit group commit skips loadTxnBegin, so authenticate and
authorize the standard Stream Load
+ // request here before it can be forwarded or planned. Requests with
load_sql use the separate HTTP
+ // Stream path, whose planner performs its own authorization and whose
internal caller uses a token.
+ if (!Strings.isNullOrEmpty(request.getLoadSql()) ||
!request.isSetGroupCommitMode()
+ || request.getGroupCommitMode().equalsIgnoreCase("off_mode")) {
+ return;
+ }
+
+ if (request.isSetAuthCode()) {
Review Comment:
[P1] Reject unvalidated HTTP auth codes in the new auth guard
The standard BE endpoint accepts a numeric `auth_code` HTTP header in
`parse_basic_auth` (`be/src/service/http/utils.cpp`), and `set_request_auth`
copies it into this request while clearing the password. A direct BE Stream
Load to an existing light-schema-change table with `group_commit:async_mode`,
`auth_code:1` and a nonempty CSV body therefore reaches this empty branch even
with an incorrect password or no LOAD privilege. Explicit group commit skips
`loadTxnBegin`, and the subsequent stream-load planner performs no
credential/LOAD check, so the authorization bypass this PR is intended to fix
remains reachable. Reject the deprecated auth-code path or validate it before
treating it as authenticated, and cover this HTTP-header case in the regression
test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
