suneet-s opened a new pull request #10106: URL: https://github.com/apache/druid/pull/10106
### Description This PR fixes an issue flagged by LGTM. It prevents special characters from being used in the authorizer name so that the authorizer can not be abused to access files on the overlord. This change chose to bind the validation so that it to an annotation so that it can be applied elsewhere in the code if needed. When an admin provides an authorizer name via system properties, no validation is done at this point, but it might be worth considering in the future. <hr> This PR has: - [ ] been self-reviewed. - [ ] added documentation for new or modified features or behaviors. - [ ] added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links. - [ ] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/licenses.yaml) - [ ] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader. - [ ] added unit tests or modified existing tests to cover new code paths, ensuring the threshold for [code coverage](https://github.com/apache/druid/blob/master/dev/code-review/code-coverage.md) is met. - [ ] added integration tests. - [ ] been tested in a test Druid cluster. <hr> ##### Key changed/added classes in this PR * `AuthorizerResourceFilter` * `AuthorizerNameValidation` ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscr...@druid.apache.org For additional commands, e-mail: commits-h...@druid.apache.org
