yuqi1129 commented on issue #13696: URL: https://github.com/apache/gravitino/issues/13696#issuecomment-6055919571
The Lance REST API currently supports caller-provided locations: `RegisterTable` requires a `location`, while `CreateTable` and `DeclareTable` also accept one. However, the API contract does not establish whether that location belongs to the target catalog or another table, and Gravitino currently has no validation enforcing that relationship. Checking that the location contains a valid Lance dataset is insufficient: it could be the location of another table. Table-level authorization alone does not solve this either. A caller permitted to register or drop a table under one identifier should not thereby gain permission to access or delete the dataset of another table by registering its location. To address this while retaining server-side data operations, Lance REST would need an explicit location-scope contract. For example, a catalog could be restricted to `s3://xxxx/v1/`, and any supplied location outside that scope would be rejected. The scope must be controlled by an administrator, and validation must apply consistently to registration, creation, declaration, and subsequent dataset I/O, including existing registrations. This should use URI-aware validation of the scheme, bucket/authority, and path segments rather than a raw string-prefix check: `s3://xxxx/v10/` must not match `s3://xxxx/v1/`. Caller-provided storage options must also be prevented from changing the effective storage endpoint in a way that bypasses the scope. A catalog scope would establish a storage boundary; conflicts or overlaps with locations already assigned to other tables would still require separate ownership validation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
