markhoerth opened a new issue, #14476:
URL: https://github.com/apache/gravitino/issues/14476
### Version
main branch
### Describe what's wrong
1. A metalake member with no privileges can tell which view names exist.
`GET /v1/{prefix}/namespaces/{ns}/tables/{name}` answers 404 when `{name}` is a
view, but 403 for a table or a missing name.
`LoadTableAuthzHandler.performTableAuthorization` checks `viewExists` and
throws `NoSuchTableException` before it evaluates any privilege. Every other
route answers 403 for all three cases.
2. `POST /v1/{prefix}/namespaces/{ns}/properties` with
`{"updates":{"k":null}}` returns 200, and the JDBC catalog stores a NULL value.
From then on, loading the namespace, creating tables or views in it, and
removing the property all return 500 (`NullPointerException: null value in
entry: k=null` from `JdbcCatalog.fetchProperties`), through the IRC and the
Gravitino API. Iceberg's `UpdateNamespacePropertiesRequest` builder refuses
null values, but a request read from JSON skips the builder, and the IRC passes
it on unchecked. The spec types the values as strings, so the request should
get 400.
### Error message and/or stacktrace
```
GET /v1/c/namespaces/ns/tables/a_view 404 NoSuchTableException
(caller has no privileges)
GET /v1/c/namespaces/ns/tables/a_table 403 ForbiddenException
GET /v1/c/namespaces/ns/tables/nothing 403 ForbiddenException
POST /v1/c/namespaces/ns/properties {"removals":[],"updates":{"k":null}}
200
GET /v1/c/namespaces/ns 500 NullPointerException: null
value in entry: k=null
```
### How to reproduce
1. With authorization enabled, as a metalake member with no roles, load a
view's name, a table's name and a missing name through `/tables/`.
2. Post the null-value property update above, then load the namespace.
### Additional context
Expected: 403 for all three names in (1), and 400 for the update in (2) with
nothing stored.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
