bharos opened a new pull request, #14515: URL: https://github.com/apache/gravitino/pull/14515
### What changes were proposed in this pull request? `ActiveRolesParser` decodes role names in `X-Gravitino-Active-Roles`: - Re-reads the header bytes as UTF-8, so raw UTF-8 names match. - Percent-decodes each role name (`vrf_%E8%A7%92%E8%89%B2` → `vrf_角色`), after splitting and keyword matching. - Rejects malformed escapes, invalid UTF-8, and blank or control-character names with 400. Docs updated in `docs/security/access-control.md`. ### Why are the changes needed? Jetty decodes header bytes as ISO-8859-1, so non-Latin-1 role names never matched. Common clients (Apache HttpClient 5, used by Spark/Trino and the Java client; Python `http.client`) cannot send such values raw, so an ASCII-only form is needed. Fixes #14427 ### Does this PR introduce _any_ user-facing change? Yes, for the unreleased header: role names may be percent-encoded UTF-8 (a literal `%` is `%25`), and non-UTF-8 values return 400. ### How was this patch tested? Unit tests in `TestActiveRolesParser` and `TestAuthenticationFilter`; a new case in `RoleAssumptionAuthorizationIT`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
