markhoerth opened a new issue, #14423:
URL: https://github.com/apache/gravitino/issues/14423
### Version
main branch, commit bb634defdc5663a8124be5fca1c8d9e52ac096ac (2.0.0-SNAPSHOT)
### Describe what's wrong
The metalake owner sends `POST /api/metalakes/{metalake}/jobs/runs` with a
body that has no `jobTemplateName`, an empty one, or a blank one. The owner
expects a 400 that says `jobTemplateName` is required. Instead the server
returns 500 "Authorization failed due to system internal error. Please contact
administrator.". With no body at all, the owner gets 403 "User 'admin' is not
authorized to perform operation 'runJob'", although the authorization
expression begins with `METALAKE::OWNER`.
The endpoint itself already returns 400 for a null body
(`server/src/main/java/org/apache/gravitino/server/web/rest/JobOperations.java:420-426`)
and calls `request.validate()`, but the authorization interceptor runs first.
In
`server/src/main/java/org/apache/gravitino/server/web/filter/authorization/RunJobAuthorizationExecutor.java`:
- `:59-62` return `false` (deny) when the request is null, so the request is
rejected as unauthorized before the endpoint's 400 check runs.
- `:70` calls `jobRunRequest.validate()`, which throws
`IllegalArgumentException("\"jobTemplateName\" is required and cannot be
empty")`. The interceptor's `catch (Exception ex)` in
`server/src/main/java/org/apache/gravitino/server/web/filter/GravitinoInterceptionService.java:305-315`
turns it into a 500.
### Error message and/or stacktrace
```
POST /api/metalakes/ml/jobs/runs {"jobConf":{}}
500 {"code":1002,"type":"RuntimeException","message":"Authorization failed
due to system internal error. Please contact administrator."}
server log:
java.lang.IllegalArgumentException: "jobTemplateName" is required and cannot
be empty
at
com.google.common.base.Preconditions.checkArgument(Preconditions.java:143)
at
org.apache.gravitino.dto.requests.JobRunRequest.validate(JobRunRequest.java:58)
POST /api/metalakes/ml/jobs/runs (no body)
403 {"code":1008,"type":"ForbiddenException","message":"User 'admin' is not
authorized to perform operation 'runJob' on metadata 'ml'"}
```
### How to reproduce
1. Create a metalake `ml` as `admin`:
```
curl -u admin:x -H 'Content-Type: application/json' -H 'Accept:
application/vnd.gravitino.v1+json' -X POST http://127.0.0.1:8090/api/metalakes
-d '{"name":"ml","comment":"","properties":{}}'
```
2. Run a job with no template name; the response is 500:
```
curl -u admin:x -H 'Content-Type: application/json' -H 'Accept:
application/vnd.gravitino.v1+json' -X POST
http://127.0.0.1:8090/api/metalakes/ml/jobs/runs -d '{"jobConf":{}}'
```
The same happens with `"jobTemplateName":""` and `"jobTemplateName":" "`.
3. Run a job with no body; the response is 403:
```
curl -u admin:x -H 'Content-Type: application/json' -H 'Accept:
application/vnd.gravitino.v1+json' -X POST
http://127.0.0.1:8090/api/metalakes/ml/jobs/runs
```
### Additional context
Related: #10171 (pre-try request dereference in `runJob`; a different spot),
#14304 (another input that reaches the same interceptor catch-all). The 2.0 OSS
test suite check `test_job_run_bad_request_is_400` found it. The defect is in
Gravitino's authorization executor.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
