roryqi opened a new issue, #14562:
URL: https://github.com/apache/gravitino/issues/14562
### Version
main branch (`01eb0c277`; affected code also present at `6126562ff8`)
### Describe what's wrong
With Iceberg REST authorization enabled, requests whose decoded namespace
level contains `.` return HTTP 500 instead of a client error.
This affects loading, checking existence, updating properties and dropping a
namespace, including requests made by an administrator.
Creating `["a.b"]` already returns 400 before writing anything, but requests
addressing the same invalid name still return 500.
Expected: reject invalid namespace levels with HTTP 400 before evaluating
authorization or invoking the catalog.
### Error message and/or stacktrace
```json
{"error":{"message":"Authorization failed due to system internal error,
User: 'admin', Operation:
'loadNamespace'","type":"RuntimeException","code":500}}
```
### How to reproduce
1. Enable Iceberg REST authorization with a `lakehouse-iceberg` catalog
using the JDBC backend.
2. As an administrator, send GET requests to `/v1/{catalog}/namespaces/a.b`.
3. Repeat with `a%2Eb`, `%2e%2e` and literal `..`, preserving the request
path.
4. Also send HEAD, DELETE and POST properties requests for `a.b`.
These requests return 500. The namespace does not need to exist.
### Additional context
Namespace path parameters are decoded without validating their levels before
authorization. `IllegalNameIdentifierException` is later wrapped as a generic
`RuntimeException`, producing 500 even though the exception mapper already
supports mapping the original exception to 400.
Validation must run before authorization expression evaluation. Related:
#14438; its create-side validation does not cover this request-path failure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
