jerryshao opened a new issue, #14610:
URL: https://github.com/apache/gravitino/issues/14610
### Version
`main` and `branch-1.3` (affected paths differ).
### Describe what's wrong
With authorization enabled, some invalid client inputs are processed before
REST validation and incorrectly returned as HTTP 500:
- Invalid metadata object `fullName`.
- Unknown values in the load-table `privileges` parameter.
- On `branch-1.3`, empty or both-null tag/policy association fields.
These requests should return HTTP 400 with the validation error.
Additionally, tag/policy association with a null request body returns 403 on
`branch-1.3`, instead of 400.
### Error message and/or stacktrace
```text
Authorization failed due to system internal error. Please contact
administrator.
```
Underlying exceptions include:
```text
IllegalArgumentException: tagsToAdd and tagsToRemove cannot both be null
IllegalArgumentException: policiesToAdd and policiesToRemove cannot both be
null
```
### How to reproduce
Enable authorization and use a user with access to the metalake:
1. Associate tags with `type=schema` and `fullName=catalog`, using an
otherwise valid request body.
2. Load a table with `?privileges=BOGUS`.
3. On `branch-1.3`, POST `{}` or both-null association fields to:
- `/api/metalakes/{metalake}/objects/{type}/{fullName}/tags`
- `/api/metalakes/{metalake}/objects/{type}/{fullName}/policies`
Expected: HTTP 400. Actual: HTTP 500.
### Additional context
Privilege parsing also short-circuits: `MODIFY_TABLE,BOGUS` can skip
validation of the unknown value. All supplied values should be validated.
The related run-job validation issue is already fixed on `branch-1.3` by
#14585.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
