okumin opened a new pull request, #6641:
URL: https://github.com/apache/hive/pull/6641
<!--
Thanks for sending a pull request! Here are some tips for you:
1. If this is your first time, please read our contributor guidelines:
https://cwiki.apache.org/confluence/display/Hive/HowToContribute
2. Ensure that you have created an issue on the Hive project JIRA:
https://issues.apache.org/jira/projects/HIVE/summary
3. Ensure you have added or run the appropriate tests for your PR:
4. If the PR is unfinished, add '[WIP]' in your PR title, e.g.,
'[WIP]HIVE-XXXXX: Your PR title ...'.
5. Be sure to keep the PR description updated to reflect all changes.
6. Please write your PR title to summarize what this PR proposes.
7. If possible, provide a concise example to reproduce the issue for a
faster review.
-->
### What changes were proposed in this pull request?
Authorize a CREATE TABLE request with stage-create enabled.
https://issues.apache.org/jira/browse/HIVE-29769
### Why are the changes needed?
Stage Create is a feature to retrieve table locations and other information
without persisting the table in the Hive Metastore. It is used when an external
client performs a CTAS-like operation.
<img width="752" height="255" alt="image"
src="https://github.com/user-attachments/assets/34c3c629-57e1-4f4c-b7a2-a494044a9464";
/>
Our Iceberg REST relies on HMS for authz. On this path, the authorization
plugin is not involved since no metadata is stored in the backend RDBMS.
A pitfall is that the API allows an end user to specify a table location. It
is currently OK because we don't provide Credential Vending yet. However, once
we deliver the feature, we must validate the specified URI.
This is very related to the vulnerability of Apache Polaris that was
recently reported.
https://polaris.apache.org/community/security-advisories/cve-2026-42809/
This PR would validate the specified location using Apache Ranger or another
authz plugin.
### Does this PR introduce _any_ user-facing change?
If a user is using a stage-create, it might fail. However, as it finally
fails on commit, the severity is not so high.
### How was this patch tested?
I added unit and integration tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
