dengzhhu653 commented on code in PR #6888:
URL: https://github.com/apache/hive/pull/6888#discussion_r4310822405
##########
standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/HMSHandler.java:
##########
@@ -1577,6 +1577,10 @@ public GetPartitionsResponse
get_partitions_with_specs(GetPartitionsRequest requ
getTableRequest.setCatName(catName);
Table table = get_table_core(getTableRequest);
firePreEvent(new PreReadTableEvent(table, this));
+ // Perform the same table-level filter hook check the regular partition
listing RPCs
+ // perform in GetPartitionsHandler.authorizeTableForPartitionMetadata()
+ FilterUtils.checkDbAndTableFilters(isServerFilterEnabled, filterHook,
normalizeIdentifier(catName),
Review Comment:
To get a full Ranger support, HMS should enable both the filter hook and
pre-event listener, losing either of them can lead to the security gaps. The
`HiveMetaStoreAuthorizer` is an example for both reacting to the pre-event and
filtering the result based on authorization checks.
If a table passed on pre-event check, it doesn't need to check the filter
hook again, as it's always green in such case.
The filter hooks is more for filtering the result before responding it to
client, other than validating the request input.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
