kuczoram opened a new pull request, #6928:
URL: https://github.com/apache/hive/pull/6928
<!--
Thanks for sending a pull request! Here are some tips for you:
1. If this is your first time, please read our contributor guidelines:
https://cwiki.apache.org/confluence/display/Hive/HowToContribute
2. Ensure that you have created an issue on the Hive project JIRA:
https://issues.apache.org/jira/projects/HIVE/summary
3. Ensure you have added or run the appropriate tests for your PR:
4. If the PR is unfinished, add '[WIP]' in your PR title, e.g.,
'[WIP]HIVE-XXXXX: Your PR title ...'.
5. Be sure to keep the PR description updated to reflect all changes.
6. Please write your PR title to summarize what this PR proposes.
7. If possible, provide a concise example to reproduce the issue for a
faster review.
-->
### What changes were proposed in this pull request?
I propose to restrict the config parameter override in compactions jobs,
like the following:
- Introduced three new config parameters to control the set of config
parameter which are allowed to be overwritten in the compaction jobs:
"hive.compactor.conf.allowlist", "hive.compactor.conf.allowlist.append",
"hive.compactor.conf.denylist"
- Before overwriting a config parameter it would go through some validation
steps:
-- First it is validated against "hive.compactor.conf.allowlist". This
config contains a regex which limits the scope of the allowed config
parameters. There are thousands of possible config parameters which can be set
in the compaction job, but actually most of them doesn't make sense. Even if
they don't hold any security risk, they doesn't make sense to be set there,
because they can have no affect. By defining an allowed scope, the set of
configs are significantly reduced. Like this it was possible to define a deny
list relatively small and readable. I was first trying to define a deny list
against all possible config, but it became huge and unreadable.
-- If a config parameter passed the allow config, it will be validated
against "hive.compactor.conf.denylist". This regex filters for the most common
keywords which can indicate that a config is possibly harmful.
-- If a config parameter passed the deny list, it still be validated against
the existing configs in hive, such as the restricted, hidden and locked list
configs.
- There is a possibility for admins to extend the allow list by setting
"hive.compactor.conf.allowlist.append". Here the config parameters have to be
listed by names. And even though a config parameter is set here, it will still
be validated against the deny list and the restricted/hidden/locked lists.
### Why are the changes needed?
So far there were no validation on the config parameters which were set in
the compaction jobs. Therefore it was possible to set any config parameters
there.
### Does this PR introduce _any_ user-facing change?
Yes, the set of the allowed config are restricted now. But the admins can
extend this set by config parameter.
### How was this patch tested?
Unit tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
