Copilot commented on code in PR #6936:
URL: https://github.com/apache/hive/pull/6936#discussion_r4445642321
##########
iceberg/iceberg-rest-catalog-client/src/main/java/org/apache/iceberg/hive/rest/catalog/client/HiveRESTCatalogClient.java:
##########
@@ -207,11 +210,20 @@ public Table getTable(GetTableRequest tableRequest)
throws TException {
return MetastoreUtil.toHiveTable(icebergTable, conf);
} catch (NoSuchTableException tableMissing) {
if (restCatalog instanceof ViewCatalog viewCatalog) {
- if (!viewCatalog.viewExists(id)) {
+ View view;
+ try {
+ view = viewCatalog.loadView(id);
+ } catch (NoSuchViewException viewMissing) {
throw new NoSuchObjectException();
}
- return MetastoreUtil.buildMinimalHMSView(
+ Table hmsView = MetastoreUtil.buildMinimalHMSView(
tableRequest.getCatName(), tableRequest.getDbName(),
tableRequest.getTblName());
+ // Carry the server-reported Authorized state as the HMS view
parameter; when the server reports none, the
+ // view is treated as a deferred-authorization view.
+ if
(!"true".equalsIgnoreCase(view.properties().get(HiveCatalog.VIEW_AUTHORIZED_PROPERTY)))
{
+ hmsView.getParameters().put(HiveCatalog.HMS_VIEW_AUTHORIZED,
"false");
Review Comment:
This marker comes from the first view load, but `postGetTable()` reloads the
SQL through `IcebergViewSupport` without updating the marker. If a
non-superuser replaces an authorized view between those reads, Hive uses the
replacement SQL without `Authorized=false`, so `CommandAuthorizerV2` skips
underlying-table privilege checks (VALID under THREAT_MODEL.md ยงยง3.3, 5 and
13). Bind the SQL and authorization state to the same loaded metadata version,
and add a regression test for this interleaving.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
