[
https://issues.apache.org/jira/browse/IMPALA-15126?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Zoltán Borók-Nagy updated IMPALA-15126:
---------------------------------------
Description:
When a Ranger column-masking policy is defined and a query expands a struct
with a star path (STRUCT.*) such that the expansion includes complex
sub-fields, analysis fails with a server-side NullPointerException.
Steps to reproduce:
1. Add any column-masking policy on functional_parquet.complextypestbl for the
requesting user (e.g. id → CUSTOM 100 * \{col}) so the table is served through
a table-masking view.
2.
{noformat}
REFRESH AUTHORIZATION;{noformat}
3. As the masked user, run:
{noformat}
SET EXPAND_COMPLEX_TYPES=true;
SELECT id, nested_struct.* FROM functional_parquet.complextypestbl;{noformat}
was:
When a Ranger column-masking policy is defined on a nested struct field (e.g.
nested_struct.a) and a query expands that struct with a star path (STRUCT.*)
such that the expansion includes complex sub-fields, analysis fails with a
server-side
NullPointerException instead of either masking, ignoring the policy, or
returning a clean error.
This is reachable by default once EXPAND_COMPLEX_TYPES defaults to true
(IMPALA-15054): under that default, nested_struct.* expands to all of the
struct's fields (scalar and complex), whereas previously it expanded only the
scalar fields. It
can also be hit on any release by explicitly setting EXPAND_COMPLEX_TYPES=true.
Steps to reproduce:
1. On a Ranger-authorized cluster, add a column-masking policy for the
requesting user on a nested struct field:
- db functional_parquet, table complextypestbl, column nested_struct.a, mask
type CUSTOM, expr 100 * \{col}
(these are the policies created by
tests/authorization/test_ranger.py::TestRanger::test_column_masking).
2.
{noformat}
REFRESH AUTHORIZATION;{noformat}
3. As the masked user, run:
{noformat}
SET EXPAND_COMPLEX_TYPES=true;
SELECT id, nested_struct.* FROM functional_parquet.complextypestbl;{noformat}
Expected: The query analyzes successfully (masking on a nested column is
currently a no-op, matching Hive — see notes), or fails with a clear,
user-facing AnalysisException.
Actual: The query fails with:
{noformat}
RuntimeException: java.lang.NullPointerException
CAUSED BY: NullPointerException: null
{noformat}
- Top-level SELECT * FROM complextypestbl under masking does not NPE; it
returns the scalar id masked while complex columns (e.g. int_array, which has a
MASK_NULL policy) come back unmasked — i.e. complex-column masks are silently
ignored.
> NullPointerException when a column-masking policy on a nested struct field
> meets STRUCT.* expansion
> ---------------------------------------------------------------------------------------------------
>
> Key: IMPALA-15126
> URL: https://issues.apache.org/jira/browse/IMPALA-15126
> Project: IMPALA
> Issue Type: Bug
> Components: Frontend
> Reporter: Zoltán Borók-Nagy
> Assignee: Zoltán Borók-Nagy
> Priority: Major
>
> When a Ranger column-masking policy is defined and a query expands a struct
> with a star path (STRUCT.*) such that the expansion includes complex
> sub-fields, analysis fails with a server-side NullPointerException.
> Steps to reproduce:
> 1. Add any column-masking policy on functional_parquet.complextypestbl for
> the requesting user (e.g. id → CUSTOM 100 * \{col}) so the table is served
> through a table-masking view.
> 2.
> {noformat}
> REFRESH AUTHORIZATION;{noformat}
> 3. As the masked user, run:
> {noformat}
> SET EXPAND_COMPLEX_TYPES=true;
> SELECT id, nested_struct.* FROM functional_parquet.complextypestbl;{noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
