Zoltán Borók-Nagy created IMPALA-15130:
------------------------------------------
Summary: Raise error when top-level complex column requires masking
Key: IMPALA-15130
URL: https://issues.apache.org/jira/browse/IMPALA-15130
Project: IMPALA
Issue Type: Bug
Components: Frontend
Reporter: Zoltán Borók-Nagy
When a Ranger column-masking policy targets a top-level complex-typed column
(ARRAY/MAP/STRUCT), Impala silently ignores the mask.
This is deliberate today but unsafe: TableMask.createColumnMaskStmt()
(fe/.../authorization/TableMask.java, ~lines 90-99) drops the mask for complex
types (and for nested children) and just logs a warning:
if (maskedValue == null || maskedValue.equals(colName)) { // Don't need
masking.
return null;
}
if (colType.isComplexType() || colName.contains(".")) {
// Ignore column masks on complex types or their children.
// TODO: RANGER-3525: Clarify handling of column masks on nested types
LOG.warn("Ignoring column mask on complex type {}.{}: {} => {}", ...);
return null; // -> column is passed through UNMASKED
}
Hive allows NULL-masking on top-level columns.
We should at least raise an error in such cases instead of ignoring the masking
policy.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
