[
https://issues.apache.org/jira/browse/IMPALA-15217?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113532#comment-18113532
]
ASF subversion and git services commented on IMPALA-15217:
----------------------------------------------------------
Commit ae8f7fbdf68950c63e10deb411027b195fc82c82 in impala's branch
refs/heads/master from Michael Smith
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=ae8f7fbdf ]
IMPALA-15217: Authorize URIs for avro.schema.url when loading
Adds authorization checks for 'avro.schema.url' when creating a table or
altering a table to add the property. If an HTTP URL, checks that the
user has permission to read the specified URL. If any other URL, it also
requires that the path exist.
Authorization is now performed before reading from the source at
'avro.schema.url'; schema parsing for remote schemas moves to
CatalogOpExecutor. New end-to-end tests are added to verify that
CatalogOpExecutor catches the same errors and uses matching schema
reconciliation.
Verification and authorization are now also done when changing the file
format of a table to avro if the 'avro.schema.url' property is present.
Updates ColumnDef#toFieldSchemas to lower-case types for uses where the
results are not subsequently lower-cased. Previously all calls were
later lower-cased through CatalogOpExecutor#buildFieldSchemaList.
New tests are added for authorization of 'avro.schema.url'.
Assisted-by: Claude Sonnet 4.6 (VSCode)
Change-Id: Idf9a9b3e95c495f232057515a047802bc963b555
Reviewed-on: http://gerrit.cloudera.org:8080/24800
Reviewed-by: Michael Smith <[email protected]>
Tested-by: Michael Smith <[email protected]>
> Avro Schema URL Server-Side Request Forgery
> -------------------------------------------
>
> Key: IMPALA-15217
> URL: https://issues.apache.org/jira/browse/IMPALA-15217
> Project: IMPALA
> Issue Type: Bug
> Components: Frontend, Security
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
> Fix For: Impala 4.5.2
>
>
> https://www.cve.org/CVERecord?id=CVE-2026-54048
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
