[
https://issues.apache.org/jira/browse/HIVE-30195?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated HIVE-30195:
----------------------------------
Labels: pull-request-available (was: )
> get_partitions_with_specs skips the table-level metastore filter hook check
> (checkDbAndTableFilters) that all regular partition listing RPCs perform
> ----------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: HIVE-30195
> URL: https://issues.apache.org/jira/browse/HIVE-30195
> Project: Hive
> Issue Type: Sub-task
> Components: Standalone Metastore
> Reporter: Yuming Wang
> Priority: Major
> Labels: pull-request-available
>
> The {{get_partitions_with_specs}} thrift RPC introduced by HIVE-20306
> bypasses the table-level metastore filter hook check that every regular
> partition listing RPC performs.
> All regular partition listing RPCs ({{{}get_partitions{}}},
> {{{}get_partitions_by_names{}}}, {{{}get_partitions_with_auth{}}},
> {{{}get_partitions_by_filter{}}}, {{{}get_partitions_by_expr{}}},
> {{{}get_partitions_ps{}}}, {{{}get_partitions_ps_with_auth{}}}) are routed
> through {{{}GetPartitionsHandler{}}}, whose {{beforeExecute()}} performs both:
> # {{{}firePreEvent(PreReadTableEvent){}}}, and
> # {{authorizeTableForPartitionMetadata()}} →
> {{{}FilterUtils.checkDbAndTableFilters(...){}}}, which runs the configured
> metastore filter hook ({{{}metastore.server.filter.enabled{}}} /
> {{{}metastore.filter.hook{}}}) against the database and the table, and throws
> {{NoSuchObjectException}} when the hook filters them out.
> {{get_partitions_with_specs}} has its own inline flow in {{HMSHandler}}
> ({{{}get_partitions_with_specs{}}}, ~lines 1571–1600): it fires the pre-event
> and applies partition-level filtering post-fetch
> ({{{}FilterUtils.filterPartitionsIfEnabled{}}}), but never performs the
> table-level {{checkDbAndTableFilters}} check.
> Impact: with {{metastore.server.filter.enabled=true}} and a filter hook that
> hides the table from the caller (server-side result filtering per
> THREAT_MODEL.md §8.3), the regular listing RPCs fail fast with
> {{{}NoSuchObjectException{}}}, while {{get_partitions_with_specs}} still
> fetches all matching partitions and only filters at partition level
> afterwards — whether rows are exposed depends on the hook's
> {{filterPartitions}} implementation. Deployments that also configure
> {{HiveMetaStoreAuthorizer}} as a pre-event listener are not affected
> (authorization is enforced by the pre-event); the gap affects the filter-hook
> (visibility/masking) mechanism specifically.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
