Zoltán Borók-Nagy created IMPALA-15126:
------------------------------------------
Summary: NullPointerException when a column-masking policy on a
nested struct field meets STRUCT.* expansion
Key: IMPALA-15126
URL: https://issues.apache.org/jira/browse/IMPALA-15126
Project: IMPALA
Issue Type: Bug
Components: Frontend
Reporter: Zoltán Borók-Nagy
When a Ranger column-masking policy is defined on a nested struct field (e.g.
nested_struct.a) and a query expands that struct with a star path (STRUCT.*)
such that the expansion includes complex sub-fields, analysis fails with a
server-side
NullPointerException instead of either masking, ignoring the policy, or
returning a clean error.
This is reachable by default once EXPAND_COMPLEX_TYPES defaults to true
(IMPALA-15054): under that default, nested_struct.* expands to all of the
struct's fields (scalar and complex), whereas previously it expanded only the
scalar fields. It
can also be hit on any release by explicitly setting EXPAND_COMPLEX_TYPES=true.
Steps to reproduce:
1. On a Ranger-authorized cluster, add a column-masking policy for the
requesting user on a nested struct field:
- db functional_parquet, table complextypestbl, column nested_struct.a, mask
type CUSTOM, expr 100 * \{col}
(these are the policies created by
tests/authorization/test_ranger.py::TestRanger::test_column_masking).
2.
{noformat}
REFRESH AUTHORIZATION;{noformat}
3. As the masked user, run:
{noformat}
SET EXPAND_COMPLEX_TYPES=true;
SELECT id, nested_struct.* FROM functional_parquet.complextypestbl;{noformat}
Expected: The query analyzes successfully (masking on a nested column is
currently a no-op, matching Hive — see notes), or fails with a clear,
user-facing AnalysisException.
Actual: The query fails with:
{noformat}
RuntimeException: java.lang.NullPointerException
CAUSED BY: NullPointerException: null
{noformat}
- Top-level SELECT * FROM complextypestbl under masking does not NPE; it
returns the scalar id masked while complex columns (e.g. int_array, which has a
MASK_NULL policy) come back unmasked — i.e. complex-column masks are silently
ignored.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
