[
https://issues.apache.org/jira/browse/IMPALA-15130?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Zoltán Borók-Nagy resolved IMPALA-15130.
----------------------------------------
Fix Version/s: Impala 5.0.0
Resolution: Fixed
> Raise error when top-level complex column requires masking
> ----------------------------------------------------------
>
> Key: IMPALA-15130
> URL: https://issues.apache.org/jira/browse/IMPALA-15130
> Project: IMPALA
> Issue Type: Bug
> Components: Frontend
> Reporter: Zoltán Borók-Nagy
> Assignee: Zoltán Borók-Nagy
> Priority: Major
> Fix For: Impala 5.0.0
>
>
> When a Ranger column-masking policy targets a top-level complex-typed column
> (ARRAY/MAP/STRUCT), Impala silently ignores the mask.
> This is deliberate today but unsafe: TableMask.createColumnMaskStmt()
> (fe/.../authorization/TableMask.java, ~lines 90-99) drops the mask for complex
> types (and for nested children) and just logs a warning:
> if (maskedValue == null || maskedValue.equals(colName)) { // Don't need
> masking.
> return null;
> }
> if (colType.isComplexType() || colName.contains(".")) {
> // Ignore column masks on complex types or their children.
> // TODO: RANGER-3525: Clarify handling of column masks on nested types
> LOG.warn("Ignoring column mask on complex type {}.{}: {} => {}", ...);
> return null; // -> column is passed through UNMASKED
> }
> Hive allows NULL-masking on top-level columns.
> We should at least raise an error in such cases instead of ignoring the
> masking policy.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
