JingsongLi commented on code in PR #758:
URL: https://github.com/apache/paimon-rust/pull/758#discussion_r3930389053
##########
crates/paimon/src/table/table_commit.rs:
##########
@@ -205,7 +205,7 @@ impl TableCommit {
filter_committed: bool,
) -> Result<()> {
// A commit validates against the existing snapshot.
-
CoreOptions::new(self.table.schema().options()).ensure_read_authorized()?;
+ self.table.ensure_read_authorized_live("a commit").await?;
Review Comment:
[P1] Re-authorize before the writer performs lazy reads
This live check runs only when commit starts, but `TableWrite` has already
read table state by then. `TableWrite::new` still checks only the schema cached
on the handle; on the first normal PK write, `create_kv_writer` calls
`scan_partition_sequence_numbers`, which reads the latest snapshot/manifests,
and a dynamic-bucket write additionally runs
`DynamicBucketAssigner::ensure_index_entries_loaded` plus
`HashIndexFile::read`. Thus a handle loaded while `query-auth.enabled=false`
can be reused after the server enables restricted query auth:
`write_arrow_batch` and `prepare_commit` read protected metadata/index contents
before this check eventually rejects the commit. The dynamic path can even emit
a replacement hash-index file containing hashes restored from the protected
index, so rejecting only at commit does not undo the disclosure. Please put a
live authorization check before the first async writer read (or add an
auth-aware async initialization) and cover the stale-handle write
path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
