JingsongLi commented on PR #10437:
URL: https://github.com/apache/paimon/pull/10437#issuecomment-6080724668
[P2] Preserve column identity before granting permissions
`BasePermissionProcedure.parseColumnNames` trims every token before sending
it to the REST catalog. Column names are exact identifiers in
`PermissionColumns` and the REST permission contract, so this can successfully
grant a different column range than the caller requested.
I reproduced this through actual Flink 1.20 SQL and the REST catalog test
server:
```sql
CREATE TABLE mydb.space_columns (`secret` STRING, ` secret ` STRING)
WITH ('query-auth.enabled' = 'true');
CALL sys.grant_permission(
resource_type => 'COLUMN', access => 'SELECT', principal => 'analyst',
`database` => 'mydb', `table` => 'space_columns',
excluded_column_names => ' secret '
);
```
`DESCRIBE` preserves the second column as ` secret `, but
`sys.list_permissions` returns `excluded_column_names = ['secret']`. The
operation reports success while excluding the other column. Under the existing
exact-name denylist contract, the requested spaced column remains allowed. The
allowlist path has the corresponding wrong-target problem.
Please use an input representation that preserves exact names, or reject
inputs that cannot be represented without changing their identity before making
the grant. Documenting only the comma limitation does not cover this silent
rewrite.
Validation: the seven existing permission procedure integration cases pass
with standard JDK 8 Maven checks. An additional real SQL identity assertion
fails (`['secret']` versus `[' secret ']`). Independent review confirmed that
the REST DTO and server preserve exact column names. No production permissions
were changed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
