[
https://issues.apache.org/jira/browse/SPARK-42623?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17697721#comment-17697721
]
Wenchen Fan commented on SPARK-42623:
-------------------------------------
I think the problem occurs when we store the original SQL text, like CREATE
VIEW, or GENERATED COLUMN. A proper fix should be replacing the placeholder in
the original SQL text with the actual parameters, before storing them. But this
would be a bit hard to implement. Given that the main motivation of SQL
parameters is protecting from SQL injection, I think applying it in SELECT
query should be sufficient.
> parameter markers not blocked in DDL
> ------------------------------------
>
> Key: SPARK-42623
> URL: https://issues.apache.org/jira/browse/SPARK-42623
> Project: Spark
> Issue Type: Bug
> Components: Spark Core
> Affects Versions: 3.4.0
> Reporter: Serge Rielau
> Priority: Major
> Fix For: 3.4.0
>
>
> The parameterized query code does not block DDL statements from referencing
> parameter markers.
> E.g. a
>
> {code:java}
> scala> spark.sql(sqlText = "CREATE VIEW v1 AS SELECT current_timestamp() +
> :later as stamp, :x * :x AS square", args = Map("later" -> "INTERVAL'3'
> HOUR", "x" -> "15.0")).show()
> ++
> ||
> ++
> ++
> {code}
> It appears we have some protection that fails us when the view is invoked:
>
> {code:java}
> scala> spark.sql(sqlText = "SELECT * FROM v1", args = Map("later" ->
> "INTERVAL'3' HOUR", "x" -> "15.0")).show()
> org.apache.spark.sql.AnalysisException: [UNBOUND_SQL_PARAMETER] Found the
> unbound parameter: `later`. Please, fix `args` and provide a mapping of the
> parameter to a SQL literal.; line 1 pos 29
> {code}
> Right now I think affected are:
> * DEFAULT definition
> * VIEW definition
> but any other future standard expression popping up is at risk, such as SQL
> Functions, or GENERATED COLUMN.
> CREATE TABLE AS is debatable, since it it executes the query at definition
> only.
> For simplicity I propose to block the feature from ANY DDL statement (CREATE,
> ALTER).
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
