Zoltan Borok-Nagy has uploaded this change for review. (
http://gerrit.cloudera.org:8080/24530
Change subject: IMPALA-15130: Reject column masking on complex-typed columns
......................................................................
IMPALA-15130: Reject column masking on complex-typed columns
A Ranger column-masking policy on a top-level complex-typed column
(ARRAY/MAP/STRUCT) cannot be applied: the mask transforms are scalar
and there is no way to express a masked complex value.
TableMask.createColumnMaskStmt() previously ignored such masks and
returned the column unmasked, leaking data the policy was meant to hide.
The InlineViewRef guard that was supposed to reject this ("Column
masking is not supported for complex types") was dead code as
TableMask.hasComplexColumnMask_ was never assigned.
Fail closed instead: a mask on a top-level complex column now throws an
AnalysisException. Masks on nested struct fields (e.g. nested_struct.a)
are still ignored, matching Hive, which only considers top-level columns
and so does not recognize such policies either.
Also removes the dead hasComplexColumnMask_ field/getter and the
unreachable InlineViewRef check.
Testing:
- New FE test AuthorizationStmtTest.testColumnMaskingOnComplexColumn
- test_ranger.py: dropped the complex-column masking policies from
test_column_masking and
test_column_masking_with_structs_in_select_list. Those masks were
previously ignored (returned unmasked) and are now rejected, which is
exercised by the FE test above. The corresponding .test goldens are
unchanged because those columns were already returned unmasasked
Change-Id: Idddacf0b40abcaa18a5764ff617179fe898886c9
Assisted-by: Claude Opus 4.8 (1M context) <[email protected]>
---
M fe/src/main/java/org/apache/impala/analysis/InlineViewRef.java
M fe/src/main/java/org/apache/impala/authorization/TableMask.java
M fe/src/test/java/org/apache/impala/authorization/AuthorizationStmtTest.java
M
testdata/workloads/functional-query/queries/QueryTest/ranger_column_masking_struct_in_select_list.test
M tests/authorization/test_ranger.py
5 files changed, 62 insertions(+), 35 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/24530/1
--
To view, visit http://gerrit.cloudera.org:8080/24530
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Idddacf0b40abcaa18a5764ff617179fe898886c9
Gerrit-Change-Number: 24530
Gerrit-PatchSet: 1
Gerrit-Owner: Zoltan Borok-Nagy <[email protected]>
