Michael Smith has uploaded this change for review. ( http://gerrit.cloudera.org:8080/24771
Change subject: IMPALA-15218: Add trusted_jar_paths for data sources ...................................................................... IMPALA-15218: Add trusted_jar_paths for data sources Adds allowlist `trusted_jar_paths` to identify a safe location for loading jars for DATA SOURCES and JDBC tables. Loading arbitrary jars allows code execution, and CREATE TABLE permissions need to be granted to people separate from the ability to load any jar. Table properties are difficult to authorize correctly, so an allowlist is added to put limits on what jars can be loaded into memory. To restore prior behavior, specify `trusted_jar_paths` on impalad startup flags as a comma-separated list of location prefixes for known JDBC driver jars, such as `/test-warehouse/data-sources/,hdfs://test-warehouse/data-sources/`. Also fixes an SQL injection issue and avoids printing dbcp.password in WARNING logs. Assisted-by: Claude Sonnet 4.6 (VSCode) Change-Id: I0bf53fb5eff545d5584ca120e362fd01a2086be1 --- M be/src/service/frontend.cc M be/src/util/backend-gflag-util.cc M bin/start-impala-cluster.py M common/thrift/BackendGflags.thrift M fe/src/main/java/org/apache/impala/extdatasource/jdbc/conf/JdbcStorageConfigManager.java M fe/src/main/java/org/apache/impala/extdatasource/jdbc/dao/DataSourceObjectCache.java M fe/src/main/java/org/apache/impala/extdatasource/jdbc/util/QueryConditionUtil.java M fe/src/main/java/org/apache/impala/planner/DataSourceScanNode.java M fe/src/main/java/org/apache/impala/service/BackendConfig.java M fe/src/test/java/org/apache/impala/extdatasource/jdbc/JdbcDataSourceTest.java M fe/src/test/java/org/apache/impala/planner/PlannerTest.java A fe/src/test/java/org/apache/impala/service/BackendConfigTest.java M tests/custom_cluster/test_ext_data_sources.py 13 files changed, 275 insertions(+), 10 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/71/24771/1 -- To view, visit http://gerrit.cloudera.org:8080/24771 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: branch-4.5.2 Gerrit-MessageType: newchange Gerrit-Change-Id: I0bf53fb5eff545d5584ca120e362fd01a2086be1 Gerrit-Change-Number: 24771 Gerrit-PatchSet: 1 Gerrit-Owner: Michael Smith <[email protected]>
