Michael Smith has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24804 )
Change subject: IMPALA-15218: Add trusted_jar_paths for data sources ...................................................................... IMPALA-15218: Add trusted_jar_paths for data sources Adds allowlist `trusted_jar_paths` to identify a safe location for loading jars for DATA SOURCES and JDBC tables. Loading arbitrary jars allows code execution, and CREATE TABLE permissions need to be granted to people separate from the ability to load any jar. Table properties are difficult to authorize correctly, so an allowlist is added to put limits on what jars can be loaded into memory. To restore prior behavior, specify `trusted_jar_paths` on impalad startup flags as a comma-separated list of location prefixes for known JDBC driver jars, such as `/test-warehouse/data-sources/,hdfs://test-warehouse/data-sources/`. Also fixes an SQL injection issue and avoids printing dbcp.password in WARNING logs. Assisted-by: Claude Sonnet 4.6 (VSCode) Change-Id: I0bf53fb5eff545d5584ca120e362fd01a2086be1 Reviewed-on: http://gerrit.cloudera.org:8080/24804 Reviewed-by: Michael Smith <[email protected]> Tested-by: Michael Smith <[email protected]> --- M be/src/service/frontend.cc M be/src/util/backend-gflag-util.cc M bin/start-impala-cluster.py M common/thrift/BackendGflags.thrift M fe/src/main/java/org/apache/impala/extdatasource/jdbc/conf/JdbcStorageConfigManager.java M fe/src/main/java/org/apache/impala/extdatasource/jdbc/dao/DataSourceObjectCache.java M fe/src/main/java/org/apache/impala/extdatasource/jdbc/util/QueryConditionUtil.java M fe/src/main/java/org/apache/impala/planner/DataSourceScanNode.java M fe/src/main/java/org/apache/impala/service/BackendConfig.java M fe/src/test/java/org/apache/impala/extdatasource/jdbc/JdbcDataSourceTest.java M fe/src/test/java/org/apache/impala/planner/PlannerTest.java A fe/src/test/java/org/apache/impala/service/BackendConfigTest.java M tests/custom_cluster/test_ext_data_sources.py 13 files changed, 287 insertions(+), 19 deletions(-) Approvals: Michael Smith: Looks good to me, approved; Verified -- To view, visit http://gerrit.cloudera.org:8080/24804 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: I0bf53fb5eff545d5584ca120e362fd01a2086be1 Gerrit-Change-Number: 24804 Gerrit-PatchSet: 3 Gerrit-Owner: Michael Smith <[email protected]> Gerrit-Reviewer: Csaba Ringhofer <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Joe McDonnell <[email protected]> Gerrit-Reviewer: Michael Smith <[email protected]> Gerrit-Reviewer: Peter Rozsa <[email protected]> Gerrit-Reviewer: Wenzhe Zhou <[email protected]> Gerrit-Reviewer: Zoltan Borok-Nagy <[email protected]>
