This is an automated email from the ASF dual-hosted git repository.
morningman pushed a commit to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.0 by this push:
new c2bb9b655b7 [branch-4.0][fix](security) Add auth and config gate for
_stream_load_forward endpoint (#65376)
c2bb9b655b7 is described below
commit c2bb9b655b71bb96d5b8a7b06d57901f5df0f43a
Author: Xin Liao <[email protected]>
AuthorDate: Mon Jul 27 17:28:21 2026 +0800
[branch-4.0][fix](security) Add auth and config gate for
_stream_load_forward endpoint (#65376)
Pick apache/doris#64935
---
be/src/common/config.cpp | 2 ++
be/src/common/config.h | 2 ++
be/src/http/action/stream_load_forward_handler.cpp | 12 ++++++++++++
be/src/http/action/stream_load_forward_handler.h | 8 +++++---
be/src/service/http_service.cpp | 2 +-
.../load_p0/stream_load/test_group_commit_redirect.groovy | 1 +
6 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/be/src/common/config.cpp b/be/src/common/config.cpp
index de6bdfb1bfe..65a71872fba 100644
--- a/be/src/common/config.cpp
+++ b/be/src/common/config.cpp
@@ -266,6 +266,8 @@ DEFINE_mInt32(download_low_speed_limit_kbps, "50");
DEFINE_mInt32(download_low_speed_time, "300");
// whether to download small files in batch
DEFINE_mBool(enable_batch_download, "true");
+// whether to enable stream load forward endpoint for cloud group commit
+DEFINE_mBool(enable_group_commit_streamload_be_forward, "false");
// whether to check md5sum when download
DEFINE_mBool(enable_download_md5sum_check, "false");
// download binlog meta timeout, default 30s
diff --git a/be/src/common/config.h b/be/src/common/config.h
index e6f0ac42e12..96690cf6b2a 100644
--- a/be/src/common/config.h
+++ b/be/src/common/config.h
@@ -325,6 +325,8 @@ DECLARE_mInt32(download_low_speed_limit_kbps);
DECLARE_mInt32(download_low_speed_time);
// whether to download small files in batch.
DECLARE_mBool(enable_batch_download);
+// whether to enable stream load forward endpoint for cloud group commit
+DECLARE_mBool(enable_group_commit_streamload_be_forward);
// whether to check md5sum when download
DECLARE_mBool(enable_download_md5sum_check);
// download binlog meta timeout
diff --git a/be/src/http/action/stream_load_forward_handler.cpp
b/be/src/http/action/stream_load_forward_handler.cpp
index 37657947ba5..0a4569afe95 100644
--- a/be/src/http/action/stream_load_forward_handler.cpp
+++ b/be/src/http/action/stream_load_forward_handler.cpp
@@ -32,6 +32,18 @@ namespace doris {
#include "common/compile_check_begin.h"
int StreamLoadForwardHandler::on_header(HttpRequest* req) {
+ if (!config::enable_group_commit_streamload_be_forward) {
+ HttpChannel::send_reply(req, HttpStatus::FORBIDDEN,
+ "Stream load forward is disabled. "
+ "Set
enable_group_commit_streamload_be_forward=true to enable.");
+ return -1;
+ }
+
+ int auth_ret = HttpHandlerWithAuth::on_header(req);
+ if (auth_ret != 0) {
+ return auth_ret;
+ }
+
std::ostringstream params_info;
const auto* params = req->params();
for (const auto& param : *params) {
diff --git a/be/src/http/action/stream_load_forward_handler.h
b/be/src/http/action/stream_load_forward_handler.h
index 2d5e6a32b95..13d52b98b6f 100644
--- a/be/src/http/action/stream_load_forward_handler.h
+++ b/be/src/http/action/stream_load_forward_handler.h
@@ -25,8 +25,9 @@
#include <string>
#include "common/status.h"
-#include "http/http_handler.h"
+#include "http/http_handler_with_auth.h"
#include "http/http_request.h"
+#include "runtime/exec_env.h"
#include "util/byte_buffer.h"
namespace doris {
@@ -98,9 +99,10 @@ private:
// Stream Load request forward handler
// Forwards Stream Load requests to other BE nodes
// Supports streaming forward, maintains original request path format:
/api/{db}/{table}/_stream_load_forward
-class StreamLoadForwardHandler : public HttpHandler {
+class StreamLoadForwardHandler : public HttpHandlerWithAuth {
public:
- StreamLoadForwardHandler() = default;
+ explicit StreamLoadForwardHandler(ExecEnv* exec_env)
+ : HttpHandlerWithAuth(exec_env, TPrivilegeHier::GLOBAL,
TPrivilegeType::LOAD) {}
~StreamLoadForwardHandler() override = default;
void handle(HttpRequest* req) override;
diff --git a/be/src/service/http_service.cpp b/be/src/service/http_service.cpp
index 6a1d5c1abe1..7d489ed9361 100644
--- a/be/src/service/http_service.cpp
+++ b/be/src/service/http_service.cpp
@@ -140,7 +140,7 @@ Status HttpService::start() {
streamload_2pc_action);
// register stream load forward handler
- auto* forward_handler = _pool.add(new StreamLoadForwardHandler());
+ auto* forward_handler = _pool.add(new StreamLoadForwardHandler(_env));
_ev_http_server->register_handler(HttpMethod::PUT,
"/api/{db}/{table}/_stream_load_forward",
forward_handler);
diff --git
a/regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy
b/regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy
index 75002e2ac3e..28c8db5f1a8 100644
---
a/regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy
+++
b/regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy
@@ -93,6 +93,7 @@ suite('test_group_commit_redirect', 'docker') {
options.beNum = 3
options.cloudMode = true
options.beConfigs.add('enable_java_support=false')
+ options.beConfigs.add('enable_group_commit_streamload_be_forward=true')
options.feConfigs.add('enable_group_commit_streamload_be_forward=true')
docker(options) {
// get fe and be info
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
