morrySnow opened a new pull request, #67783: URL: https://github.com/apache/doris/pull/67783
### What problem does this PR solve? A row policy can be bypassed by a merge-on-write time-travel query. The rewrite replaces the original relation with a subquery alias over a union of the base-table scan and the row-binlog scan. The policy marker left above that composite plan is then removed because policy analysis only recognizes relation-shaped children, so neither union branch receives the row filter. This can be reproduced by creating a merge-on-write table with historical row binlog enabled, updating and deleting rows after a captured commit TSO, assigning restrictive and permissive row policies to a non-privileged user, and querying the captured version as that user. Rows rejected by the policy are returned from both the base branch and the before-image branch. ### What is changed? - Put an independent policy-check node directly above both scans produced by the merge-on-write time-travel rewrite, before branch-specific filters and projections are added. - Resolve authorization and materialized-view refresh policy ownership through every `OlapTableWrapper` layer to the original table. Policy expressions and data masks are still bound against each wrapper scan's own output slots. - Add unit coverage for a renamed wrapper and recursively nested wrappers. - Add an end-to-end regression that proves both the base branch and the row-binlog branch enforce the combined row policies. ### Tests - `CheckRowPolicyTest`: 10 tests passed. - `test_mow_time_travel_row_policy`: passed. - `test_time_travel_mow`: passed. - FE build with Checkstyle: passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
