CalvinKirs opened a new pull request, #69455:
URL: https://github.com/apache/doris/pull/69455
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
HTTP TVF fetches file sizes through FE HEAD requests without invoking the
configured `SecurityChecker`. Add a shared helper that starts the existing SSRF
check before HEAD and calls `stopSSRFChecking()` in `finally`, including when
starting the check or requesting metadata fails. Apply it to both direct
HTTP/HTTPS URLs and every HTTP URL expanded from `hf://`, preserving headers
and file statuses.
This change covers FE file-size HEAD requests. BE reads, Hugging Face
tree/list API requests, checker configuration, and the default no-op checker
remain unchanged. The existing `UrlSecurityChecker` stop-method reflection
arity mismatch is outside this patch and requires a separate follow-up; the new
tests verify the caller's hook sequencing, not the external SDK's cleanup
behavior.
### Release note
HTTP TVF FE file-size HEAD requests now invoke the configured SSRF checker.
A rejected check prevents the HEAD request from being sent.
### Check List (For Author)
- Test
- [ ] Regression test
- [x] Unit Test
- [ ] Manual test
- [ ] No need to test or manual test.
Ran:
```bash
./run-fe-ut.sh --run
'org.apache.doris.tablefunction.HttpTableValuedFunctionTest,org.apache.doris.tablefunction.HFUtilsTest'
```
- All 5 new HTTP TVF cases passed: HTTP/HTTPS sequencing, header/status
preservation, rejection without HEAD, cleanup after HEAD failure, and per-URL
checks after HF expansion.
- Existing `HFUtilsTest`: 13 passed, 1 error in
`testGlobExpansionExceptions` because Hugging Face was unreachable (`Network is
unreachable`). The combined Maven run therefore failed on that existing
network-dependent test.
- Checkstyle passed for both changed Java files; `git diff --check` passed.
- Behavior changed:
- [ ] No.
- [x] Yes. The configured checker is now invoked before HTTP TVF FE HEAD
requests; rejected checks fail query analysis before that request.
- Does this need documentation?
- [x] No. No new interface or configuration.
- [ ] Yes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
