github-actions[bot] commented on code in PR #69527:
URL: https://github.com/apache/doris/pull/69527#discussion_r4367464261
##########
fe/fe-core/src/main/java/org/apache/doris/tablefunction/S3TableValuedFunction.java:
##########
@@ -63,6 +64,11 @@ public S3TableValuedFunction(Map<String, String> properties,
List<TBrokerFileSta
} catch (UserException e) {
throw new RuntimeException(e);
}
+ // Validate the final URI, including when BrokerProperties passes it
through unchanged.
+ // A local dataset must not bypass the LOCAL switch, privileges or BE
secure directory.
+ if (isLanceFormat() && !LanceTvfStoragePolicy.isRemoteUri(filePath)) {
Review Comment:
[P1] Gate S3 reads that select Hadoop storage
With `enable_local_tvf=false`, an ordinary caller can use
`S3('format'='csv', 'csv_schema'='id:int', 'fs.hdfs.support'='true',
'uri'='viewfs://review/data/private.csv', 'fs.defaultFS'='viewfs://review',
'fs.viewfs.mounttable.review.link./data'='file:///srv/private')`. If
`/srv/private/private.csv` exists on the FE and selected BE, this reads its
rows without LOCAL opt-in, ADMIN/OPERATOR or secure-root containment.
`StorageProperties.createPrimary` selects `HdfsProperties`, but this guard only
handles Lance and `HadoopTvfAdmission.HADOOP_READ` is called only from the HDFS
constructor. FE listing preserves the [ViewFS path
identity](https://github.com/apache/doris-thirdparty/blob/hadoop-3.4.2.2-for-doris/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/viewfs/ViewFileSystem.java#L568-L574);
`csv_schema` skips the nominal S3 schema RPC, and generic split classification
produces `FILE_HDFS` with the supplied mounts. The BE then [opens the selected
local target th
rough
ViewFS](https://github.com/apache/doris-thirdparty/blob/hadoop-3.4.2.2-for-doris/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/viewfs/ViewFileSystem.java#L686-L690).
Apply Hadoop read admission to the effective storage in S3 before listing and
to returned paths, and add a CSV/declared-schema negative test. This is a
separate read path from the existing INSERT and Lance findings.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
