maytasm commented on code in PR #20687:
URL: https://github.com/apache/druid/pull/20687#discussion_r4380580672
##########
server/src/main/java/org/apache/druid/query/lookup/LookupListeningResource.java:
##########
@@ -89,13 +93,21 @@ public Response handleUpdates(InputStream inputStream,
ObjectMapper mapper)
}
try {
+ final HttpServletRequest request = requestProvider.get();
+ LookupResourceFilter.filterBulk(
+ request,
+ new LookupsState<>(null, state.getToLoad(),
state.getToDrop())
+ );
state.getToLoad().forEach(manager::add);
state.getToDrop().forEach(lookName -> {
manager.remove(lookName,
state.getToLoad().getOrDefault(lookName, null));
});
return
Response.status(Response.Status.ACCEPTED).entity(manager.getAllLookupsState()).build();
Review Comment:
I'm talking about with LOOKUP security. I think what you added filters the
LOOKUP that is passed to the manager add/remove. However, what i am talking
about is that is returned in the payload to the caller. For example, if I don't
have any authorization on LOOKUP and called this API. The input I sent will all
be filtered out and nothing will be added or removed. However the response
`Response.status(Response.Status.ACCEPTED).entity(manager.getAllLookupsState()).build()`
will end up returning me the state of all LOOKUPs despite me not having READ
access on any lookup right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
