LuciferYang opened a new issue, #12475: URL: https://github.com/apache/gravitino/issues/12475
### What would you like to be improved? `CallerContext` (`common/.../audit/CallerContext.java`) is an audit/credential context published into a `ThreadLocal` and read across modules (server fileset/credential ops, `FilesetEventDispatcher`, GVFS clients). Its Javadoc says it is forked from Hadoop's `org.apache.hadoop.ipc.CallerContext`, which is fully immutable — but the Gravitino copy has lost that immutability: - `withContext(Map)` stores the caller's map by reference and `context()` returns it directly, so a caller's later mutation, or a reader calling `put`/`remove` on `context()`, can silently alter an already-published context. - The `context` field is non-final and the `Builder` mutates a pre-built instance, so a retained `Builder` can change an instance already handed out / stored in the `ThreadLocal`. No live bug today (all call sites pass fresh maps and only read), but it is a latent footgun on a shared, security-sensitive value object and diverges from the immutable design it claims to mirror. ### How should we improve? Store a defensive unmodifiable copy in `withContext`, and make the `context` field `final` with constructor injection so `build()` returns a distinct, truly immutable instance. Keep the public API signatures unchanged (`context()` would return an unmodifiable map). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
