markhoerth opened a new issue, #12729:
URL: https://github.com/apache/gravitino/issues/12729
`ViewOperations` is not covered by the authorization interception service,
so view operations are not privilege-checked the way every other metadata
family is.
Compare the two responses on a server with authorization enabled, both
against a metalake that does not exist, both unauthenticated.
Tags, rejected before the handler runs:
```
curl -s 'http://<server>:8090/api/metalakes/zz/objects/table/a.b.c/tags'
```
```
{"code":1008,"type":"ForbiddenException",
"message":"Current user anonymous doesn't exist in the metalake zz, ...",
"stack":["... at
org.apache.gravitino.authorization.AuthorizationUtils.checkCurrentUser(AuthorizationUtils.java:131)",
"... at
org.apache.gravitino.server.web.filter.GravitinoInterceptionService$MetadataAuthorizationMethodInterceptor.invoke(GravitinoInterceptionService.java:168)"]}
```
Views, reaching the handler and performing the lookup:
```
curl -s 'http://<server>:8090/api/metalakes/zz/catalogs/c/schemas/s/views'
```
```
{"code":1003,"type":"NoSuchCatalogException",
"message":"Failed to operate view(s) operation [LIST] under schema [s],
reason [Catalog zz.c does not exist]",
"stack":["... at
org.apache.gravitino.catalog.ViewNormalizeDispatcher.listViews(ViewNormalizeDispatcher.java:53)",
"... at
org.apache.gravitino.listener.ViewEventDispatcher.listViews(ViewEventDispatcher.java:76)",
"... at
org.apache.gravitino.server.web.rest.ViewOperations.lambda$listViews$0(ViewOperations.java:81)",
"... at
org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478)"]}
```
The views stack passes from Jersey's `ResourceMethodInvoker` directly into
`ViewOperations.listViews`.
`GravitinoInterceptionService$MetadataAuthorizationMethodInterceptor` does not
appear in it, and `AuthorizationUtils.checkCurrentUser` is never called. The
authorization check the tags, policies, statistics, credentials, owners,
catalogs, schemas, tables, topics, filesets, models, users, groups, roles and
jobs endpoints all enforce is absent for views.
Required: view operations are covered by the same authorization interception
as every other metadata object type, and a caller without privilege on the
view's parent is rejected before any catalog lookup takes place.
Separately observed on the same endpoint: `POST
/metalakes/{metalake}/catalogs/{catalog}/schemas/{schema}/views` with no
request body returns HTTP 500 with an entirely empty response body. A request
with a missing or unparseable body is a client error and must return 400 with
an error code, and no error path should return an empty body.
Found by a REST contract sweep over all 130 `/metalakes` endpoints on build
1.3.0-SNAPSHOT, commit 6d9d432df18a9bd124c162ea50a296f436549980.
Required: fixed upstream in apache/gravitino and present in the enterprise
tree before RC2 on September 4.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
