nevzheng opened a new issue, #14242:
URL: https://github.com/apache/gravitino/issues/14242
### Version
main branch
### Describe what's wrong
`POST /v1/{prefix}/namespaces/{namespace}/register` is authorized with the
create-table expression on
the schema (`IcebergNamespaceOperations#registerTable`). The `overwrite`
flag in the request body is not
considered.
With `overwrite=true`, the backend replaces the metadata of an existing
table with the same name
(Hive and JDBC catalogs implement this in `MetastoreRegisterTableUtils`). So
a user who holds
`CREATE_TABLE` on the schema, but has no privilege on the existing table,
can replace that table's
metadata. The existing owner and grants stay unchanged.
Replacing an existing table is a modification. The Lance REST server already
treats register in
overwrite mode that way
(`LanceMetadataAuthorizationMethodInterceptor.OverwriteAuthzHandler` requires
the
modify-table expression).
### Error message and/or stacktrace
None. The request returns 200.
### How to reproduce
1. Enable authorization (`gravitino.authorization.enable=true`) and serve an
Iceberg catalog through the
Iceberg REST server.
2. User `u1` owns table `s1.t`. User `u2` has `USE_CATALOG`, `USE_SCHEMA`
and `CREATE_TABLE` on `s1`
and no privilege on `t`.
3. As `u2`, register `s1.t` with `overwrite=true` and any metadata location.
Expected: 403, because replacing `t` needs ownership of `t` or
`MODIFY_TABLE`.
Actual: 200, and `t` now points at the new metadata.
### Additional context
Proposed fix: when `overwrite=true`, also evaluate the modify-table
expression on the named table.
Keep the schema-level `CREATE_TABLE` check, because an overwrite of a name
that does not exist is a
plain register.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
