nevzheng opened a new issue, #14244:
URL: https://github.com/apache/gravitino/issues/14244
### Version
main branch
### Describe what's wrong
`gravitino.identifier` is a reserved property. The Gravitino REST API
rejects it on create
(`BasePropertiesMetadata`), but the Iceberg REST server accepts it on create
and update requests for
tables, views and namespaces.
When Gravitino imports an object, `TableOperationDispatcher`,
`ViewOperationDispatcher` and
`SchemaOperationDispatcher` reuse the id found in that property, and the
store then overwrites the
existing row with that id:
- Tables and schemas: the upserts (`insertTableMetaOnDuplicateKeyUpdate`,
`insertSchemaMetaOnDuplicateKeyUpdate`) key on the id alone, so they can
rename and move a row from a
different schema or catalog.
- Views: the overwrite looks the row up by id within the same schema.
After the import, the Iceberg REST hook sets the caller as owner of that id.
So a new object created
with another object's id takes over that object's entity, together with its
owner, grants, tags and
policies. The id is visible to anyone who can load the object, because
Iceberg REST load responses
return the raw properties.
An honest client can hit this by accident too, for example by creating a
table from properties copied
from another table.
### Error message and/or stacktrace
None. The server logs a WARN that the uid already existed but still needs to
be imported.
### How to reproduce
1. Enable authorization. Create view `s.w` through the Gravitino API.
2. Through the Iceberg REST server, load `s.w` and read
`gravitino.identifier` from its properties.
3. Through the Iceberg REST server, create view `s.v` with
`gravitino.identifier` set to that value.
4. Load `s.w` and its owner through the Gravitino API.
Expected: `v` gets a new id; `w` keeps its id, owner and grants.
Actual: the entity that was `w` is renamed to `v` and owned by the creator
of `v`.
The same happens for tables (across schemas and catalogs) and namespaces.
### Additional context
Proposed fix:
1. Iceberg REST: reject `gravitino.identifier` with 400 on create and update
requests.
2. Core: on import, reuse the carried id only when the stored entity with
that id is a sibling whose old
name no longer exists in the catalog (an external rename). Otherwise
import under a fresh id.
Follow-ups: fence the table and schema upserts by parent, as views already
are, and strip the property
from Iceberg REST load responses.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
