LuciferYang opened a new issue, #14290:
URL: https://github.com/apache/gravitino/issues/14290
### Version
main branch
### Describe what's wrong
With authorization enabled, the Spark connector records every table the user
cannot load in a thread-local list, reports the list from a post-hoc analyzer
rule, and clears it only when SQL text is parsed. When a denial is recorded but
the rule does not run, the entry stays on the thread. The next query on that
thread that is not parsed from SQL, such as a DataFrame action, then fails with
a `ForbiddenException` for a table it never touched.
Two ways to get there:
- On Spark 3.5, `spark.catalog.getTable("cat.db.t")` on a table without
SELECT loads the table after analysis. It returns placeholder metadata and
leaves the denial on the thread.
- An analysis that fails partway, for example because another table in the
same query fails to load with an error other than "table not found", leaves the
denials recorded so far.
### Error message and/or stacktrace
```
org.apache.gravitino.exceptions.ForbiddenException: Missing required
privileges for Spark tables: [cat.db.t: SELECT_TABLE]
```
### How to reproduce
In spark-shell on Spark 3.5, as a user without SELECT on `cat.db.t`:
```scala
spark.catalog.getTable("cat.db.t")
spark.range(1).count() // throws the ForbiddenException above
```
### Additional context
SQL-only sessions such as the Spark Thrift Server are not affected, because
every statement is parsed first and the parse clears the list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
