This is an automated email from the ASF dual-hosted git repository.
saihemanth-cloudera pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hive.git
The following commit(s) were added to refs/heads/master by this push:
new 79f8c95713e HIVE-29767: Delayed auth views access check
79f8c95713e is described below
commit 79f8c95713e1c6c11a4f3cfe3192eb7a703fb82f
Author: Daniel (Hongdan) Zhu <[email protected]>
AuthorDate: Wed Sep 16 14:31:53 2026 -0700
HIVE-29767: Delayed auth views access check
Co-authored-by: Hongdan Zhu <[email protected]>
---
.../org/apache/hadoop/hive/ql/plan/PlanUtils.java | 10 +--
.../authorization_deferred_view_cte.q | 31 +++++++++
.../authorization_deferred_view_cte.q.out | 73 ++++++++++++++++++++++
3 files changed, 106 insertions(+), 8 deletions(-)
diff --git a/ql/src/java/org/apache/hadoop/hive/ql/plan/PlanUtils.java
b/ql/src/java/org/apache/hadoop/hive/ql/plan/PlanUtils.java
index 81c08194ebd..7083950a2a8 100644
--- a/ql/src/java/org/apache/hadoop/hive/ql/plan/PlanUtils.java
+++ b/ql/src/java/org/apache/hadoop/hive/ql/plan/PlanUtils.java
@@ -1115,16 +1115,10 @@ public static ReadEntity getParentViewInfo(String
alias_id,
currentAlias = currentAlias.replace(SemanticAnalyzer.SUBQUERY_TAG_1, "")
.replace(SemanticAnalyzer.SUBQUERY_TAG_2, "");
ReadEntity input = viewAliasToInput.get(currentAlias);
- if (input == null && currentInput != null) {
- // To handle the case of - select * from (select * from V1) A;
- // the currentInput != null check above is needed.
- // the alias list that case would be A:V1:T. Lookup on A would return
null,
- // we need to go further to find the view inside it.
- return currentInput;
+ if (input != null) {
+ currentInput = input;
}
- currentInput = input;
}
-
return currentInput;
}
diff --git
a/ql/src/test/queries/clientnegative/authorization_deferred_view_cte.q
b/ql/src/test/queries/clientnegative/authorization_deferred_view_cte.q
new file mode 100644
index 00000000000..f206fe17a12
--- /dev/null
+++ b/ql/src/test/queries/clientnegative/authorization_deferred_view_cte.q
@@ -0,0 +1,31 @@
+--! qt:authorizer
+
+-- Deferred-auth view access check should not be bypassed through CTEs.
+-- The unprivileged user has SELECT on the outer regular view only.
+-- Since the inner view is Authorized=false, Hive must re-check the base table
+-- privileges against the querying user. The final SELECT should be denied.
+
+set user.name=user_dbowner;
+
+drop view if exists reg_view;
+drop view if exists deferred_view;
+drop table if exists base_table;
+
+create table base_table(i int, s string);
+
+create view deferred_view as
+select i, s from base_table;
+
+alter view deferred_view set tblproperties ('Authorized'='false');
+
+create view reg_view as
+with c as (
+ select i, s from deferred_view
+)
+select i, s from c;
+
+grant select on table reg_view to user user_unauth;
+
+set user.name=user_unauth;
+
+select i, s from reg_view;
\ No newline at end of file
diff --git
a/ql/src/test/results/clientnegative/authorization_deferred_view_cte.q.out
b/ql/src/test/results/clientnegative/authorization_deferred_view_cte.q.out
new file mode 100644
index 00000000000..430b9a967a7
--- /dev/null
+++ b/ql/src/test/results/clientnegative/authorization_deferred_view_cte.q.out
@@ -0,0 +1,73 @@
+PREHOOK: query: drop view if exists reg_view
+PREHOOK: type: DROPVIEW
+POSTHOOK: query: drop view if exists reg_view
+POSTHOOK: type: DROPVIEW
+PREHOOK: query: drop view if exists deferred_view
+PREHOOK: type: DROPVIEW
+POSTHOOK: query: drop view if exists deferred_view
+POSTHOOK: type: DROPVIEW
+PREHOOK: query: drop table if exists base_table
+PREHOOK: type: DROPTABLE
+PREHOOK: Output: database:default
+POSTHOOK: query: drop table if exists base_table
+POSTHOOK: type: DROPTABLE
+POSTHOOK: Output: database:default
+PREHOOK: query: create table base_table(i int, s string)
+PREHOOK: type: CREATETABLE
+PREHOOK: Output: database:default
+PREHOOK: Output: default@base_table
+POSTHOOK: query: create table base_table(i int, s string)
+POSTHOOK: type: CREATETABLE
+POSTHOOK: Output: database:default
+POSTHOOK: Output: default@base_table
+PREHOOK: query: create view deferred_view as
+select i, s from base_table
+PREHOOK: type: CREATEVIEW
+PREHOOK: Input: default@base_table
+PREHOOK: Output: database:default
+PREHOOK: Output: default@deferred_view
+POSTHOOK: query: create view deferred_view as
+select i, s from base_table
+POSTHOOK: type: CREATEVIEW
+POSTHOOK: Input: default@base_table
+POSTHOOK: Output: database:default
+POSTHOOK: Output: default@deferred_view
+POSTHOOK: Lineage: deferred_view.i SIMPLE
[(base_table)base_table.FieldSchema(name:i, type:int, comment:null), ]
+POSTHOOK: Lineage: deferred_view.s SIMPLE
[(base_table)base_table.FieldSchema(name:s, type:string, comment:null), ]
+PREHOOK: query: alter view deferred_view set tblproperties
('Authorized'='false')
+PREHOOK: type: ALTERVIEW_PROPERTIES
+PREHOOK: Input: default@deferred_view
+PREHOOK: Output: default@deferred_view
+POSTHOOK: query: alter view deferred_view set tblproperties
('Authorized'='false')
+POSTHOOK: type: ALTERVIEW_PROPERTIES
+POSTHOOK: Input: default@deferred_view
+POSTHOOK: Output: default@deferred_view
+PREHOOK: query: create view reg_view as
+with c as (
+ select i, s from deferred_view
+)
+select i, s from c
+PREHOOK: type: CREATEVIEW
+PREHOOK: Input: default@base_table
+PREHOOK: Input: default@deferred_view
+PREHOOK: Output: database:default
+PREHOOK: Output: default@reg_view
+POSTHOOK: query: create view reg_view as
+with c as (
+ select i, s from deferred_view
+)
+select i, s from c
+POSTHOOK: type: CREATEVIEW
+POSTHOOK: Input: default@base_table
+POSTHOOK: Input: default@deferred_view
+POSTHOOK: Output: database:default
+POSTHOOK: Output: default@reg_view
+POSTHOOK: Lineage: reg_view.i SIMPLE
[(base_table)base_table.FieldSchema(name:i, type:int, comment:null), ]
+POSTHOOK: Lineage: reg_view.s SIMPLE
[(base_table)base_table.FieldSchema(name:s, type:string, comment:null), ]
+PREHOOK: query: grant select on table reg_view to user user_unauth
+PREHOOK: type: GRANT_PRIVILEGE
+PREHOOK: Output: default@reg_view
+POSTHOOK: query: grant select on table reg_view to user user_unauth
+POSTHOOK: type: GRANT_PRIVILEGE
+POSTHOOK: Output: default@reg_view
+FAILED: HiveAccessControlException Permission denied: Principal
[name=user_unauth, type=USER] does not have following privileges for operation
QUERY [[SELECT] on Object [type=TABLE_OR_VIEW, name=hive.default.base_table]]
