[ https://issues.apache.org/jira/browse/PHOENIX-4231?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16370810#comment-16370810 ]
ASF GitHub Bot commented on PHOENIX-4231: ----------------------------------------- Github user aertoria commented on a diff in the pull request: https://github.com/apache/phoenix/pull/292#discussion_r169509766 --- Diff: phoenix-core/src/main/java/org/apache/phoenix/jdbc/PhoenixStatement.java --- @@ -907,10 +909,15 @@ public MutationState execute() throws SQLException { try { FileSystem fs = dynamicJarsDirPath.getFileSystem(conf); List<LiteralParseNode> jarPaths = getJarPaths(); - for (LiteralParseNode jarPath : jarPaths) { - File f = new File((String) jarPath.getValue()); - fs.copyFromLocalFile(new Path(f.getAbsolutePath()), new Path( - dynamicJarsDir + f.getName())); + for (LiteralParseNode jarPathNode : jarPaths) { + String jarPathName = (String) jarPathNode.getValue(); + File f = new File(jarPathName); + Path dynamicJarsDirPathWithJar = new Path(dynamicJarsDir + f.getName()); + // Copy the jar (can be local or on HDFS) to the hbase.dynamic.jars.dir directory. + // Note that this does not support HDFS URIs without scheme and authority. + Path jarPath = new Path(jarPathName); + FileUtil.copy(jarPath.getFileSystem(conf), jarPath, fs, dynamicJarsDirPathWithJar, --- End diff -- This copy happen at phoenixStatment.java which is at client side. Shouldn't the checking be happening at Server side > Support restriction of remote UDF load sources > ----------------------------------------------- > > Key: PHOENIX-4231 > URL: https://issues.apache.org/jira/browse/PHOENIX-4231 > Project: Phoenix > Issue Type: Improvement > Reporter: Andrew Purtell > Assignee: Chinmay Kulkarni > Priority: Major > > When allowUserDefinedFunctions is true, users can load UDFs remotely via a > jar file from any HDFS filesystem reachable on the network. The setting > hbase.dynamic.jars.dir can be used to restrict locations for jar loading but > is only applied to jars loaded from the local filesystem. We should > implement support for similar restriction via configuration for jars loaded > via hdfs:// URIs. -- This message was sent by Atlassian JIRA (v7.6.3#76005)