saihemanth-cloudera commented on code in PR #6683:
URL: https://github.com/apache/hive/pull/6683#discussion_r4351729459
##########
ql/src/java/org/apache/hadoop/hive/ql/ddl/table/info/show/status/ShowTableStatusAnalyzer.java:
##########
@@ -81,4 +89,24 @@ public void analyzeInternal(ASTNode root) throws
SemanticException {
task.setFetchSource(true);
setFetchTask(createFetchTask(ShowTableStatusDesc.SCHEMA));
}
+
+ /**
+ * Register table read inputs for authorization. Resolves the SQL LIKE
pattern against the tables
+ * in the database the same way {@link ShowTableStatusOperation} does, so
every table whose
+ * metadata is returned is authorized.
+ */
+ private void addReadEntitiesForShowTableExtendedPattern(String dbName,
String pattern)
+ throws SemanticException {
+ try {
+ Pattern likePattern =
Pattern.compile(UDFLike.likePatternToRegExp(pattern),
+ Pattern.CASE_INSENSITIVE);
+ for (String name : db.getTablesForDb(dbName, null)) {
Review Comment:
The authorized table set is discarded, then execution lists tables again. A
newly matching table could be returned without authorization.
##########
ql/src/java/org/apache/hadoop/hive/ql/ddl/table/info/show/status/ShowTableStatusAnalyzer.java:
##########
@@ -81,4 +89,24 @@ public void analyzeInternal(ASTNode root) throws
SemanticException {
task.setFetchSource(true);
setFetchTask(createFetchTask(ShowTableStatusDesc.SCHEMA));
}
+
+ /**
+ * Register table read inputs for authorization. Resolves the SQL LIKE
pattern against the tables
+ * in the database the same way {@link ShowTableStatusOperation} does, so
every table whose
+ * metadata is returned is authorized.
+ */
+ private void addReadEntitiesForShowTableExtendedPattern(String dbName,
String pattern)
+ throws SemanticException {
+ try {
+ Pattern likePattern =
Pattern.compile(UDFLike.likePatternToRegExp(pattern),
+ Pattern.CASE_INSENSITIVE);
+ for (String name : db.getTablesForDb(dbName, null)) {
+ if (likePattern.matcher(name).matches()) {
+ inputs.add(new ReadEntity(getTable(dbName, name, true)));
Review Comment:
Could we batch these lookups? Broad patterns now fetch every matching table
twice.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
