Yuming Wang created HIVE-30195:
----------------------------------
Summary: get_partitions_with_specs skips the table-level metastore
filter hook check (checkDbAndTableFilters) that all regular partition listing
RPCs perform
Key: HIVE-30195
URL: https://issues.apache.org/jira/browse/HIVE-30195
Project: Hive
Issue Type: Sub-task
Components: Standalone Metastore
Reporter: Yuming Wang
The {{get_partitions_with_specs}} thrift RPC introduced by HIVE-20306 bypasses
the table-level metastore filter hook check that every regular partition
listing RPC performs.
All regular partition listing RPCs ({{{}get_partitions{}}},
{{{}get_partitions_by_names{}}}, {{{}get_partitions_with_auth{}}},
{{{}get_partitions_by_filter{}}}, {{{}get_partitions_by_expr{}}},
{{{}get_partitions_ps{}}}, {{{}get_partitions_ps_with_auth{}}}) are routed
through {{{}GetPartitionsHandler{}}}, whose {{beforeExecute()}} performs both:
# {{{}firePreEvent(PreReadTableEvent){}}}, and
# {{authorizeTableForPartitionMetadata()}} →
{{{}FilterUtils.checkDbAndTableFilters(...){}}}, which runs the configured
metastore filter hook ({{{}metastore.server.filter.enabled{}}} /
{{{}metastore.filter.hook{}}}) against the database and the table, and throws
{{NoSuchObjectException}} when the hook filters them out.
{{get_partitions_with_specs}} has its own inline flow in {{HMSHandler}}
({{{}get_partitions_with_specs{}}}, ~lines 1571–1600): it fires the pre-event
and applies partition-level filtering post-fetch
({{{}FilterUtils.filterPartitionsIfEnabled{}}}), but never performs the
table-level {{checkDbAndTableFilters}} check.
Impact: with {{metastore.server.filter.enabled=true}} and a filter hook that
hides the table from the caller (server-side result filtering per
THREAT_MODEL.md §8.3), the regular listing RPCs fail fast with
{{{}NoSuchObjectException{}}}, while {{get_partitions_with_specs}} still
fetches all matching partitions and only filters at partition level afterwards
— whether rows are exposed depends on the hook's {{filterPartitions}}
implementation. Deployments that also configure {{HiveMetaStoreAuthorizer}} as
a pre-event listener are not affected (authorization is enforced by the
pre-event); the gap affects the filter-hook (visibility/masking) mechanism
specifically.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
