Michael Smith has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24771 )
Change subject: IMPALA-15218: Add trusted_jar_paths for data sources ...................................................................... IMPALA-15218: Add trusted_jar_paths for data sources Adds allowlist `trusted_jar_paths` to identify a safe location for loading jars for DATA SOURCES and JDBC tables. Loading arbitrary jars allows code execution, and CREATE TABLE permissions need to be granted to people separate from the ability to load any jar. Table properties are difficult to authorize correctly, so an allowlist is added to put limits on what jars can be loaded into memory. To restore prior behavior, specify `trusted_jar_paths` on impalad startup flags as a comma-separated list of location prefixes for known JDBC driver jars, such as `/test-warehouse/data-sources/,hdfs://test-warehouse/data-sources/`. Also fixes an SQL injection issue and avoids printing dbcp.password in WARNING logs. Assisted-by: Claude Sonnet 4.6 (VSCode) Change-Id: I0bf53fb5eff545d5584ca120e362fd01a2086be1 Reviewed-on: http://gerrit.cloudera.org:8080/24771 Reviewed-by: Joe McDonnell <[email protected]> Tested-by: Michael Smith <[email protected]> --- M be/src/service/frontend.cc M be/src/util/backend-gflag-util.cc M bin/start-impala-cluster.py M common/thrift/BackendGflags.thrift M fe/src/main/java/org/apache/impala/extdatasource/jdbc/conf/JdbcStorageConfigManager.java M fe/src/main/java/org/apache/impala/extdatasource/jdbc/dao/DataSourceObjectCache.java M fe/src/main/java/org/apache/impala/extdatasource/jdbc/util/QueryConditionUtil.java M fe/src/main/java/org/apache/impala/planner/DataSourceScanNode.java M fe/src/main/java/org/apache/impala/service/BackendConfig.java M fe/src/test/java/org/apache/impala/extdatasource/jdbc/JdbcDataSourceTest.java M fe/src/test/java/org/apache/impala/planner/PlannerTest.java A fe/src/test/java/org/apache/impala/service/BackendConfigTest.java M tests/custom_cluster/test_ext_data_sources.py 13 files changed, 277 insertions(+), 10 deletions(-) Approvals: Joe McDonnell: Looks good to me, approved Michael Smith: Verified -- To view, visit http://gerrit.cloudera.org:8080/24771 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: branch-4.5.2 Gerrit-MessageType: merged Gerrit-Change-Id: I0bf53fb5eff545d5584ca120e362fd01a2086be1 Gerrit-Change-Number: 24771 Gerrit-PatchSet: 3 Gerrit-Owner: Michael Smith <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Joe McDonnell <[email protected]> Gerrit-Reviewer: Michael Smith <[email protected]> Gerrit-Reviewer: Steve Carlin <[email protected]>
