From cfea4845afe511ba02bc2264536289aebf7c11c0 Mon Sep 17 00:00:00 2001 From: zml1206 Date: Wed, 29 Nov 2023 19:25:58 +0800 Subject: [PATCH] Disable spark script transformation in Authz --- .../authz/ranger/RangerSparkExtension.scala | 3 +- .../AuthzUnsupportedOperationsCheck.scala | 30 ++++++++++++++ ...AuthzUnsupportedOperationsCheckSuite.scala | 41 +++++++++++++++++++ 3 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzUnsupportedOperationsCheck.scala create mode 100644 extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzUnsupportedOperationsCheckSuite.scala diff --git a/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtension.scala b/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtension.scala index 93c10068a8c..d2a80917731 100644 --- a/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtension.scala +++ b/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtension.scala @@ -19,7 +19,7 @@ package org.apache.kyuubi.plugin.spark.authz.ranger import org.apache.spark.sql.SparkSessionExtensions -import org.apache.kyuubi.plugin.spark.authz.rule.{RuleEliminateMarker, RuleEliminatePermanentViewMarker, RuleEliminateTypeOf} +import org.apache.kyuubi.plugin.spark.authz.rule.{AuthzUnsupportedOperationsCheck, RuleEliminateMarker, RuleEliminatePermanentViewMarker, RuleEliminateTypeOf} import org.apache.kyuubi.plugin.spark.authz.rule.config.AuthzConfigurationChecker import org.apache.kyuubi.plugin.spark.authz.rule.datamasking.{RuleApplyDataMaskingStage0, RuleApplyDataMaskingStage1} import org.apache.kyuubi.plugin.spark.authz.rule.expression.RuleApplyTypeOfMarker @@ -45,6 +45,7 @@ class RangerSparkExtension extends (SparkSessionExtensions => Unit) { override def apply(v1: SparkSessionExtensions): Unit = { v1.injectCheckRule(AuthzConfigurationChecker) + v1.injectCheckRule(_ => new AuthzUnsupportedOperationsCheck) v1.injectResolutionRule(_ => new RuleReplaceShowObjectCommands()) v1.injectResolutionRule(_ => new RuleApplyPermanentViewMarker()) v1.injectResolutionRule(_ => new RuleApplyTypeOfMarker()) diff --git a/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzUnsupportedOperationsCheck.scala b/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzUnsupportedOperationsCheck.scala new file mode 100644 index 00000000000..4a189affca1 --- /dev/null +++ b/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzUnsupportedOperationsCheck.scala @@ -0,0 +1,30 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.kyuubi.plugin.spark.authz.rule + +import org.apache.spark.sql.catalyst.plans.logical.{LogicalPlan, ScriptTransformation} + +import org.apache.kyuubi.plugin.spark.authz.AccessControlException + +class AuthzUnsupportedOperationsCheck extends (LogicalPlan => Unit) { + override def apply(plan: LogicalPlan): Unit = plan foreach { + case _: ScriptTransformation => + throw new AccessControlException("Script transformation is not allowed") + case _ => + } +} diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzUnsupportedOperationsCheckSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzUnsupportedOperationsCheckSuite.scala new file mode 100644 index 00000000000..5959aebae12 --- /dev/null +++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzUnsupportedOperationsCheckSuite.scala @@ -0,0 +1,41 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.kyuubi.plugin.spark.authz.rule + +import org.scalatest.BeforeAndAfterAll +// scalastyle:off +import org.scalatest.funsuite.AnyFunSuite + +import org.apache.kyuubi.plugin.spark.authz.{AccessControlException, SparkSessionProvider} + +class AuthzUnsupportedOperationsCheckSuite extends AnyFunSuite with SparkSessionProvider + with BeforeAndAfterAll { + // scalastyle:on + + override protected val catalogImpl: String = "in-memory" + override def afterAll(): Unit = { + spark.stop() + super.afterAll() + } + + test("disable script transformation") { + val extension = new AuthzUnsupportedOperationsCheck + val p1 = sql("SELECT TRANSFORM('') USING 'ls /'").queryExecution.analyzed + intercept[AccessControlException](extension.apply(p1)) + } +}