Branch utilized view columns ACL #24589
Conversation
| Analyzer analyzer = createAnalyzer(session, metadata, WarningCollector.NOOP); | ||
| Statement statement = SQL_PARSER.createStatement(query); | ||
| Analysis analysis = analyzer.analyze(statement); | ||
| assertEquals(analysis.getAccessControlReferences().getTableColumnAndSubfieldReferencesForAccessControl().values().toString(), "[{tpch.s1.v6=[a, c], tpch.s1.v7=[y]}, {tpch.s1.t1=[]}, {tpch.s1.t13=[]}]"); |
There was a problem hiding this comment.
This test case passes, so it shows that ACL is not being run on columns v6.b and v7.x
There was a problem hiding this comment.
oh i think this is the problem. The tables are getting empty lists, but our permissions service checks ALL columns when it gets an empty list of columns. The table access controls should have the columns that are used from the table (via the view).
There was a problem hiding this comment.
Ok, I will see if adding an equals method to AccessControlContext will change the results from empty list.
So the correct behavior would be something like:
"[{tpch.s1.v6=[a, c], tpch.s1.v7=[y]}, {tpch.s1.t1=[a, c]}, {tpch.s1.t13=[y]}]"
| Optional.empty(), | ||
| true)); |
There was a problem hiding this comment.
Used runAsInvoker as true
Description
Not able to reproduce the bug in this tasks using automated testing: T214103298
Motivation and Context
Impact
Test Plan
Contributor checklist
Release Notes
Please follow release notes guidelines and fill in the release notes below.
If release note is NOT required, use: