Skip to content

[fix][CGS][entrance] disable location clause in Hive tasks for security#960

Closed
v-kkhuang wants to merge 1 commit intodev-1.18.0-webankfrom
dev-1.19.0-hive-location
Closed

[fix][CGS][entrance] disable location clause in Hive tasks for security#960
v-kkhuang wants to merge 1 commit intodev-1.18.0-webankfrom
dev-1.19.0-hive-location

Conversation

@v-kkhuang
Copy link
Copy Markdown

@v-kkhuang v-kkhuang commented Mar 26, 2026

What is the purpose of the change

Background/Problem:
Currently, Hive tasks can use the LOCATION clause to specify custom data locations. This poses security risks as it allows users to potentially access unauthorized data paths or interfere with other users' data, compromising system security and data isolation.

Purpose of Change:
To address this security issue, this PR adds control mechanism to disable the LOCATION clause in Hive tasks. The solution introduces a configuration option linkis.entrance.sql.explain.hive.location.control.enabled that, when enabled, prevents users from executing Hive SQL statements containing the LOCATION clause.

Value/Impact:
After this change, administrators can prevent users from using the LOCATION clause in Hive tasks, enhancing system security by ensuring users cannot access unauthorized data paths or interfere with other users' data through custom location specifications.

Related issues/PRs

Related issues: close #959

Brief change log

  • Add configuration linkis.entrance.sql.explain.hive.location.control.enabled to control LOCATION clause validation
  • Implement LOCATION clause detection in Explain interceptor for Hive tasks
  • Add comprehensive unit tests for LOCATION control logic
  • Update EntranceConfiguration with new configuration keys
  • Add design documentation and Cucumber feature specification

Checklist

  • I have read the Contributing Guidelines on pull requests.
  • I have explained the need for this PR and the problem it solves
  • I have explained the changes or the new features added to this PR
  • I have added tests corresponding to this change
  • I have updated the documentation to reflect this change
  • I have verified that this change is backward compatible
  • If this is a code change: I have written unit tests to fully verify the new behavior.

@v-kkhuang v-kkhuang added the bug Something isn't working label Mar 26, 2026
@v-kkhuang v-kkhuang closed this Mar 26, 2026
@v-kkhuang v-kkhuang reopened this Mar 26, 2026
@v-kkhuang v-kkhuang changed the title [computation-governance][entrance] fix: disable LOCATION clause in Hive tasks for security [fix][cgs][entrance] disable LOCATION clause in Hive tasks for security Mar 26, 2026
@v-kkhuang v-kkhuang changed the title [fix][cgs][entrance] disable LOCATION clause in Hive tasks for security [fix][cgs][entrance] disable location clause in Hive tasks for security Mar 26, 2026
@v-kkhuang v-kkhuang changed the base branch from apachemaster to dev-1.18.0-webank March 26, 2026 03:51
@v-kkhuang v-kkhuang closed this Mar 26, 2026
@v-kkhuang v-kkhuang changed the title [fix][cgs][entrance] disable location clause in Hive tasks for security [fix][CGS][entrance] disable location clause in Hive tasks for security Mar 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant