Repository navigation
[#13839] fix(server): Enforce metadata tag permissions on branch-1.3 - #13843
Merged
Merged
Conversation
…h-1.3 Adapt the server fix from apache#13794 (5ef4945) to branch-1.3. Group the complete CAN_ACCESS_METADATA expansion so object access cannot bypass tag permissions. Cover both REST authorization expressions with table and view permissions, and add a Java client HTTP regression for denied and authorized tag reads. Co-authored-by: Akshay Thorat <ak007t@gmail.com>
mchades
requested review from
jerryshao and
roryqi
and
a balanced review from Copilot
October 14, 2026 07:15
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
1 open finding
What changed in this PR
Backports a server authorization fix to branch-1.3 to ensure metadata-object tag reads can’t bypass tag permissions, and adds regression coverage for both REST routes and the Java client.
Changes:
- Groups the full
CAN_ACCESS_METADATAauthorization sub-expression to enforce correct operator precedence. - Adds a server-side unit test verifying tag reads require both metadata access and tag permissions across both REST resources.
- Extends Java client integration coverage to include
getTag()authorization via metadata-backed tag APIs.
| File | Description |
|---|---|
| server/src/test/java/org/apache/gravitino/server/web/rest/authorization/TestMetadataObjectTagAuthorizationExpression.java | Adds a regression test to validate tag-read authorization isn’t bypassed via metadata access. |
| server-common/src/main/java/org/apache/gravitino/server/authorization/expression/AuthorizationExpressionConverter.java | Fixes precedence by wrapping the full CAN_ACCESS_METADATA OR-chain in parentheses. |
| clients/client-java/src/test/java/org/apache/gravitino/client/integration/test/authorization/TagOperationsAuthorizationIT.java | Extends IT coverage to assert getTag() obeys tag permissions when accessed via metadata objects. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+44
to
+48
| for (String type : new String[] {"TABLE", "VIEW"}) { | ||
| MockAuthorizationExpressionEvaluator evaluator = | ||
| new MockAuthorizationExpressionEvaluator( | ||
| AuthorizationExpressionConverter.replaceCanAccessMetadataPrivilege(expression) | ||
| .replace("entityType", "'" + type + "'")); |
roryqi
approved these changes
Oct 14, 2026
Contributor
|
Do we need to fix this issue in the main branch? |
Contributor
Author
yes, the same fixed included in #13794 |
Copilot stopped reviewing on behalf of
mchades due to an error
October 14, 2026 08:50
Code Coverage Report
Files
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Apply the server fix from #13794 to
branch-1.3: group the completeCAN_ACCESS_METADATAexpression and add regression coverage for both tag REST routes and Java client tag reads, using 1.3's supported types and privileges.Why are the changes needed?
Metadata access could bypass tag permissions and expose associated tags to unauthorized users.
Fix: #13839 (branch-1.3)
Does this PR introduce any user-facing change?
Tag reads through metadata objects now enforce tag permissions.
How was this patch tested?
server-commontests, 43 server authorization tests, and 10TagOperationsAuthorizationITtests passed.git diff --checkpassed.