This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.1 by this push:
new 31b0e6e5d10 branch-4.1: [fix](audit) Fix SET_VAR leakage after INSERT
audit logging (#67786) (#68108)
31b0e6e5d10 is described below
commit 31b0e6e5d1001c7f1dd81d8a3de16070afc2c862
Author: meiyi <[email protected]>
AuthorDate: Fri Sep 18 13:56:16 2026 +0800
branch-4.1: [fix](audit) Fix SET_VAR leakage after INSERT audit logging
(#67786) (#68108)
pick https://github.com/apache/doris/pull/67786
---
.../apache/doris/nereids/parser/NereidsParser.java | 5 +-
.../parser/AuditEncryptionSessionVariableTest.java | 63 ++++++++++++++++++++++
.../test_set_var_hint_restore.groovy | 44 +++++++++++++++
3 files changed, 111 insertions(+), 1 deletion(-)
diff --git
a/fe/fe-core/src/main/java/org/apache/doris/nereids/parser/NereidsParser.java
b/fe/fe-core/src/main/java/org/apache/doris/nereids/parser/NereidsParser.java
index 9c71956d38f..a1493178ab6 100644
---
a/fe/fe-core/src/main/java/org/apache/doris/nereids/parser/NereidsParser.java
+++
b/fe/fe-core/src/main/java/org/apache/doris/nereids/parser/NereidsParser.java
@@ -364,11 +364,14 @@ public class NereidsParser {
return (LogicalPlan) realLogicalPlanBuilder.visit(tree);
}
+ /** Parse SQL for masking without applying execution hints to the session.
*/
public LogicalPlan parseForEncryption(String sql, Map<Pair<Integer,
Integer>, String> indexInSqlToString) {
CommonTokenStream tokenStream = parseAllTokens(sql);
ParserRuleContext tree = toAst(tokenStream,
DorisParser::singleStatement);
+ // SQL masking must not apply SET_VAR hints to the current session.
+ // The original SQL, including its hints, is preserved by the property
replacements.
LogicalPlanBuilder realLogicalPlanBuilder = new
LogicalPlanBuilderForEncryption(
- getHintMap(sql, tokenStream, DorisParser::selectHint),
indexInSqlToString);
+ ImmutableMap.of(), indexInSqlToString);
return (LogicalPlan) realLogicalPlanBuilder.visit(tree);
}
diff --git
a/fe/fe-core/src/test/java/org/apache/doris/nereids/parser/AuditEncryptionSessionVariableTest.java
b/fe/fe-core/src/test/java/org/apache/doris/nereids/parser/AuditEncryptionSessionVariableTest.java
new file mode 100644
index 00000000000..58004fa4534
--- /dev/null
+++
b/fe/fe-core/src/test/java/org/apache/doris/nereids/parser/AuditEncryptionSessionVariableTest.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.doris.nereids.parser;
+
+import org.apache.doris.common.Pair;
+import org.apache.doris.nereids.StatementContext;
+import org.apache.doris.nereids.trees.plans.commands.info.BaseViewInfo;
+import org.apache.doris.qe.ConnectContext;
+import org.apache.doris.qe.SessionVariable;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+import java.util.TreeMap;
+
+public class AuditEncryptionSessionVariableTest {
+ @Test
+ public void testAuditParsingDoesNotApplySetVar() {
+ ConnectContext ctx = new ConnectContext();
+ ctx.setDatabase("test");
+ ctx.setStatementContext(new StatementContext(ctx, null));
+ ctx.setThreadLocalInfo();
+ try {
+ SessionVariable session = ctx.getSessionVariable();
+ session.setQueryTimeoutS(1800);
+ session.setInsertTimeoutS(14400);
+ String hint = "/*+ SET_VAR(query_timeout=1, insert_timeout=1) */";
+ String[] sources = {
+ "numbers(\"number\"=\"1\")",
+ "S3('uri'='s3://bucket/data.parquet', 'format'='parquet',
's3.secret_key'='test-secret')"
+ };
+ for (String source : sources) {
+ String sql = "INSERT INTO t SELECT " + hint + " * FROM " +
source;
+ TreeMap<Pair<Integer, Integer>, String> replacements = new
TreeMap<>(new Pair.PairComparator<>());
+ new NereidsParser().parseForEncryption(sql, replacements);
+ Assertions.assertEquals(1800, session.getQueryTimeoutS());
+ Assertions.assertEquals(14400, session.getInsertTimeoutS());
+ Assertions.assertFalse(session.getIsSingleSetVar());
+
Assertions.assertTrue(session.getSessionOriginValue().isEmpty());
+ String masked = BaseViewInfo.rewriteSql(replacements, sql);
+ Assertions.assertTrue(masked.contains(hint));
+ Assertions.assertFalse(masked.contains("test-secret"));
+ }
+ } finally {
+ ConnectContext.remove();
+ }
+ }
+}
diff --git
a/regression-test/suites/query_p0/session_variable/test_set_var_hint_restore.groovy
b/regression-test/suites/query_p0/session_variable/test_set_var_hint_restore.groovy
new file mode 100644
index 00000000000..52fd39e99c4
--- /dev/null
+++
b/regression-test/suites/query_p0/session_variable/test_set_var_hint_restore.groovy
@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+suite("test_set_var_hint_restore") {
+ sql "DROP TABLE IF EXISTS test_set_var_hint_restore"
+ sql """
+ CREATE TABLE test_set_var_hint_restore (
+ k INT NOT NULL,
+ v BIGINT NOT NULL
+ ) ENGINE=OLAP
+ DUPLICATE KEY(k)
+ DISTRIBUTED BY HASH(k) BUCKETS 6
+ PROPERTIES ("replication_num"="1")
+ """
+
+ def timeoutsBeforeInsert = sql "SELECT @@query_timeout, @@insert_timeout"
+ test {
+ sql """
+ INSERT INTO test_set_var_hint_restore
+ SELECT /*+ SET_VAR(query_timeout=1, insert_timeout=1) */
+ 41, SUM(CRC32(CAST(number AS STRING)))
+ FROM numbers("number"="1000000000")
+ """
+ exception "timeout"
+ }
+
+ // Read immediately: another statement could restore values leaked by
audit SQL parsing.
+ def timeoutsAfterInsert = sql "SELECT @@query_timeout, @@insert_timeout"
+ assertEquals(timeoutsBeforeInsert, timeoutsAfterInsert)
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
