Ruben Q L created CALCITE-7760:
----------------------------------
Summary: Harden Spark engine activation: require operator opt-in
via system property
Key: CALCITE-7760
URL: https://issues.apache.org/jira/browse/CALCITE-7760
Project: Calcite
Issue Type: Improvement
Components: spark
Reporter: Ruben Q L
Fix For: 1.43.0
The {{spark=true}} JDBC connection property currently triggers process-wide
side effects: a local JavaSparkContext, an on-disk class directory served over
a local HTTP class server, and setting a JVM system property; which falls
outside the query author's authority per our threat model (i.e. they belong to
the operator, not the query author).
Therefore it is proposed to gate the Spark engine on a new operator-only system
property {{calcite.enable.spark}} (default false). A connection using
{{spark=true}} without the opt-in now should fail with SecurityException at
prepare time, before SparkHandlerImpl is reflectively loaded and before any
handler side effect happens. Also move the class directory from
build/sparkServer/classes (relative to CWD) to a per-process directory under
java.io.tmpdir.
This would be a breaking change, and shall be documented as such. Deployments
that use the Spark engine from now on will need to set
{{-Dcalcite.enable.spark=true}} .
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
