Luca Castelli created FLINK-41421:
-------------------------------------
Summary: StateCatalog database names can resolve outside the
configured snapshot directories
Key: FLINK-41421
URL: https://issues.apache.org/jira/browse/FLINK-41421
Project: Flink
Issue Type: Bug
Components: API / State Processor
Affects Versions: 2.4.0
Reporter: Luca Castelli
Fix For: 2.4.0
{{Related to FLINK-40176.}}
{{SnapshotDiscovery#find}}{{ turns a database name back into a snapshot path.
It resolves the part after the label (and after the timestamp segment, when
}}{{db-name.include-ts}}{{ is true) against the configured directory, but it
does not check that the result stays inside that directory. So }}{{..}}{{
segments reach any }}{{_metadata}}{{ file that the process can read.
}}{{{}getDatabase{}}}{{{}, {}}}{{{}databaseExists{}}}{{{},
{}}}{{{}listTables{}}}{{{}, {}}}{{getTable}}{{ and }}{{tableExists}}{{ all call
}}{{{}find{}}}{{{}.{}}}
Example, with {{{}directory.app = /state/envs/prod{}}}:
||Database name||Resolves to||
|{{app/<ts>/../other-snapshot}}|{{/state/envs/other-snapshot}}|
|{{app/<ts>/../../secret}}|{{/state/secret}}|
|{{app/<ts>/../prod-sibling/snap}}|{{/state/envs/prod-sibling/snap}}|
|{{app/<ts>/file:/state/secret}}|throws {{IllegalArgumentException}}|
The timestamp segment is not validated, so any value works there. With
{{{}db-name.include-ts=false{}}}, {{app/../other-snapshot}} gives the same
result. A name under one label can also reach a snapshot under another label.
Suggested fix: validate the resolved path, not the name, as FLINK-40332 did for
{{{}FileCatalogStore{}}}. {{find}} returns no match when the resolved snapshot
directory is not the configured directory or one of its descendants (compare
{{Path}} objects, not string prefixes), and when {{Path}} rejects the name.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
