attilapiros opened a new pull request, #7586: URL: https://github.com/apache/kyuubi/pull/7586
### Why are the changes needed? This PR adds a configurable plan-node deny list to kyuubi-spark-authz. The first (and currently only) entry blocks `ScriptTransformation` — the Spark SQL `TRANSFORM ... USING <script>` feature — which would otherwise let any SQL user execute arbitrary shell commands on Spark executors, bypassing all Ranger data-access controls. ### How was this patch tested? Added a new unit test suite `NodeDenyListCheckerSuite`: ``` Discovery starting. Discovery completed in 134 milliseconds. Run starting. Expected test count is: 3 NodeDenyListCheckerSuite: - plain SELECT is allowed - TRANSFORM ... USING is rejected - TRANSFORM ... USING inside a subquery is rejected Run completed in 4 seconds, 858 milliseconds. Total number of tests run: 3 Suites: completed 2, aborted 0 Tests: succeeded 3, failed 0, canceled 0, ignored 0, pending 0 ``` ### Was this patch authored or co-authored using generative AI tooling? Assisted-by: Claude:claude-sonnet -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
