[HBASE-20735] Invalid validation of coprocessor whitelist

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: Coprocessors
• Labels: security
• Assignee: Unassigned
• Reporter: Jagadeesh Anabathula
• Created: 14/Jun/18 19:35
• Updated: 15/Jun/22 00:27

Description

Per HBASE-16700, coprocessors can be present only in whitelisted paths.
It validates for every new coprocessor, if jar's path is in whitelist paths.
It is currently validating only the first coprocessor that is set to a table. All the coprocessors that are added after that are not validated and allows path other than that are whitelisted.

In my case, I have hbase.coprocessor.region.whitelist.paths as /tmp/*,/tmp/coprocessors/*

Following works fine

 hbase(main):001:0> create 'test_coprocessors', 'c'
 0 row(s) in 1.7540 seconds

=> Hbase::Table - test_coprocessors
 hbase(main):002:0> alter 'test_coprocessors', METHOD => 'table_att', 'COPROCESSOR' => 'hdfs:/tmp/coprocessors/coprocessors-0.4.0.jar|com.test.hbase.coprocessors.observers.PrefixedDataFilter|100|prefix=P'
 Updating all regions with the new schema...
 1/1 regions updated.
 Done.
 0 row(s) in 2.1250 seconds

hbase(main):003:0> alter 'test_coprocessors', METHOD => 'table_att', 'COPROCESSOR' => 'hdfs:/user/hbase/coprocessors/coprocessors-0.4.0.jar|com.test.hbase.coprocessors.observers.PrefixedDataFilter|100|prefix=P'
 Updating all regions with the new schema...
 1/1 regions updated.
 Done.
 0 row(s) in 1.9690 seconds

hbase(main):004:0> desc 'test_coprocessors'
 Table test_coprocessors is ENABLED
 test_coprocessors, {TABLE_ATTRIBUTES => {METADATA => {'COPROCESSOR$1' => 'hdfs:/tmp/coprocessors/coprocessors-0.4.0.jar|com.test.hbase.coprocessors.observer
 s.PrefixedDataFilter|100|prefix=P', 'COPROCESSOR$2' => 'hdfs:/user/hbase/coprocessors/coprocessors-0.4.0.jar|com.test.hbase.coprocessors.observers.Prefi
 xedDataFilter|100|prefix=P'}}
 COLUMN FAMILIES DESCRIPTION

{NAME => 'c', BLOOMFILTER => 'ROW', VERSIONS => '1', IN_MEMORY => 'false', KEEP_DELETED_CELLS => 'FALSE', DATA_BLOCK_ENCODING => 'NONE', TTL => 'FOREVER', COMPRESSION => 'NONE', MIN_VERSIONS => '0', BLOCKCACHE => 'true', BLOCKSIZE => '65536', REPLICATION_SCOPE => '0'}

1 row(s) in 0.0220 seconds