[HIVE-9473] sql std auth should disallow built-in udfs that allow any java methods to be called

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.0
• Component/s: Authorization, SQLStandardAuthorization
• Labels: TODOC1.0

Release Note

SQL Standard authorization will disable the udfs reflect, reflect2 and java_method by automatically setting the udf blacklist config parameter (hive.server2.builtin.udf.blacklist). However, if HiveServer2 admin chooses to set the config param to a specific value, it will not be altered.

• Assignee: Thejas Nair
• Reporter: Thejas Nair
• Created: 26/Jan/15 22:50
• Updated: 26/Feb/15 00:14
• Resolved: 30/Jan/15 00:35

Description

As mentioned in HIVE-8893, some udfs can be used to execute arbitrary java methods. This should be disallowed when sql standard authorization is used.

Issue Links

• is related to: HIVE-8893 Implement whitelist for builtin UDFs to avoid untrused code execution in multiuser mode