[IMPALA-11744] Table mask view should preserve the original column order in Hive

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: Impala 4.0.0, Impala 4.1.0, Impala 4.2.0, Impala 4.1.1
• Fix Version/s: Impala 4.1.2, Impala 4.3.0
• Component/s: Security
• Target Version: Impala 4.1.2
• Epic Color: ghx-label-8
• Assignee: Quanlong Huang
• Reporter: Quanlong Huang
• Created: 24/Nov/22 09:24
• Updated: 28/Mar/23 22:03
• Resolved: 06/Dec/22 04:28

Description

Ranger provides column masking and row filtering policies to mask sensitive data to specified users/groups. When a table should be masked in a query, Impala replaces it with a table mask view that expose the columns with masked expressions.

After IMPALA-9661, only selected columns are exposed in the table mask view. However, the columns are exposed in the order that they are registered, which can provide wrong results if the original statement contains STAR expressions.

The following example shows the issue:

create table mask_test_tbl (a string, b string, c string, d string);
insert into mask_test_tbl values ("aaaa", "bbbb", "cccc", "dddd");
-- Create a column masking policies on column c using Redact
select * from mask_test_tbl;
+------+------+------+------+
| a    | b    | c    | d    |
+------+------+------+------+
| aaaa | bbbb | xxxx | dddd |
+------+------+------+------+

The following query produces incorrect results:

select b, * from mask_test_tbl;
+------+------+------+------+------+
| b    | a    | b    | c    | d    |
+------+------+------+------+------+
| bbbb | bbbb | aaaa | xxxx | dddd |
+------+------+------+------+------+

Note that the results of 2nd and 3rd columns are reverted.

Issue Links

• is caused by: IMPALA-9661 Avoid introducing unused columns in table masking view
• links to: Code Review