[RANGER-3009] Query with column mask fail with ParseException if column name has special char

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.1.0
• Component/s: Ranger
• Assignee: Unassigned
• Reporter: Rajkumar Singh
• Created: 23/Sep/20 23:52
• Updated: 15/Sep/22 09:53

Description

hive query with column masking failed with ParseException

Table DDL

CREATE TABLE `emp`( `id` string, `name#` string);

The following query failed

select `emp`.`id`, `emp`.`name#` from (SELECT `id`, CAST(mask_show_first_n(name#, 4, 'x', 'x', 'x', -1, '1') AS string) AS `name#`, BLOCK__OFFSET__INSIDE__FILE, INPUT__FILE__NAME, ROW__ID FROM `default`.`emp` )`emp`;

Error: Error while compiling statement: FAILED: ParseException line 1:79 character '#' not supported here (state=42000,code=40000)

quoting manually helped

select `emp`.`id`, `emp`.`name#` from (SELECT `id`, CAST(mask_show_first_n(`name#`, 4, 'x', 'x', 'x', -1, '1') AS string) AS `name#`, BLOCK__OFFSET__INSIDE__FILE, INPUT__FILE__NAME, ROW__ID FROM `default`.`emp` )`emp`;

manual query change will not work for Ranger authorizer as following query

select * from emp;

will be rewritten to

select `emp`.`id`, `emp`.`name#` from (SELECT `id`, CAST(mask_show_first_n(name#, 4, 'x', 'x', 'x', -1, '1') AS string) AS `name#`, BLOCK__OFFSET__INSIDE__FILE, INPUT__FILE__NAME, ROW__ID FROM `default`.`emp` )`emp`;

Ranger apply the transformer for column RangerHiveAuthorizer#applyRowFilterAndColumnMasking so we should consider the enclosing the column names in the back-ticks to make it work

https://github.com/apache/ranger/blob/master/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java#L1332