[SENTRY-2533] The UDF in_file should be blacked default

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.2.0
• Component/s: Sentry
• Labels: security
• Assignee: Wenchao Li
• Reporter: Wenchao Li
• Created: 20/Sep/19 12:51
• Updated: 12/Dec/19 19:59
• Resolved: 12/Dec/19 19:59

Description

HIVE-20420(CVE-2018-11777) introduced a fallback authorizer factory which disallowed some builtin UDFs such as java_method, reflect, reflect2 and in_file. But Sentry does not black in_file up to now, so a malicious user can use in_file in SQL queries to detect some specific files on the HS2 host, or to detect whether a specific file has specific content. in_file should be added to HIVE_UDF_BLACK_LIST.

Issue Links

• links to: Review Board Link