Эх сурвалжийг харах

HUE-5275 [libsentry] Avoid mutating original objects in privilege checker

Jenny Kim 9 жил өмнө
parent
commit
16f60ad

+ 3 - 8
desktop/libs/libsentry/src/libsentry/privilege_checker.py

@@ -15,7 +15,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import copy
 import logging
 
 from collections import defaultdict
@@ -61,7 +60,7 @@ class PrivilegeChecker(object):
     self.api_v2 = api_v2 if api_v2 else get_api_v2(self.user, component='solr')
 
 
-  def filter_objects(self, objects, action='READ', key=None):
+  def filter_objects(self, objects, action='READ', key=lambda x: x.copy()):
     """
     Given a set of authorizable Sentry objects and a requested action, return a filtered set of objects that the user
     has privileges to perform the given action upon.
@@ -101,9 +100,7 @@ class PrivilegeChecker(object):
     return filtered_objects
 
 
-  def _to_sentry_authorizables(self, objects, key=None):
-    authorizables =  copy.deepcopy(objects)
-
+  def _to_sentry_authorizables(self, objects, key):
     def add_default_server(object):
       if 'db' in object and not object.get('server'):  # V1
         object.update({'server': 'server1'})
@@ -111,9 +108,7 @@ class PrivilegeChecker(object):
         object.update({'serviceName': 'server1'})
       return object
 
-    if key:
-      authorizables = [key(obj) for obj in authorizables if key(obj)]
-
+    authorizables = [key(obj) for obj in objects if key(obj)]
     authorizables = [add_default_server(obj) for obj in authorizables]
     return authorizables
 

+ 77 - 0
desktop/libs/libsentry/src/libsentry/test_privilege_checker.py

@@ -121,6 +121,83 @@ class TestPrivilegeChecker(object):
     # Original list of objects should not be mutated
     assert_true(['bar', 'baz', 'foo'], sorted(objectSet, reverse=True))
 
+    objectSet = [
+      {
+          u'identity': u'9282adb88478c2ce4beb13dbba997ef5',
+          u'serDeLibName': u'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe',
+          u'outputFormat': u'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat',
+          u'sourceType': u'HIVE',
+          u'inputFormat': u'org.apache.hadoop.mapred.TextInputFormat',
+          u'created': u'2016-07-25T17: 22: 18.000Z',
+          u'sourceId': u'4fbdadc6899638782fc8cb626176dc7b',
+          u'tags': [
+              u'asdf'
+          ],
+          u'deleted': False,
+          u'_version_': 1549818955715051520,
+          u'userEntity': False,
+          u'properties': {
+              u'1': u'2'
+          },
+          u'extractorRunId': u'4fbdadc6899638782fc8cb626176dc7b##1',
+          u'compressed': False,
+          u'parentPath': u'/default',
+          u'owner': u'admin',
+          u'originalName': u'sample_08',
+          u'type': u'TABLE',
+          u'lastAccessed': u'1970-01-01T00: 00: 00.000Z',
+          u'fileSystemPath': u'hdfs: //hue-team-1.vpc.cloudera.com: 8020/user/hive/warehouse/sample_08',
+          u'internalType': u'hv_table'
+      },
+      {
+          u'serDeLibName': u'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe',
+          u'owner': u'admin',
+          u'fileSystemPath': u'hdfs: //hue-team-1.vpc.cloudera.com: 8020/user/hive/warehouse/sample_07',
+          u'lastModifiedBy': u'admin',
+          u'_version_': 1550478188023382016,
+          u'type': u'TABLE',
+          u'internalType': u'hv_table',
+          u'sourceType': u'HIVE',
+          u'inputFormat': u'org.apache.hadoop.mapred.TextInputFormat',
+          u'tags': [
+              u'hue-bugblitz',
+              u'vvvvv',
+              u'asdf',
+              u'ffff'
+          ],
+          u'deleted': False,
+          u'userEntity': False,
+          u'originalDescription': u'HueisaWebinterfaceforanalyzingdatawithApacheHadoop.HueisaWebinterfaceforanalyzingdatawithApacheHadoop.HueisaWebinterfaceforanalyzingdatawithApacheHadoop.HueisaWebinterfaceforanalyzingdatawithApacheHadoop.\n\nHueisaWebinterfaceforanalyzingdatawithApacheHadoop.HueisaWebinterfaceforanalyzingdatawithApacheHadoop.',
+          u'compressed': False,
+          u'identity': u'ea27302e11370a3927ac11cbb920891d',
+          u'outputFormat': u'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat',
+          u'extractorRunId': u'4fbdadc6899638782fc8cb626176dc7b##8979',
+          u'created': u'2016-07-25T17: 22: 15.000Z',
+          u'sourceId': u'4fbdadc6899638782fc8cb626176dc7b',
+          u'lastModified': u'2016-09-28T16: 25: 07.000Z',
+          u'parentPath': u'/default',
+          u'originalName': u'sample_07',
+          u'lastAccessed': u'1970-01-01T00: 00: 00.000Z'
+      }
+    ]
+    expectedSet = [
+      {u'column': None, u'table': u'sample_08', u'db': u'default', 'server': 'server1'},
+      {u'column': None, u'table': u'sample_07', u'db': u'default', 'server': 'server1'}
+    ]
+
+    def test_key_fn(obj):
+      return {
+        'column': None,
+        'table': obj.get('originalName'),
+        'db': obj.get('parentPath', '').strip('/')
+      }
+
+    authorizableSet = self.checker._to_sentry_authorizables(objects=objectSet, key=test_key_fn)
+    assert_equal(expectedSet, authorizableSet, authorizableSet)
+    # Original list of objects should not be mutated
+    assert_true(all('server' not in obj for obj in objectSet))
+    assert_true(all('db' not in obj for obj in objectSet))
+
 
   def test_columns_select(self):
     action = 'SELECT'