فهرست منبع

[beeswax] Enable a whitelist of Hive configuration properties that users are authorized to set

Jenny Kim 9 سال پیش
والد
کامیت
428d272dcb

+ 8 - 1
apps/beeswax/src/beeswax/conf.py

@@ -24,7 +24,7 @@ from django.utils.translation import ugettext_lazy as _t, ugettext as _
 
 from desktop.conf import default_ssl_cacerts, default_ssl_validate, AUTH_PASSWORD as DEFAULT_AUTH_PASSWORD,\
   AUTH_USERNAME as DEFAULT_AUTH_USERNAME
-from desktop.lib.conf import ConfigSection, Config, coerce_bool, coerce_password_from_script
+from desktop.lib.conf import ConfigSection, Config, coerce_bool, coerce_csv, coerce_password_from_script
 from desktop.lib.exceptions import StructuredThriftTransportException
 
 from beeswax.settings import NICE_NAME
@@ -131,6 +131,13 @@ USE_NEW_EDITOR = Config( # To remove in Hue 4
   help=_t('Choose whether to show the new SQL editor.')
 )
 
+CONFIG_WHITELIST = Config(
+  key='config_whitelist',
+  default='hive.map.aggr,hive.exec.compress.output,hive.exec.parallel,hive.execution.engine,mapreduce.job.queuename',
+  type=coerce_csv,
+  help=_t('A comma-separated list of white-listed Hive configuration properties that users are authorized to set.')
+)
+
 SSL = ConfigSection(
   key='ssl',
   help=_t('SSL configuration for the server.'),

+ 1 - 2
apps/beeswax/src/beeswax/models.py

@@ -421,8 +421,7 @@ class Session(models.Model):
     return json.loads(self.properties)
 
   def get_formatted_properties(self):
-    blacklisted_properties = ('system:java.class.path', 'env:CLASSPATH', 'env:HADOOP_CLASSPATH')
-    return [dict({'key': key, 'value': value}) for key, value in self.get_properties().items() if key not in blacklisted_properties]
+    return [dict({'key': key, 'value': value}) for key, value in self.get_properties().items()]
 
   def __str__(self):
     return '%s %s' % (self.owner, self.last_used)

+ 4 - 3
apps/beeswax/src/beeswax/server/hive_server2_lib.py

@@ -39,7 +39,7 @@ from TCLIService.ttypes import TOpenSessionReq, TGetTablesReq, TFetchResultsReq,
 from beeswax import conf as beeswax_conf
 from beeswax import hive_site
 from beeswax.hive_site import hiveserver2_use_ssl
-from beeswax.conf import LIST_PARTITIONS_LIMIT
+from beeswax.conf import CONFIG_WHITELIST, LIST_PARTITIONS_LIMIT
 from beeswax.models import Session, HiveServerQueryHandle, HiveServerQueryHistory
 from beeswax.server.dbms import Table, NoSuchObjectException, DataTable,\
                                 QueryServerException
@@ -887,8 +887,9 @@ class HiveServerClient:
 
     results = self.execute_query_statement(query)
     if results:
-      rows = [row[0] for row in results.rows()]
-      configuration = dict((row.split('=')[0], row.split('=')[1]) for row in rows if '=' in row)
+      config_whitelist = [config.lower() for config in CONFIG_WHITELIST.get()]
+      properties = [(row[0].split('=')[0], row[0].split('=')[1]) for row in results.rows() if '=' in row[0]]
+      configuration = dict((prop, value) for prop, value in properties if prop.lower() in config_whitelist)
     return configuration
 
 

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -804,6 +804,9 @@
   # New column format is from version 7.
   ## thrift_version=7
 
+  # A comma-separated list of white-listed Hive configuration properties that users are authorized to set.
+  # config_whitelist=hive.map.aggr,hive.exec.compress.output,hive.exec.parallel,hive.execution.engine,mapreduce.job.queuename
+
   [[ssl]]
     # Path to Certificate Authority certificates.
     ## cacerts=/etc/hue/cacerts.pem

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -806,6 +806,9 @@
   # New column format is from version 7.
   ## thrift_version=7
 
+  # A comma-separated list of white-listed Hive configuration properties that users are authorized to set.
+  # config_whitelist=hive.map.aggr,hive.exec.compress.output,hive.exec.parallel,hive.execution.engine,mapreduce.job.queuename
+
   [[ssl]]
     # Path to Certificate Authority certificates.
     ## cacerts=/etc/hue/cacerts.pem