diff --git a/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Constants.java b/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Constants.java index d359da9fd..1f8d8635c 100644 --- a/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Constants.java +++ b/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Constants.java @@ -14,6 +14,21 @@ */ package io.hetu.core.plugin.hbase.utils; +import io.prestosql.spi.type.BigintType; +import io.prestosql.spi.type.BooleanType; +import io.prestosql.spi.type.DateType; +import io.prestosql.spi.type.DoubleType; +import io.prestosql.spi.type.IntegerType; +import io.prestosql.spi.type.SmallintType; +import io.prestosql.spi.type.TimeType; +import io.prestosql.spi.type.TimestampType; +import io.prestosql.spi.type.TinyintType; +import io.prestosql.spi.type.VarcharType; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; + /** * constants * @@ -196,5 +211,23 @@ public class Constants */ public static final String HDFS_AUTHENTICATION_KERBEROS = "KERBEROS"; + /** + * type class names' list + */ + public static final List HBASE_DATA_TYPE_NAME_LIST = Collections.unmodifiableList(new ArrayList() { + { + this.add(VarcharType.class.getName()); + this.add(TinyintType.class.getName()); + this.add(SmallintType.class.getName()); + this.add(IntegerType.class.getName()); + this.add(BigintType.class.getName()); + this.add(DoubleType.class.getName()); + this.add(BooleanType.class.getName()); + this.add(TimeType.class.getName()); + this.add(DateType.class.getName()); + this.add(TimestampType.class.getName()); + } + }); + private Constants() {} } diff --git a/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Utils.java b/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Utils.java index 68607d3bf..244ada377 100644 --- a/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Utils.java +++ b/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Utils.java @@ -27,6 +27,8 @@ import java.lang.reflect.Field; import java.util.Map; import java.util.Optional; +import static io.hetu.core.plugin.hbase.utils.Constants.HBASE_DATA_TYPE_NAME_LIST; + /** * Utils * @@ -76,6 +78,9 @@ public class Utils public static Type createTypeByName(String type) { Type result = null; + if (!HBASE_DATA_TYPE_NAME_LIST.contains(type)) { + return Optional.ofNullable(result).orElse(result); + } try { Class clazz = Class.forName(type); Field[] fields = clazz.getFields(); diff --git a/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/HBaseRowSerializer.java b/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/HBaseRowSerializer.java index 0275dc6cd..d88da7daf 100644 --- a/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/HBaseRowSerializer.java +++ b/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/HBaseRowSerializer.java @@ -269,6 +269,9 @@ public interface HBaseRowSerializer static HBaseRowSerializer getSerializerInstance(String serializerClassName) { try { + if (!SerializerConstants.WHITE_LIST_HBASEROWSERIALIZER_NAME.contains(serializerClassName)) { + throw new PrestoException(NOT_FOUND, "Illegal configured serializer class."); + } return (HBaseRowSerializer) Class.forName(serializerClassName).getConstructor().newInstance(); } catch (ClassNotFoundException diff --git a/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/SerializerConstants.java b/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/SerializerConstants.java new file mode 100644 index 000000000..a4743a653 --- /dev/null +++ b/hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/SerializerConstants.java @@ -0,0 +1,35 @@ +/* + * Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package io.hetu.core.plugin.hbase.utils.serializers; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; + +public class SerializerConstants +{ + /** + * HBaseRowSerializer implementation class list + */ + public static final List WHITE_LIST_HBASEROWSERIALIZER_NAME = Collections.unmodifiableList(new ArrayList(){ + { + this.add(StringRowSerializer.class.getName()); + } + }); + + private SerializerConstants() + { + } +} diff --git a/hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/CsvDataSource.java b/hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/CsvDataSource.java index d303c877f..bd7e28a0f 100644 --- a/hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/CsvDataSource.java +++ b/hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/CsvDataSource.java @@ -31,6 +31,7 @@ import java.util.List; import java.util.Map; import java.util.Properties; +import static io.hetu.core.heuristicindex.HeuristicIndexUtConstants.CVS_COLUMNS_DATA_TYPES; import static java.util.Objects.requireNonNull; public class CsvDataSource @@ -133,6 +134,9 @@ public class CsvDataSource result.put(i, values); } + if (!CVS_COLUMNS_DATA_TYPES.contains(types[i])) { + throw new IllegalStateException("The input data type is not support"); + } if (Class.forName(types[i]).equals(String.class)) { values.add(columns[i]); } diff --git a/hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/HeuristicIndexUtConstants.java b/hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/HeuristicIndexUtConstants.java new file mode 100644 index 000000000..4f5d7dd0a --- /dev/null +++ b/hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/HeuristicIndexUtConstants.java @@ -0,0 +1,36 @@ +/* + * Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package io.hetu.core.heuristicindex; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; + +public class HeuristicIndexUtConstants +{ + /** + * list of cvs columns data types + */ + public static final List CVS_COLUMNS_DATA_TYPES = Collections.unmodifiableList(new ArrayList() { + { + this.add(Integer.class.getName()); + this.add(String.class.getName()); + } + }); + + private HeuristicIndexUtConstants() + { + } +} diff --git a/presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftConstants.java b/presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftConstants.java new file mode 100644 index 000000000..ee3e0bb0f --- /dev/null +++ b/presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftConstants.java @@ -0,0 +1,46 @@ +/* + * Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package io.prestosql.plugin.hive.metastore.thrift; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; + +public class ThriftConstants +{ + /** + * White list for MetastoreClientFactory implementation's class name + */ + public static final List WHITE_LIST_FOR_METASTORECLIENTFACTORY_CLASS = Collections.unmodifiableList(new ArrayList() { + { + this.add("io.prestosql.plugin.hive.metastore.thrift.MockThriftMetastoreClientFactory"); + this.add(ThriftMetastoreClientFactory.class.getName()); + } + }); + + /** + * White list for ThriftMetastore implementation's class name + */ + public static final List WHITE_LIST_FOR_THRIFTMETASTORE_CLASS = Collections.unmodifiableList(new ArrayList() { + { + this.add("io.prestosql.plugin.hive.metastore.thrift.InMemoryThriftMetastore"); + this.add(ThriftHiveMetastore.class.getName()); + } + }); + + private ThriftConstants() + { + } +} diff --git a/presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastoreModule.java b/presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastoreModule.java index 4ee2fc4f1..5ff862bd9 100644 --- a/presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastoreModule.java +++ b/presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastoreModule.java @@ -33,6 +33,8 @@ import io.prestosql.spi.procedure.Procedure; import static com.google.inject.multibindings.Multibinder.newSetBinder; import static io.airlift.configuration.ConfigBinder.configBinder; +import static io.prestosql.plugin.hive.metastore.thrift.ThriftConstants.WHITE_LIST_FOR_METASTORECLIENTFACTORY_CLASS; +import static io.prestosql.plugin.hive.metastore.thrift.ThriftConstants.WHITE_LIST_FOR_THRIFTMETASTORE_CLASS; import static org.weakref.jmx.guice.ExportBinder.newExporter; public class ThriftMetastoreModule @@ -52,6 +54,9 @@ public class ThriftMetastoreModule binder.bind(MetastoreClientFactory.class).to(ThriftMetastoreClientFactory.class).in(Scopes.SINGLETON); } else { + if (!WHITE_LIST_FOR_METASTORECLIENTFACTORY_CLASS.contains(config.getMetastoreClientFactoryImp().trim())) { + throw new PrestoException(HiveErrorCode.HIVE_FILE_NOT_FOUND, "Found illegal class when binding MetastoreClientFactory."); + } log.info("Binding MetastoreClientFactory.class to %s", config.getMetastoreClientFactoryImp().trim()); binder.bind(MetastoreClientFactory.class) .to((Class) Class.forName(config.getMetastoreClientFactoryImp().trim())) @@ -67,6 +72,9 @@ public class ThriftMetastoreModule binder.bind(ThriftMetastore.class).to(ThriftHiveMetastore.class).in(Scopes.SINGLETON); } else { + if (!WHITE_LIST_FOR_THRIFTMETASTORE_CLASS.contains(config.getThriftMetastoreImp().trim())) { + throw new PrestoException(HiveErrorCode.HIVE_FILE_NOT_FOUND, "Found illegal class when binding ThriftMetastore."); + } log.info("Binding ThriftMetastore.class to %s", config.getThriftMetastoreImp().trim()); binder.bind(ThriftMetastore.class) .to((Class) Class.forName(config.getThriftMetastoreImp().trim())) diff --git a/presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3Constants.java b/presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3Constants.java new file mode 100644 index 000000000..ea52b76bb --- /dev/null +++ b/presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3Constants.java @@ -0,0 +1,42 @@ +/* + * Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package io.prestosql.plugin.hive.s3; + +import com.amazonaws.services.s3.model.KMSEncryptionMaterialsProvider; +import com.amazonaws.services.s3.model.SimpleMaterialProvider; +import com.amazonaws.services.s3.model.StaticEncryptionMaterialsProvider; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; + +public class PrestoS3Constants +{ + /** + * EncryptionMaterialsProvider Implementation List + */ + public static final List ENCRYPTIONMATERIALSPROVIDER_IMPL_LIST = Collections.unmodifiableList(new ArrayList() { + { + this.add("io.prestosql.plugin.hive.s3.TestPrestoS3FileSystem$TestEncryptionMaterialsProvider"); + this.add(KMSEncryptionMaterialsProvider.class.getName()); + this.add(SimpleMaterialProvider.class.getName()); + this.add(StaticEncryptionMaterialsProvider.class.getName()); + } + }); + + private PrestoS3Constants() + { + } +} diff --git a/presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3FileSystem.java b/presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3FileSystem.java index c33cb275e..861e76426 100644 --- a/presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3FileSystem.java +++ b/presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3FileSystem.java @@ -107,6 +107,7 @@ import static com.google.common.base.Throwables.throwIfUnchecked; import static com.google.common.base.Verify.verify; import static com.google.common.collect.Iterables.toArray; import static io.airlift.units.DataSize.Unit.MEGABYTE; +import static io.prestosql.plugin.hive.s3.PrestoS3Constants.ENCRYPTIONMATERIALSPROVIDER_IMPL_LIST; import static java.lang.Math.max; import static java.lang.Math.toIntExact; import static java.lang.String.format; @@ -730,6 +731,9 @@ public class PrestoS3FileSystem } try { + if (!ENCRYPTIONMATERIALSPROVIDER_IMPL_LIST.contains(empClassName)) { + throw new RuntimeException("Invalid provider class: " + empClassName); + } Object instance = Class.forName(empClassName).getConstructor().newInstance(); if (!(instance instanceof EncryptionMaterialsProvider)) { throw new RuntimeException("Invalid encryption materials provider class: " + instance.getClass().getName()); diff --git a/presto-hive/src/main/java/io/prestosql/plugin/hive/security/SecurityConstants.java b/presto-hive/src/main/java/io/prestosql/plugin/hive/security/SecurityConstants.java new file mode 100644 index 000000000..906b5845d --- /dev/null +++ b/presto-hive/src/main/java/io/prestosql/plugin/hive/security/SecurityConstants.java @@ -0,0 +1,50 @@ +/* + * Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package io.prestosql.plugin.hive.security; + +import io.prestosql.plugin.base.security.AllowAllAccessControl; +import io.prestosql.plugin.base.security.FileBasedAccessControl; +import io.prestosql.plugin.base.security.ForwardingConnectorAccessControl; +import io.prestosql.plugin.base.security.ReadOnlyAccessControl; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; + +public class SecurityConstants +{ + /** + * SqlStandardAccessControl implementation white list + */ + public static final List WHITE_LIST_SQLSTANDARDACCESSCONTROL_IMPL = Collections.unmodifiableList(new ArrayList() { + { + // for a full name of class string will cause a maven-dependency-plugin issue, we need to separate it into two string + String classPackage = "io.prestosql.security"; + String className = ".TestAccessControlManager$DenyConnectorAccessControl"; + this.add(classPackage + className); + this.add(AllowAllAccessControl.class.getName()); + this.add(ForwardingConnectorAccessControl.class.getName()); + this.add(FileBasedAccessControl.class.getName()); + this.add(LegacyAccessControl.class.getName()); + this.add(ReadOnlyAccessControl.class.getName()); + this.add(SqlStandardAccessControl.class.getName()); + this.add(SystemTableAwareAccessControl.class.getName()); + } + }); + + private SecurityConstants() + { + } +} diff --git a/presto-hive/src/main/java/io/prestosql/plugin/hive/security/SqlStandardSecurityModule.java b/presto-hive/src/main/java/io/prestosql/plugin/hive/security/SqlStandardSecurityModule.java index e946c6c32..6cf6165bc 100644 --- a/presto-hive/src/main/java/io/prestosql/plugin/hive/security/SqlStandardSecurityModule.java +++ b/presto-hive/src/main/java/io/prestosql/plugin/hive/security/SqlStandardSecurityModule.java @@ -22,6 +22,8 @@ import io.prestosql.plugin.hive.metastore.SemiTransactionalHiveMetastore; import io.prestosql.spi.PrestoException; import io.prestosql.spi.connector.ConnectorAccessControl; +import static io.prestosql.plugin.hive.security.SecurityConstants.WHITE_LIST_SQLSTANDARDACCESSCONTROL_IMPL; + public class SqlStandardSecurityModule implements Module { @@ -42,6 +44,9 @@ public class SqlStandardSecurityModule } else { try { + if (!WHITE_LIST_SQLSTANDARDACCESSCONTROL_IMPL.contains(sqlStandardAccessControlImp)) { + throw new PrestoException(HiveErrorCode.HIVE_FILE_NOT_FOUND, "Found illegal class when binding ConnectorAccessControl."); + } log.info("Binding ConnectorAccessControl.class to %s", sqlStandardAccessControlImp); binder.bind(ConnectorAccessControl.class) .to((Class) Class.forName(this.sqlStandardAccessControlImp)) diff --git a/presto-verifier/src/main/java/io/prestosql/verifier/VerifierConstants.java b/presto-verifier/src/main/java/io/prestosql/verifier/VerifierConstants.java new file mode 100644 index 000000000..6d8ab5de6 --- /dev/null +++ b/presto-verifier/src/main/java/io/prestosql/verifier/VerifierConstants.java @@ -0,0 +1,40 @@ +/* + * Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package io.prestosql.verifier; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; + +public class VerifierConstants +{ + /** + * Jdbc driver list + */ + public static final List variableJdbcList = Collections.unmodifiableList(new ArrayList() { + { + this.add("com.sap.db.jdbc.Driver"); + this.add("oracle.jdbc.driver.OracleDriver"); + this.add("com.microsoft.jdbc.sqlserver.SQLServerDriver"); + this.add("com.mysql.jdbc.Driver"); + this.add("org.postgresql.Driver"); + this.add("org.h2.Driver"); + } + }); + + private VerifierConstants() + { + } +} diff --git a/presto-verifier/src/main/java/io/prestosql/verifier/VerifyCommand.java b/presto-verifier/src/main/java/io/prestosql/verifier/VerifyCommand.java index 9eef23d2c..019ec9a05 100644 --- a/presto-verifier/src/main/java/io/prestosql/verifier/VerifyCommand.java +++ b/presto-verifier/src/main/java/io/prestosql/verifier/VerifyCommand.java @@ -83,6 +83,7 @@ import static io.prestosql.sql.parser.ParsingOptions.DecimalLiteralTreatment.AS_ import static io.prestosql.verifier.QueryType.CREATE; import static io.prestosql.verifier.QueryType.MODIFY; import static io.prestosql.verifier.QueryType.READ; +import static io.prestosql.verifier.VerifierConstants.variableJdbcList; import static java.util.concurrent.Executors.newFixedThreadPool; import static java.util.concurrent.TimeUnit.MINUTES; @@ -178,6 +179,9 @@ public class VerifyCommand private static void loadJdbcDriver(URL[] urls, String jdbcClassName) { + if (!variableJdbcList.contains(jdbcClassName)) { + throw new RuntimeException("Illegal jdbc driver name."); + } try (URLClassLoader classLoader = new URLClassLoader(urls)) { Driver driver = (Driver) Class.forName(jdbcClassName, true, classLoader).getConstructor().newInstance(); // The code calling the DriverManager to load the driver needs to be in the same class loader as the driver