Limit user types to the keyspace they are defined in

patch by slebresne; reviewed by iamaleksey for CASSANDRA-6643

CHANGES.txt

@@ -14,6 +14,7 @@
  * Add server side batching to native transport (CASSANDRA-5663)
  * Make batchlog replay asynchronous (CASSANDRA-6134)
  * remove unused classes (CASSANDRA-7197)
+ * Limit user types to the keyspace they are defined in (CASSANDRA-6643)
 Merged from 2.0:
  * (Hadoop) support authentication in CqlRecordReader (CASSANDRA-7221)
  * (Hadoop) Close java driver Cluster in CQLRR.close (CASSANDRA-7228)

src/java/org/apache/cassandra/cql3/CQL3Type.java

@@ -347,7 +347,6 @@ public interface CQL3Type
 
         private static class RawUT extends Raw
         {
-
             private final UTName name;
 
             private RawUT(UTName name)
@@ -357,7 +356,19 @@ public interface CQL3Type
 
             public CQL3Type prepare(String keyspace) throws InvalidRequestException
             {
-                name.setKeyspace(keyspace);
+                if (name.hasKeyspace())
+                {
+                    // The provided keyspace is the one of the current statement this is part of. If it's different from the keyspace of
+                    // the UTName, we reject since we want to limit user types to their own keyspace (see #6643)
+                    if (!keyspace.equals(name.getKeyspace()))
+                        throw new InvalidRequestException(String.format("Statement on keyspace %s cannot refer to a user type in keyspace %s; "
+                                                                        + "user types can only be used in the keyspace they are defined in",
+                                                                        keyspace, name.getKeyspace()));
+                }
+                else
+                {
+                    name.setKeyspace(keyspace);
+                }
 
                 KSMetaData ksm = Schema.instance.getKSMetaData(name.getKeyspace());
                 if (ksm == null)
@@ -374,6 +385,6 @@ public interface CQL3Type
             {
                 return name.toString();
             }
-    }
+        }
     }
 }

src/java/org/apache/cassandra/cql3/statements/CreateTypeStatement.java

@@ -50,9 +50,6 @@ public class CreateTypeStatement extends SchemaAlteringStatement
     {
         if (!name.hasKeyspace())
             name.setKeyspace(state.getKeyspace());
-
-        if (name.getKeyspace() == null)
-            throw new InvalidRequestException("You need to be logged in a keyspace or use a fully qualified user type name");
     }
 
     public void addDefinition(ColumnIdentifier name, CQL3Type.Raw type)

src/java/org/apache/cassandra/cql3/statements/DropTypeStatement.java

@@ -43,9 +43,6 @@ public class DropTypeStatement extends SchemaAlteringStatement
     {
         if (!name.hasKeyspace())
             name.setKeyspace(state.getKeyspace());
-
-        if (name.getKeyspace() == null)
-            throw new InvalidRequestException("You need to be logged in a keyspace or use a fully qualified user type name");
     }
 
     public void checkAccess(ClientState state) throws UnauthorizedException, InvalidRequestException