Examples with ViewExpression io.trino.spi.security.ViewExpression used on opensource projects

Example 6 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class TestColumnMask method testView.

@Test
public void testView() {
    // mask on the underlying table for view owner when running query as different user
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "nation"), "name", VIEW_OWNER, new ViewExpression(VIEW_OWNER, Optional.empty(), Optional.empty(), "reverse(name)"));
    assertThat(assertions.query(Session.builder(SESSION).setIdentity(Identity.forUser(RUN_AS_USER).build()).build(), "SELECT name FROM mock.default.nation_view WHERE nationkey = 1")).matches("VALUES CAST('ANITNEGRA' AS VARCHAR(25))");
    // mask on the underlying table for view owner when running as themselves
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "nation"), "name", VIEW_OWNER, new ViewExpression(VIEW_OWNER, Optional.of(CATALOG), Optional.of("tiny"), "reverse(name)"));
    assertThat(assertions.query(Session.builder(SESSION).setIdentity(Identity.forUser(VIEW_OWNER).build()).build(), "SELECT name FROM mock.default.nation_view WHERE nationkey = 1")).matches("VALUES CAST('ANITNEGRA' AS VARCHAR(25))");
    // mask on the underlying table for user running the query (different from view owner) should not be applied
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "nation"), "name", RUN_AS_USER, new ViewExpression(RUN_AS_USER, Optional.of(CATALOG), Optional.of("tiny"), "reverse(name)"));
    assertThat(assertions.query(Session.builder(SESSION).setIdentity(Identity.forUser(RUN_AS_USER).build()).build(), "SELECT name FROM mock.default.nation_view WHERE nationkey = 1")).matches("VALUES CAST('ARGENTINA' AS VARCHAR(25))");
    // mask on the view
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(MOCK_CATALOG, "default", "nation_view"), "name", USER, new ViewExpression(USER, Optional.of(CATALOG), Optional.of("tiny"), "reverse(name)"));
    assertThat(assertions.query("SELECT name FROM mock.default.nation_view WHERE nationkey = 1")).matches("VALUES CAST('ANITNEGRA' AS VARCHAR(25))");
}

Example 7 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class TestColumnMask method testRecursion.

@Test
public void testRecursion() {
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "orders"), "orderkey", USER, new ViewExpression(USER, Optional.of(CATALOG), Optional.of("tiny"), "(SELECT orderkey FROM orders)"));
    assertThatThrownBy(() -> assertions.query("SELECT orderkey FROM orders")).hasMessageMatching(".*\\QColumn mask for 'local.tiny.orders.orderkey' is recursive\\E.*");
    // different reference style to same table
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "orders"), "orderkey", USER, new ViewExpression(USER, Optional.of(CATALOG), Optional.of("tiny"), "(SELECT orderkey FROM local.tiny.orders)"));
    assertThatThrownBy(() -> assertions.query("SELECT orderkey FROM orders")).hasMessageMatching(".*\\QColumn mask for 'local.tiny.orders.orderkey' is recursive\\E.*");
    // mutual recursion
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "orders"), "orderkey", RUN_AS_USER, new ViewExpression(RUN_AS_USER, Optional.of(CATALOG), Optional.of("tiny"), "(SELECT orderkey FROM orders)"));
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "orders"), "orderkey", USER, new ViewExpression(RUN_AS_USER, Optional.of(CATALOG), Optional.of("tiny"), "(SELECT orderkey FROM orders)"));
    assertThatThrownBy(() -> assertions.query("SELECT orderkey FROM orders")).hasMessageMatching(".*\\QColumn mask for 'local.tiny.orders.orderkey' is recursive\\E.*");
}

Example 8 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class TestColumnMask method testUpdateWithColumnMasking.

@Test
public void testUpdateWithColumnMasking() {
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "orders"), "clerk", USER, new ViewExpression(USER, Optional.empty(), Optional.empty(), "clerk"));
    assertThatThrownBy(() -> assertions.query("UPDATE orders SET clerk = 'X'")).hasMessage("line 1:1: Updating a table with column masks is not supported");
    assertThatThrownBy(() -> assertions.query("UPDATE orders SET orderkey = -orderkey")).hasMessage("line 1:1: Updating a table with column masks is not supported");
    assertThatThrownBy(() -> assertions.query("UPDATE orders SET clerk = 'X', orderkey = -orderkey")).hasMessage("line 1:1: Updating a table with column masks is not supported");
}

Example 9 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class TestColumnMask method testReferenceInUsingClause.

@Test
public void testReferenceInUsingClause() {
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "orders"), "orderkey", USER, new ViewExpression(USER, Optional.empty(), Optional.empty(), "IF(orderkey = 1, -orderkey)"));
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "lineitem"), "orderkey", USER, new ViewExpression(USER, Optional.empty(), Optional.empty(), "IF(orderkey = 1, -orderkey)"));
    assertThat(assertions.query("SELECT count(*) FROM orders JOIN lineitem USING (orderkey)")).matches("VALUES BIGINT '6'");
}

Example 10 with ViewExpression

use of io.trino.spi.security.ViewExpression in project trino by trinodb.

the class TestColumnMask method testSqlInjection.

@Test
public void testSqlInjection() {
    accessControl.reset();
    accessControl.columnMask(new QualifiedObjectName(CATALOG, "tiny", "nation"), "name", USER, new ViewExpression(USER, Optional.of(CATALOG), Optional.of("tiny"), "(SELECT name FROM region WHERE regionkey = 0)"));
    assertThat(assertions.query("WITH region(regionkey, name) AS (VALUES (0, 'ASIA'))" + "SELECT name FROM nation ORDER BY name LIMIT 1")).matches(// if sql-injection would work then query would return ASIA
    "VALUES CAST('AFRICA' AS VARCHAR(25))");
}