Package org.gridgain.internal.sql.copy.security

Class LocationGuard

java.lang.Object
org.gridgain.internal.sql.copy.security.LocationGuard
public class LocationGuard extends Object
Enforces the node-local security policy for the file / object-store side of SQL COPY.

All rejections throw PropertyValidationException, which CopyHandlerModuleImpl maps to a SqlException(STMT_VALIDATION_ERR). The guard is built from a per-statement configuration snapshot (see CopyFileAccessConfig) so configuration changes take effect without a restart.

  • Constructor Summary

    Constructors
    Constructor
    Description
    LocationGuard(org.apache.ignite.internal.sql.engine.exec.query.CopyFileAccessConfig config)
    Constructor.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    checkAllowedClass(@Nullable String className)
    Validates that a reflectively-loaded class name is allow-listed (no-op when null/blank).
    void
    checkCatalogClass(@Nullable String impl)
    Validates that an Iceberg reflectively-loaded class name (catalog-impl, io-impl, client.factory) is allow-listed.
    void
    checkCatalogUri(@Nullable String uri)
    Validates a user-supplied Iceberg catalog URI (REST / Nessie / JDBC-with-host) against the allow-list.
    Path
    checkMatchedFile(Path file)
    Re-checks a file produced by a directory walk: its real path (following any symlink) must stay inside a root.
    void
    checkS3Access(@Nullable String endpoint, boolean hasExplicitKeys)
    Validates a user-supplied S3 endpoint override and the credential mode.
    void
    checkS3Location(String s3Uri)
    Confines an S3 object-store location to the configured bucket allow-list.
    void
    checkWarehouse(@Nullable String warehouse)
    Confines an Iceberg warehouse: S3 warehouses go through the bucket allow-list, local ones through the import roots.
    int
    maxGlobDepth()
     
    int
    maxGlobFiles()
     
    void
    requireFileAccessEnabled()
    Fails when the file/object-store side of COPY is disabled on this node.
    Path
    resolveReadPath(String userPath)
    Canonicalizes a local source path and confirms it resolves inside a configured import root.
    Path
    resolveWritePath(String userPath)
    Canonicalizes a local target path (which need not exist yet) and confirms its parent directory resolves inside a configured import root.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • LocationGuard

      public LocationGuard(org.apache.ignite.internal.sql.engine.exec.query.CopyFileAccessConfig config)
      Constructor.

  • Method Details

    • requireFileAccessEnabled

      public void requireFileAccessEnabled()
      Fails when the file/object-store side of COPY is disabled on this node.

    • resolveReadPath

      public Path resolveReadPath(String userPath)
      Canonicalizes a local source path and confirms it resolves inside a configured import root.
      Parameters:
      userPath - Raw path from the COPY statement.
      Returns:
      The canonical (symlink-resolved) real path.

    • resolveWritePath

      public Path resolveWritePath(String userPath)
      Canonicalizes a local target path (which need not exist yet) and confirms its parent directory resolves inside a configured import root. The leaf itself must not already be a symbolic link, otherwise a pre-planted (possibly dangling) link inside a root could redirect the write outside it.
      Parameters:
      userPath - Raw target path from the COPY statement.
      Returns:
      The absolute target path with a canonicalized parent.

    • checkMatchedFile

      public Path checkMatchedFile(Path file)
      Re-checks a file produced by a directory walk: its real path (following any symlink) must stay inside a root.
      Returns:
      The canonical (symlink-resolved) real path, so the reader opens the confined path rather than the original walk entry (matching the single-file read branch).

    • checkS3Location

      public void checkS3Location(String s3Uri)
      Confines an S3 object-store location to the configured bucket allow-list. Entries are matched as either a bucket name or a bucket/key-prefix. Empty allow-list forbids all S3 COPY.
      Parameters:
      s3Uri - The s3://bucket/key (or s3a://) location from the COPY statement.

    • checkS3Access

      public void checkS3Access(@Nullable @Nullable String endpoint, boolean hasExplicitKeys)
      Validates a user-supplied S3 endpoint override and the credential mode.
      Parameters:
      endpoint - The user-supplied endpoint override, or null/blank when none is set.
      hasExplicitKeys - Whether explicit access/secret keys were supplied in the SAME namespace as the endpoint (the caller must pair them per namespace — see IcebergUtils / S3ClientFactory).

    • checkCatalogClass

      public void checkCatalogClass(@Nullable @Nullable String impl)
      Validates that an Iceberg reflectively-loaded class name (catalog-impl, io-impl, client.factory) is allow-listed.

    • checkAllowedClass

      public void checkAllowedClass(@Nullable @Nullable String className)
      Validates that a reflectively-loaded class name is allow-listed (no-op when null/blank).

    • checkCatalogUri

      public void checkCatalogUri(@Nullable @Nullable String uri)
      Validates a user-supplied Iceberg catalog URI (REST / Nessie / JDBC-with-host) against the allow-list. A URI with a resolvable network host must be allow-listed and is link-local-blocked; a truly host-less opaque URI (e.g. jdbc:h2:mem:...) is not a network SSRF target and is left alone.

    • checkWarehouse

      public void checkWarehouse(@Nullable @Nullable String warehouse)
      Confines an Iceberg warehouse: S3 warehouses go through the bucket allow-list, local ones through the import roots. Other schemes (e.g. a Hive metastore thrift URI) are not filesystem locations and are left to the catalog-URI / class allow-lists.

    • maxGlobDepth

      public int maxGlobDepth()

    • maxGlobFiles

      public int maxGlobFiles()