Skip to content

Show only denied columns in Ranger error message - #30435

Merged
kokosing merged 1 commit into
trinodb:masterfrom
takezoe:improve-ranger-select-from-columns-error-message
Jul 23, 2026
Merged

Show only denied columns in Ranger error message#30435
kokosing merged 1 commit into
trinodb:masterfrom
takezoe:improve-ranger-select-from-columns-error-message

Conversation

@takezoe

@takezoe takezoe commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Description

When selecting from columns is denied, the current error message contains all requested columns:

Cannot select from columns [id, name, time] in table or view tbl1

With this change, the error message will only contains denied columns:

Cannot select from columns [id, name] in table or view tbl1

or

Cannot select from table tbl1

if the table itself is not allowed to select.

Additional context and related issues

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
(x) Release notes are required, with the following suggested text:

## Ranger plugin
* Improve Ranger error message to only show denied columns when select from columns is not allowed ({issue}`30435`)

@takezoe
takezoe force-pushed the improve-ranger-select-from-columns-error-message branch from 970d2de to 6c31e27 Compare July 23, 2026 10:31
@ksobolew

ksobolew commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

This request comes along pretty regularly in different contexts (plugins). Maybe we should have a Trino-wide policy on that? @kokosing @wendigo

@kokosing

kokosing commented Jul 23, 2026

Copy link
Copy Markdown
Member

@ksobolew see #28602, overall it looks like it is a plugin responsibility to control the error message. We want them to be consistent, but sometimes some of them may produce better message than others.

@kokosing

kokosing commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

@takezoe please fill the PR description template and provide release notes. Ping me when you are done and will merge this PR. Thank you!

@wendigo

wendigo commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

@kokosing can we come up with a consistent set of rules related to a security in the exception messages?

@ksobolew

ksobolew commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

OK, the information leak angle is one I can get behind. But perhaps it should only happen with SELECT *, not when explicitly providing a list of columns. But perhaps this is not always obvious which is which. Anyway, that's a separate discussion.

@takezoe takezoe mentioned this pull request Jul 23, 2026
Open
@takezoe

takezoe commented Jul 23, 2026

Copy link
Copy Markdown
Member Author

@kokosing Updated the release notes section. I'm not sure which the issue number should be this PR or #28602 (as it's for OPA).

@kokosing

kokosing commented Jul 23, 2026

Copy link
Copy Markdown
Member

SELECT *, not when explicitly providing a list of columns.

@ksobolew SELECT * is a SQL thing, it gets resolved and columns are passed to access control with semantic analyser. Access control plugin should not care about what was the syntax that triggered the consumption of given columns.

@kokosing
kokosing added this pull request to the merge queue Jul 23, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 23, 2026
@kokosing
kokosing added this pull request to the merge queue Jul 23, 2026
Merged via the queue into trinodb:master with commit 3b72d66 Jul 23, 2026
22 checks passed
@github-actions github-actions Bot added this to the 484 milestone Jul 23, 2026
@takezoe
takezoe deleted the improve-ranger-select-from-columns-error-message branch July 23, 2026 22:26
@mosabua mosabua mentioned this pull request Oct 1, 2026
Closed
@martint martint mentioned this pull request Oct 9, 2026
Merged
niteshy pushed a commit to niteshy/trino that referenced this pull request Oct 29, 2026
Soubhik Chakraborty GitHub Enterprise
CDPD-111275: cherry-pick cdw-master -- Table with multiple columns, i…
0040520 
…ncase of deny only one column deny audit log added when select via * (trinodb#576)

* CDPD-111275, DATAFAB-557: Table with multiple columns, incase of deny only one column deny audit log added when select via * (trinodb#506)

* Show only denied columns in Ranger error message

pr: trinodb#30435

(cherry picked from commit 3b72d66)

* Align previous ranger2.6 single bulk request

---------

Co-authored-by: takezoe <[email protected]>
(cherry picked from commit 046a84027abe299dd57c5c6fff31192e9c63e977)

* CDPD-111275: Table with multiple columns, incase of deny only one column deny audit log added when select via * (trinodb#509)

Part-2: change addressing ConnectorAccessControl to show only denied columns in error messages while retaining list of columns audited at once.
(cherry picked from commit c97c297e5644437597c1093b293d0a61092d4f32)

* apply airstyle:format
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wendigo wendigo wendigo approved these changes
@kokosing kokosing kokosing approved these changes
@mneethiraj mneethiraj Awaiting requested review from mneethiraj
+1 more reviewer
@ksobolew ksobolew ksobolew approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

cla-signed

Milestone

484

Development

Successfully merging this pull request may close these issues.

4 participants

@takezoe @ksobolew @kokosing @wendigo