Repository navigation
Conversation
…r-uri Introduce rest.client-only-properties, an opt-in mechanism that lets clients prevent server-provided defaults/overrides from affecting specified configuration keys. Keys listed in this property are resolved from client configuration only. When oauth2-server-uri appears in the list: - Server-provided values for it are ignored during config merge - The endpoint is resolved to an absolute URL using the client's uri before merging, preventing indirect override via uri changes - InitSession and CatalogSession now use consistent endpoints This addresses the risk of OAuth2 credentials being sent to an unintended endpoint when a REST catalog server overrides oauth2-server-uri or uri. The protection is opt-in to maintain backward compatibility and align with REST spec defaults. Changes: - Add RestCatalogProperties::kClientOnlyProperties - Export auth::ResolveOAuth2ServerUri for reuse - Add MergeServerConfig() and ParseClientOnlyProperties() in rest_util - Replace MergeConfigs with MergeServerConfig in RestCatalog::Make - Warn when oauth2-server-uri is neither explicit nor protected while using credential auth (following Java's warnIfOAuthServerUriNotSet) - Add unit tests covering direct/indirect override scenarios Default behavior unchanged: without setting rest.client-only-properties, server overrides apply as before, consistent with Java and Rust clients. Co-Authored-By: Claude <noreply@anthropic.com>
- Construct string_view from an iterator pair; MSVC string_view iterators are not pointers. - Parenthesize std::min in StringUtils so the Windows min() macro pulled in through cpr does not expand there.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…r-uri
Introduce rest.client-only-properties, an opt-in mechanism that lets clients prevent server-provided defaults/overrides from affecting specified configuration keys. Keys listed in this property are resolved from client configuration only.
When oauth2-server-uri appears in the list:
This addresses the risk of OAuth2 credentials being sent to an unintended endpoint when a REST catalog server overrides oauth2-server-uri or uri. The protection is opt-in to maintain backward compatibility and align with REST spec defaults.
Changes:
Default behavior unchanged: without setting rest.client-only-properties, server overrides apply as before, consistent with Java and Rust clients.