Behavioral changes for Cloudera Runtime 7.1.9 SP2 cumulative hotfix (CHF) 6 introduce
functional adjustments to Cloudera Runtime components.
Hive
- Avro tables no longer fetch schema files over HTTP or HTTPS by default
- Hive restricted how the Avro SerDe resolves table schemas from the avro.schema.url table property, to prevent server-side request forgery.
- Previous behavior:
- When avro.schema.url was not a Hadoop file system URI, Hive fetched the schema from any URL, including
http://, https://, and file:// locations, using the identity of the HiveServer2, Metastore, or Tez or MapReduce worker process. No scheme or host validation was performed, and no authorization check was made on the schema location, so a user could point an external Avro table at an arbitrary internal or cloud metadata endpoint and have the server fetch it on the user's behalf.
- New behavior:
- Hive now validates the scheme of avro.schema.url before fetching it. Schema-less URIs and configured file system schemes, such as
hdfs, s3a, and abfs, continue to be allowed, and are controlled by the new hive.avro.schema.url.allowed.schemes property. The file:// and ftp:// schemes are always blocked. HTTP and HTTPS schema URLs are blocked by default. To restore the previous behavior for HTTP and HTTPS, set hive.avro.schema.url.remote.http.enabled to true and add the permitted hosts to hive.avro.schema.url.http.allowed.hosts. Hive also now enforces DFS URI authorization on file system schema paths at both DDL time and query time, including for tables created before this fix.
Apache Jira: HIVE-29671
