apache / pinot

Apache Pinot - A realtime distributed OLAP datastore
https://pinot.apache.org/
Apache License 2.0
5.26k stars 1.23k forks source link

Disable query-level Groovy function by default #7966

Closed npawar closed 2 years ago

npawar commented 2 years ago

In Pinot you can write a Groovy script as part of your query: https://docs.pinot.apache.org/users/user-guide-query/scalar-functions#groovy-scripts. This is a security risk, and we should disable this by default. cc @mayankshriv

amrishlal commented 2 years ago

We had some discussion on this earlier too: https://github.com/apache/pinot/issues/7310. I would agree that groovy functions should be disabled by default :-)

egalpin commented 2 years ago

+1

timsants commented 2 years ago

PR for adding config for disabling groovy in queries: https://github.com/apache/pinot/pull/8159

snleee commented 2 years ago

Adding table config overrides for disabling groovy #8196