[Bug] [AUTHZ] masked column cannot be used as a filter condition

[jersy]

Code of Conduct

• I agree to follow this project's Code of Conduct

Search before asking

• I have searched in the issues and found no similar issues.

Describe the bug

There is a table named test_student_02, which contains data of students who are around 18 years old. The "age" column has been hashed for data masking. When using the following SQL query, no data can be retrieved.

var ds4 = spark.sql("select * from user02db.test_student_02 where age > 18");
ds4.explain(true);

'Project [*]
+- 'Filter ('age > 18)
   +- 'UnresolvedRelation `user02db`.`test_student_02`

== Analyzed Logical Plan ==
id: int, name: string, sex: boolean, age: string, department: string
Project [id#18, name#19, sex#23, age#24, department#22]
+- Filter (cast(age#24 as int) > 18)
   +- SubqueryAlias `user02db`.`test_student_02`
      +- Filter (department#22 = IS)
         +- RowFilterMarker
            +- DataMaskingStage0Marker HiveTableRelation `user02db`.`test_student_02`, org.apache.hadoop.hive.ql.io.orc.OrcSerde, [id#18, name#19, sex#20, age#21, department#22]
               +- Project [id#18, name#19, (0 = 0) AS sex#23, md5(cast(cast(age#21 as string) as binary)) AS age#24, department#22]
                  +- Relation[id#18,name#19,sex#20,age#21,department#22] orc

== Optimized Logical Plan ==
Project [id#18, name#19, true AS sex#23, md5(cast(cast(age#21 as string) as binary)) AS age#24, department#22]
+- Filter ((isnotnull(department#22) && (department#22 = IS)) && (cast(md5(cast(cast(age#21 as string) as binary)) as int) > 18))
   +- Relation[id#18,name#19,sex#20,age#21,department#22] orc

Affects Version(s)

master

Kyuubi Server Log Output

No response

Kyuubi Engine Log Output

No response

Kyuubi Server Configurations

No response

Kyuubi Engine Configurations

No response

Additional context

No response

Are you willing to submit PR?

• Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
• No. I cannot submit a PR at this time.

[github-actions]

Hello @jersy,
Thanks for finding the time to report the issue!
We really appreciate the community's efforts to improve Apache Kyuubi.

[packyan]

This should be an expected behavior. If the user's condition is age=18, then the user can know which students are exactly 18 years old, which is unreasonable for data security.

[jersy]

@packyan You didn't really understand what I meant. test_student_02 contains data of students who are over 18 years old. Therefore, regardless of whether or not the 'age' column has been masked, the first step should be to query this data. Secondly, if there is masking, it should be applied to the 'age' column in the query results.

你没有真正理解我表达的意思。 test_student_02包含了“age”大于18岁的数据，所以无论有没有在“age”上进行脱敏，首先应该是要查询出来这些数据的，其次， 如果有脱敏的话，是在查询的结果集上再对“age”进行脱敏。

[jersy]

(cast(md5(cast(cast(age#21 as string) as binary)) as int) > 18) in the Optimized Logical Plan is completely wrong now. Its current meaning is to compare the result of the 'age' column after applying the MD5 function with the value 18.

[jersy]

@yaooqinn Could you please take a look at this,thx.

[yaooqinn]

As @packyan explained, it's by design.

The data is masked on the leaf scan. A user can not do a filter operation on a column if the admin has set a masker on it for him/her.