[Bug] [AUTHZ] Queries with "TRANSFORM ... USING <shell-script>" must be rejected

[attilapiros]

Code of Conduct

• I agree to follow this project's Code of Conduct

Search before asking

• I have searched in the issues and found no similar issues.

Describe the bug

Spark SQL's TRANSFORM ... USING syntax (ScriptTransformation logical plan node) lets any authenticated SQL user run arbitrary OS-level commands on Spark executors. In a multi-tenant Kyuubi deployment, this is an escalation path that completely bypasses Ranger row/column/table policies.

There was no way to block it at the authz layer.

Affects Version(s)

master

Kyuubi Server Log Output

Kyuubi Engine Log Output

Kyuubi Server Configurations

Kyuubi Engine Configurations

Additional context

No response

Are you willing to submit PR?

• Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
• No. I cannot submit a PR at this time.

[github-actions]

Hello @attilapiros,
Thanks for finding the time to report the issue!
We really appreciate the community's efforts to improve Apache Kyuubi.