forge lake query switches file access off except for the lake's data, but allowed only a local data directory, so a lake on S3 or R2 could count rows from the catalog and failed on anything that read a Parquet file. The data path is allowed whatever it is now. An endpoint given as http:// is used without TLS, which a local S3 server needs; tried with rclone serve s3 in the container, offline.
- commit
- 16632cfd6b4eb48a4aa5b1fa088b0188c378bd67
- parent
- ee68744ca6d346e384a1427a2ceadaae8abaa74e
- author
- cat <admin@dev.site>
- kind
- fix risk score 2.0 of 3, Jev's estimate
| M | lib/ | 4 | +++- |
@@ -181,6 +181,8 @@ export class Lake {
181181 const endpoint = (env.FORGE_LAKE_ENDPOINT || '').replace(/^https?:\/\//, '').replace(/\/$/, '');182182 const parts = [`TYPE s3`, `KEY_ID ${lit(key)}`, `SECRET ${lit(secret)}`, `REGION ${lit(env.FORGE_LAKE_REGION || 'auto')}`];183183 if (endpoint) parts.push(`ENDPOINT ${lit(endpoint)}`, `URL_STYLE 'path'`);184+ // A plain-HTTP endpoint (a local S3 server, say).185+ if (/^http:\/\//.test(env.FORGE_LAKE_ENDPOINT || '')) parts.push('USE_SSL false');184186 await this.run(`CREATE SECRET lake_data (${parts.join(', ')})`);185187 }186188 @@ -382,7 +384,7 @@ export async function query(cfg: LakeConfig, sql: string, format: 'table' | 'jso
382384 const lake = await Lake.open(cfg, { write: false });383385 try {384386 await lake.run('USE lake');385- if (cfg.local) await lake.run(`SET allowed_directories = [${lit(cfg.data)}]`);387+ await lake.run(`SET allowed_directories = [${lit(cfg.data)}]`);386388 await lake.run('SET enable_external_access = false');387389 await lake.run('SET lock_configuration = true');388390 const stmts = await lake.conn.extractStatements(sql);