Program: 166434
Project: 166434
Buggy source:
/** 
 * Check if user has privileges to do this action on these objects
 * @param hiveOpType
 * @param inputsHObjs
 * @param outputHObjs
 * @param context
 * @throws HiveAuthzPluginException
 * @throws HiveAccessControlException
 */
@Override public void checkPrivileges(HiveOperationType hiveOpType,List<HivePrivilegeObject> inputHObjs,List<HivePrivilegeObject> outputHObjs,HiveAuthzContext context) throws HiveAuthzPluginException, HiveAccessControlException {
  UserGroupInformation ugi=getCurrentUserGroupInfo();
  if (ugi == null) {
    throw new HiveAccessControlException("String_Node_Str");
  }
  RangerHiveAuditHandler auditHandler=new RangerHiveAuditHandler();
  try {
    HiveAuthzSessionContext sessionContext=getHiveAuthzSessionContext();
    String user=ugi.getShortUserName();
    Set<String> groups=Sets.newHashSet(ugi.getGroupNames());
    if (LOG.isDebugEnabled()) {
      LOG.debug(toString(hiveOpType,inputHObjs,outputHObjs,context,sessionContext));
    }
    if (hiveOpType == HiveOperationType.DFS) {
      handleDfsCommand(hiveOpType,inputHObjs,outputHObjs,context,sessionContext,user,groups,auditHandler);
      return;
    }
    List<RangerHiveAccessRequest> requests=new ArrayList<RangerHiveAccessRequest>();
    if (inputHObjs != null) {
      for (      HivePrivilegeObject hiveObj : inputHObjs) {
        RangerHiveResource resource=getHiveResource(hiveOpType,hiveObj);
        if (resource.getObjectType() == HiveObjectType.URI) {
          String path=hiveObj.getObjectName();
          FsAction permission=FsAction.READ;
          if (!isURIAccessAllowed(user,groups,permission,path,getHiveConf())) {
            throw new HiveAccessControlException(String.format("String_Node_Str",user,permission.name(),path));
          }
          continue;
        }
        HiveAccessType accessType=getAccessType(hiveObj,hiveOpType,true);
        if (accessType == HiveAccessType.NONE) {
          continue;
        }
        if (!existsByResourceAndAccessType(requests,resource,accessType)) {
          RangerHiveAccessRequest request=new RangerHiveAccessRequest(resource,user,groups,hiveOpType,accessType,context,sessionContext);
          requests.add(request);
        }
      }
    }
    if (outputHObjs != null) {
      for (      HivePrivilegeObject hiveObj : outputHObjs) {
        RangerHiveResource resource=getHiveResource(hiveOpType,hiveObj);
        if (resource.getObjectType() == HiveObjectType.URI) {
          String path=hiveObj.getObjectName();
          FsAction permission=FsAction.WRITE;
          if (!isURIAccessAllowed(user,groups,permission,path,getHiveConf())) {
            throw new HiveAccessControlException(String.format("String_Node_Str",user,permission.name(),path));
          }
          continue;
        }
        HiveAccessType accessType=getAccessType(hiveObj,hiveOpType,false);
        if (accessType == HiveAccessType.NONE) {
          continue;
        }
        if (!existsByResourceAndAccessType(requests,resource,accessType)) {
          RangerHiveAccessRequest request=new RangerHiveAccessRequest(resource,user,groups,hiveOpType,accessType,context,sessionContext);
          requests.add(request);
        }
      }
    }
    if (isMetaDataOperation(hiveOpType)) {
      RangerHiveResource resource=getHiveResource(hiveOpType);
      RangerHiveAccessRequest request=new RangerHiveAccessRequest(resource,user,groups,context,sessionContext);
      RangerAccessResult result=hivePlugin.isAccessAllowed(request);
      if (result == null) {
        LOG.error("String_Node_Str");
        throw new HiveAccessControlException(String.format("String_Node_Str",user,hiveOpType));
      }
 else       if (!result.getIsAllowed()) {
        String path=resource.getAsString(result.getServiceDef());
        throw new HiveAccessControlException(String.format("String_Node_Str",user,hiveOpType.name(),path));
      }
 else {
        if (LOG.isDebugEnabled()) {
          LOG.debug(String.format("String_Node_Str",hiveOpType,resource,request,result));
        }
        if (result.getIsAudited()) {
          auditHandler.logAuditEventForFiltering(result,hiveOpType);
        }
      }
    }
 else {
      for (      RangerHiveAccessRequest request : requests) {
        RangerHiveResource resource=(RangerHiveResource)request.getResource();
        RangerAccessResult result=null;
        if (resource.getObjectType() == HiveObjectType.COLUMN && StringUtils.contains(resource.getColumn(),COLUMN_SEP)) {
          List<RangerAccessRequest> colRequests=new ArrayList<RangerAccessRequest>();
          String[] columns=StringUtils.split(resource.getColumn(),COLUMN_SEP);
          for (          String column : columns) {
            if (column != null) {
              column=column.trim();
            }
            if (StringUtils.isEmpty(column.trim())) {
              continue;
            }
            RangerHiveResource colResource=new RangerHiveResource(HiveObjectType.COLUMN,resource.getDatabase(),resource.getTable(),column);
            RangerHiveAccessRequest colRequest=request.copy();
            colRequest.setResource(colResource);
            colRequests.add(colRequest);
          }
          Collection<RangerAccessResult> colResults=hivePlugin.isAccessAllowed(colRequests,auditHandler);
          if (colResults != null) {
            for (            RangerAccessResult colResult : colResults) {
              result=colResult;
              if (!result.getIsAllowed()) {
                break;
              }
            }
          }
        }
 else {
          result=hivePlugin.isAccessAllowed(request,auditHandler);
        }
        if (result != null && !result.getIsAllowed()) {
          String path=resource != null ? resource.getAsString(result.getServiceDef()) : null;
          throw new HiveAccessControlException(String.format("String_Node_Str",user,request.getHiveAccessType().name(),path));
        }
      }
    }
  }
  finally {
    auditHandler.flushAudit();
  }
}

Fixed version (ground truth):
/** 
 * Check if user has privileges to do this action on these objects
 * @param hiveOpType
 * @param inputsHObjs
 * @param outputHObjs
 * @param context
 * @throws HiveAuthzPluginException
 * @throws HiveAccessControlException
 */
@Override public void checkPrivileges(HiveOperationType hiveOpType,List<HivePrivilegeObject> inputHObjs,List<HivePrivilegeObject> outputHObjs,HiveAuthzContext context) throws HiveAuthzPluginException, HiveAccessControlException {
  UserGroupInformation ugi=getCurrentUserGroupInfo();
  if (ugi == null) {
    throw new HiveAccessControlException("String_Node_Str");
  }
  RangerHiveAuditHandler auditHandler=new RangerHiveAuditHandler();
  try {
    HiveAuthzSessionContext sessionContext=getHiveAuthzSessionContext();
    String user=ugi.getShortUserName();
    Set<String> groups=Sets.newHashSet(ugi.getGroupNames());
    if (LOG.isDebugEnabled()) {
      LOG.debug(toString(hiveOpType,inputHObjs,outputHObjs,context,sessionContext));
    }
    if (hiveOpType == HiveOperationType.DFS) {
      handleDfsCommand(hiveOpType,inputHObjs,outputHObjs,context,sessionContext,user,groups,auditHandler);
      return;
    }
    List<RangerHiveAccessRequest> requests=new ArrayList<RangerHiveAccessRequest>();
    if (inputHObjs != null) {
      for (      HivePrivilegeObject hiveObj : inputHObjs) {
        RangerHiveResource resource=getHiveResource(hiveOpType,hiveObj);
        if (resource.getObjectType() == HiveObjectType.URI) {
          String path=hiveObj.getObjectName();
          FsAction permission=FsAction.READ;
          if (!isURIAccessAllowed(user,groups,permission,path,getHiveConf())) {
            throw new HiveAccessControlException(String.format("String_Node_Str",user,permission.name(),path));
          }
          continue;
        }
        HiveAccessType accessType=getAccessType(hiveObj,hiveOpType,true);
        if (accessType == HiveAccessType.NONE) {
          continue;
        }
        if (!existsByResourceAndAccessType(requests,resource,accessType)) {
          RangerHiveAccessRequest request=new RangerHiveAccessRequest(resource,user,groups,hiveOpType,accessType,context,sessionContext);
          requests.add(request);
        }
      }
    }
    if (outputHObjs != null) {
      for (      HivePrivilegeObject hiveObj : outputHObjs) {
        RangerHiveResource resource=getHiveResource(hiveOpType,hiveObj);
        if (resource.getObjectType() == HiveObjectType.URI) {
          String path=hiveObj.getObjectName();
          FsAction permission=FsAction.WRITE;
          if (!isURIAccessAllowed(user,groups,permission,path,getHiveConf())) {
            throw new HiveAccessControlException(String.format("String_Node_Str",user,permission.name(),path));
          }
          continue;
        }
        HiveAccessType accessType=getAccessType(hiveObj,hiveOpType,false);
        if (accessType == HiveAccessType.NONE) {
          continue;
        }
        if (!existsByResourceAndAccessType(requests,resource,accessType)) {
          RangerHiveAccessRequest request=new RangerHiveAccessRequest(resource,user,groups,hiveOpType,accessType,context,sessionContext);
          requests.add(request);
        }
      }
    }
    if (isMetaDataOperation(hiveOpType)) {
      RangerHiveResource resource=getHiveResource(hiveOpType);
      RangerHiveAccessRequest request=new RangerHiveAccessRequest(resource,user,groups,context,sessionContext);
      RangerAccessResult result=hivePlugin.isAccessAllowed(request);
      if (result == null) {
        LOG.error("String_Node_Str");
        throw new HiveAccessControlException(String.format("String_Node_Str",user,hiveOpType));
      }
 else       if (!result.getIsAllowed()) {
        String path=resource.getAsString(result.getServiceDef());
        throw new HiveAccessControlException(String.format("String_Node_Str",user,hiveOpType.name(),path));
      }
 else {
        if (LOG.isDebugEnabled()) {
          LOG.debug(String.format("String_Node_Str",hiveOpType,resource,request,result));
        }
        if (result.getIsAudited()) {
          auditHandler.logAuditEventForFiltering(result,hiveOpType);
        }
      }
    }
 else {
      for (      RangerHiveAccessRequest request : requests) {
        RangerHiveResource resource=(RangerHiveResource)request.getResource();
        RangerAccessResult result=null;
        if (resource.getObjectType() == HiveObjectType.COLUMN && StringUtils.contains(resource.getColumn(),COLUMN_SEP)) {
          List<RangerAccessRequest> colRequests=new ArrayList<RangerAccessRequest>();
          String[] columns=StringUtils.split(resource.getColumn(),COLUMN_SEP);
          for (          String column : columns) {
            if (column != null) {
              column=column.trim();
            }
            if (StringUtils.isEmpty(column)) {
              continue;
            }
            RangerHiveResource colResource=new RangerHiveResource(HiveObjectType.COLUMN,resource.getDatabase(),resource.getTable(),column);
            RangerHiveAccessRequest colRequest=request.copy();
            colRequest.setResource(colResource);
            colRequests.add(colRequest);
          }
          Collection<RangerAccessResult> colResults=hivePlugin.isAccessAllowed(colRequests,auditHandler);
          if (colResults != null) {
            for (            RangerAccessResult colResult : colResults) {
              result=colResult;
              if (!result.getIsAllowed()) {
                break;
              }
            }
          }
        }
 else {
          result=hivePlugin.isAccessAllowed(request,auditHandler);
        }
        if (result != null && !result.getIsAllowed()) {
          String path=resource.getAsString(result.getServiceDef());
          throw new HiveAccessControlException(String.format("String_Node_Str",user,request.getHiveAccessType().name(),path));
        }
      }
    }
  }
  finally {
    auditHandler.flushAudit();
  }
}