[OIiveirra]

What problem does this PR solve?

Issue Number: N/A

Related PR: #69526

Problem Summary: Glob results were not anchored to the canonical secure directory. Require explicit startup opt-in and enforce canonical path containment even when local TVF use is enabled.

Summary

LOCAL TVF and FILE TVF with local storage → startup opt-in → ADMIN/OPERATOR → canonical secure-root validation → reader

• Keep the startup-only enable_local_tvf=false gate before parameter parsing, backend selection and file access.

• Resolve both the secure root and every glob result to canonical paths, then check component containment. Reject an empty secure root and local-path requests with remote schemes.

• Enforce ADMIN/OPERATOR before local file access and again during privilege checking.

• Keep target-validation errors free of wildcard-expanded or resolved target names, including dangling symlinks.

Dedicated regression deployments explicitly opt in to retain LOCAL coverage.

Release note

LOCAL TVF and FILE TVF with local storage is disabled by default. To enable it, set enable_local_tvf=true in fe.conf on every query-serving FE and restart those FEs. The setting is not runtime-mutable. Enabled local reads require ADMIN/OPERATOR and remain restricted to user_files_secure_path.

Target-validation errors no longer include expanded or resolved target filenames.

Evidence

• Before: Local reads could proceed without startup opt-in, and canonical glob results were not checked against a nonempty secure root.

• After: Disabled calls stop before file-service interaction; enabled calls apply authorization and canonical containment.

• 10 focused FE tests passed with no failures or skips.

• 4 focused BE tests passed with no failures or skips. The BE run used the supported Clang16 ASAN profile.

• Changed C++ lines pass clang-format 16; relevant Java Checkstyle passes.

• SQL regression coverage is included; the full Groovy regression runner and a live remote S3 Lance read were not run locally.

• Supplemental redaction assertions cover outside wildcard matches and dangling symlinks. The 4 focused BE tests were rerun and passed with no failures or skips.

Check List (For Author)

• Test: focused unit tests and static checks as reported above.
• Behavior changed: Yes. Explicit startup opt-in, local authorization and secure-directory containment.
• Documentation: the release note above describes the configuration and behavior change.

Merge Danger

Door: Two-way through configuration and a binary rollback; opt-in retains the new path restrictions.

Blast Radius: LOCAL TVF and FILE TVF with local storage consumers. Existing deployments must explicitly opt in, and paths outside the configured secure directory will be rejected.

Check List (For Reviewer who merge this PR)

• Confirm the release note
• Confirm test cases
• Confirm document
• Add branch pick label

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.