{"record":{"id":"2a5fde969d8018a3","repo":"apache/druid","slug":"this-inputsource-does-not-support-input-source-bas","errorCode":null,"errorMessage":"This inputSource does not support input source based security","messagePattern":"This inputSource does not support input source based security","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"processing/src/main/java/org/apache/druid/data/input/InputSource.java","lineNumber":113,"sourceCode":"   * @param inputFormat        to parse data. It can be null if {@link #needsFormat()} = true\n   * @param temporaryDirectory to store temp data. It will be cleaned up automatically once the task is finished.\n   */\n  InputSourceReader reader(\n      InputRowSchema inputRowSchema,\n      @Nullable InputFormat inputFormat,\n      File temporaryDirectory\n  );\n\n  /**\n   * The types of input sources uses. A set is returned here, as some InputSource implementation allow for\n   * combining of multiple input sources.\n   * @return The types of input sources uses\n   */\n  @JsonIgnore\n  @Nonnull\n  default Set<String> getTypes()\n  {\n    throw new UOE(\"This inputSource does not support input source based security\");\n  }\n}\n","sourceCodeStart":95,"sourceCodeEnd":116,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/processing/src/main/java/org/apache/druid/data/input/InputSource.java#L95-L116","documentation":"InputSource.getTypes is a default interface method that input-source implementations are supposed to override to declare their type names, used by input-source-based security (resource action mapping). The default body throws UnsupportedOperationException, so invoking it on an InputSource that has not implemented the method means the source does not participate in input-source security checks.","triggerScenarios":"Calling computeResources (InputSource#computeResources path) or otherwise invoking getTypes() on a custom or third-party InputSource that does not override getTypes(), typically during authorization of a query/ingestion with input-source-based security enabled.","commonSituations":"Custom extension InputSources written against older Druid APIs (before getTypes was added for input-source security) used with newer Druid with druid.auth.resourceActions enabled; built-in sources in old versions lacking the override.","solutions":["Override getTypes() in the custom InputSource to return its type names (e.g. Collections.singleton(\"http\")).","Upgrade the extension providing the InputSource to a version that supports input-source based security.","Disable input-source based authorization (druid.auth.resourceActions) if it is not needed, so getTypes is not consulted.","Wrap/replace the unsupported source with a built-in InputSource that implements getTypes()."],"exampleFix":"// before\nclass MyInputSource implements InputSource { /* no getTypes override */ }\n// after\nclass MyInputSource implements InputSource {\n  @Override\n  @Nonnull\n  public Set<String> getTypes() {\n    return Collections.singleton(\"my\");\n  }\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"boolean supported;\ntry { source.getTypes(); supported = true; } catch (UOE e) { supported = false; }","tryCatchPattern":"try {\n  resources = source.computeResources(dataSource);\n} catch (UnsupportedOperationException e) {\n  log.warn(\"InputSource %s does not support input-source security; falling back to datasource-level auth\", source.getClass().getName());\n  resources = Collections.singletonList(new ResourceAction(new Resource(dataSource, ResourceType.DATASOURCE), Action.READ));\n}","preventionTips":["Override getTypes() in every custom InputSource","Keep extensions updated to the Druid version in use","Verify authorization config (druid.auth.resourceActions) against the installed input sources before rollout"],"tags":["security","input-source","authorization"],"backgroundTag":"method-not-implemented","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}