{"record":{"id":"99872c84afc34d04","repo":"apache/druid","slug":"task-type-s-does-not-support-input-source-base","errorCode":null,"errorMessage":"Task type [%s], does not support input source based security","messagePattern":"Task type \\[(.+?)\\], does not support input source based security","errorType":"exception","errorClass":"UOE","httpStatus":null,"severity":"error","filePath":"indexing-service/src/main/java/org/apache/druid/indexing/common/task/Task.java","lineNumber":176,"sourceCode":"  String getNodeType();\n\n  /**\n   * Returns the datasource this task operates on. Each task can operate on only one datasource.\n   */\n  String getDataSource();\n\n  /**\n   * @return The types of {@link org.apache.druid.data.input.InputSource} that the task uses. Empty set is returned if\n   * the task does not use any. Users can be given permission to access particular types of\n   * input sources but not others, using the\n   * {@link org.apache.druid.server.security.AuthConfig#enableInputSourceSecurity} config.\n   * @throws UnsupportedOperationException if the given task type does not suppoert input source based security\n   */\n  @JsonIgnore\n  @Nonnull\n  default Set<ResourceAction> getInputSourceResources() throws UOE\n  {\n    throw new UOE(StringUtils.format(\n        \"Task type [%s], does not support input source based security\",\n        getType()\n    ));\n  }\n\n  /**\n   * Returns query runners for this task. If this task is not meant to answer queries over its datasource, this method\n   * should return null.\n   *\n   * @param <T> query result type\n   *\n   * @return query runners for this task\n   */\n  <T> QueryRunner<T> getQueryRunner(Query<T> query);\n\n  /**\n   * Declares which resources provided by {@link PeonProcessingModule} this task actually needs. The default\n   * implementation has all the optional items disabled.","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/indexing-service/src/main/java/org/apache/druid/indexing/common/task/Task.java#L158-L194","documentation":"Task.getInputSourceResources is the default hook a task type implements to declare the input-source resources it needs for input-source-based security checks. The base Task interface does not support this model, so the default implementation throws UOE; only task types that explicitly override it (e.g. batch/ingestion tasks with declared inputSources) can be authorization-checked this way.","triggerScenarios":"Calling getInputSourceResources() (directly or via getNeededResourceActionsForTask) on a task type that does not override the method — e.g. non-ingestion tasks like KillTask, MarkTask, or compact tasks — while input-source-based security is enabled (druid.auth input security authorization enabled).","commonSituations":"Enabling input-source security on a cluster running task types that never implemented input source resource declaration; custom task extensions that lack the override; tests exercising resource actions for arbitrary task types.","solutions":["Disable input-source-based security, or restrict it to task types that support it (those overriding getInputSourceResources).","Implement getInputSourceResources() in the custom/task type, returning the ResourceActions for the task's declared input sources.","Route authorization for unsupported task types through the legacy resource-action path (getNeededResourceActions) instead of the input-source path."],"exampleFix":"// before\nclass MyCustomTask implements Task { /* no override */ }\n// after\n@Override\n@JsonIgnore\n@Nonnull\npublic Set<ResourceAction> getInputSourceResources() throws UOE {\n  return getInputSources().stream()\n      .flatMap(is -> is.ofType(InputResourceMapper.class).orElseThrow().toResourceActions(false).stream())\n      .collect(Collectors.toSet());\n}","handlingStrategy":"type-guard","validationCode":"if (!taskClassOverrides(task, \"getInputSourceResources\") && inputSourceSecurityEnabled) {\n  throw new IllegalArgumentException(\"Task type does not support input-source security: \" + task.getType());\n}","typeGuard":"boolean supportsInputSourceSecurity(Task t) {\n  try { t.getInputSourceResources(); return true; } catch (UnsupportedOperationException e) { return false; }\n}","tryCatchPattern":"try {\n  resourceActions.addAll(task.getInputSourceResources());\n} catch (UnsupportedOperationException e) {\n  log.warn(\"Task %s lacks input-source security support, using legacy resources\", task.getType());\n  resourceActions.addAll(task.getNeededResourceActions());\n}","preventionTips":["Only enable input-source-based security if all deployed task types override getInputSourceResources","Override getInputSourceResources in custom task implementations","Check the task's getType() against the supported list before requesting input-source resources"],"tags":["druid","security","authorization","task-framework"],"backgroundTag":"unsupported-operation","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}