...

Public Interfaces

The implementations, DirectoryConfigProvider and FileConfigProvider of the interface org.apache.kafka.common.config.provider.ConfigProvider, will be updated to introduce a configuration that limits the provider’s access exclusively to the designated file or directory path. 

...

Name: allowed.paths
Type: String
Documentation: Comma separated designated paths that this configuration provider has permission to access files from. If not set, all paths are allowed.
Default: empty

Proposed Changes

Classes DirectoryConfigProvider and FileConfigProvider that implements the ConfigProvider interface will be updated. In the `configureconfigure()` method  method of the classes, the newly added configuration will be retrieved. Their get() method will then verify whether the file it is attempting to access resides within the designated pathpaths. If the file is not within any of the designated pathpaths, ConfigException will be raised. In cases where no path is specified, the configuration providers will retain their previous unrestricted access to any file. 

Compatibility, Deprecation, and Migration Plan

There are no compatibility concerns since this update introduces a new configuration. In the absence of this configuration, the behavior behaviour remains unchanged, allowing the configuration providers to access any files, ensuring seamless compatibility.

...