You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "alamb (via GitHub)" <gi...@apache.org> on 2026/04/15 12:52:35 UTC
[PR] Alamb/security model [arrow-rs]
alamb opened a new pull request, #9730:
URL: https://github.com/apache/arrow-rs/pull/9730
# Which issue does this PR close?
<!--
We generally require a GitHub issue to be filed for all bug fixes and enhancements and this helps us generate change logs for our releases. You can link an issue to this PR using the GitHub syntax.
-->
- Closes https://github.com/apache/arrow-rs/issues/9727
# Rationale for this change
Other arrow subprojects (C++ in particular) has been beset recently by a deluge of low quality bug reports masquerading as security problems.
To reduce this flow and make it easier to direct people to the appropriate bug vs feature venue, we should document our security posture better
# What changes are included in this PR?
1. Add SECURITY.md
2. Clarify what is a bug vs a security issue
3. Sprinkle links to SECURITY around
# Are these changes tested?
By CI
# Are there any user-facing changes?
yes, new policyt
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3089273465
##########
parquet/README.md:
##########
@@ -71,13 +71,11 @@ The `parquet` crate provides the following features which may be enabled in your
[`simdutf8`]: https://crates.io/crates/simdutf8
[parquet variant]: https://github.com/apache/parquet-format/blob/master/VariantEncoding.md
-## Parquet Feature Status
Review Comment:
🤦 -- not sure -- will revert
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3121639156
##########
arrow/src/lib.rs:
##########
@@ -335,14 +335,28 @@
//! * [`parquet`](https://docs.rs/parquet) - support for [Apache Parquet]
//! * [`arrow-avro`](https://docs.rs/arrow-avro) - support for [Apache Avro]
//!
-//! # Safety and Security
+//! # Security
//!
-//! Like many crates, this crate makes use of unsafe where prudent. However, it endeavours to be
-//! sound. Specifically, **it should not be possible to trigger undefined behaviour using safe APIs.**
+//! This project follows the [Apache Arrow Security Model].
//!
-//! If you think you have found an instance where this is possible, please file
-//! a ticket in our [issue tracker] and it will be triaged and fixed. For more information on
-//! arrow's use of unsafe, see [here](https://github.com/apache/arrow-rs/tree/main/arrow#safety).
+//! Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
+//! malformed input is considered a **bug**, not a security vulnerability,
+//! unless it is **exploitable** by an attacker to
+//!
+//! * Execute arbitrary code (Remote Code Execution);
Review Comment:
I added explicit definition of what exploitable means here. I did not include a "Denial Of Service" per the discussion with @tustvold on https://github.com/apache/arrow/pull/49761/changes#r3087975701
##########
SECURITY.md:
##########
@@ -0,0 +1,49 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. Key aspects include:
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues. This implementation provides APIs to validate Arrow data. For example, [`ArrayData::validate_full`] can be used to ensure that data conforms to the Arrow specification.
+
+## Rust Safety and Undefined Behavior
Review Comment:
Done below
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#issuecomment-4252194669
FYI @scovich @Jefffrey @etseidl @tustvold @jhorstmann, and @crepererum who may be interested in commenting on this policy
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb merged PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3124214775
##########
arrow/src/lib.rs:
##########
@@ -335,14 +335,28 @@
//! * [`parquet`](https://docs.rs/parquet) - support for [Apache Parquet]
//! * [`arrow-avro`](https://docs.rs/arrow-avro) - support for [Apache Avro]
//!
-//! # Safety and Security
+//! # Security
//!
-//! Like many crates, this crate makes use of unsafe where prudent. However, it endeavours to be
-//! sound. Specifically, **it should not be possible to trigger undefined behaviour using safe APIs.**
+//! This project follows the [Apache Arrow Security Model].
//!
-//! If you think you have found an instance where this is possible, please file
-//! a ticket in our [issue tracker] and it will be triaged and fixed. For more information on
-//! arrow's use of unsafe, see [here](https://github.com/apache/arrow-rs/tree/main/arrow#safety).
+//! Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
+//! malformed input is considered a **bug**, not a security vulnerability,
+//! unless it is **exploitable** by an attacker to
+//!
+//! * Execute arbitrary code (Remote Code Execution);
+//! * Exfiltrate sensitive information from process memory (Information Disclosure);
+//!
+//! If you think you have found a security vulnerability, please follow the
+//! reporting instructions in the repository `SECURITY.md` file.
+//!
+//! # Safety
+//!
+//! Like many crates, this crate makes use of `unsafe` where prudent. However, it endeavors to be
+//! sound. Specifically, **it should not be possible to trigger undefined behavior using safe APIs.**
+//!
+//! For more information on the use of unsafe, see [here](https://github.com/apache/arrow-rs/tree/main/arrow#safety).
Review Comment:
I added more explanation to SECURITY.md and left links to there
##########
SECURITY.md:
##########
@@ -0,0 +1,83 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. In particular:
+
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues.
+
+This implementation provides APIs such as [`ArrayData::validate_full`] to
+validate that Arrow data conforms to the specification.
+
+Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
+malformed input is generally considered a **bug**, not a security
+vulnerability, unless it is **exploitable** and could allow an attacker to
+
+* Execute arbitrary code (Remote Code Execution);
+* Exfiltrate sensitive information from process memory (Information Disclosure);
+
+If that exploitation path is unclear, the issue should likely be reported as a
+bug.
+
+## Rust Safety, Soundness, and Undefined Behavior
Review Comment:
I added this section to try and help define that not all soundness issues are vulnerabilities. I think it makes our current practice explicit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3114388435
##########
SECURITY.md:
##########
@@ -0,0 +1,49 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. Key aspects include:
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues. This implementation provides APIs to validate Arrow data. For example, [`ArrayData::validate_full`] can be used to ensure that data conforms to the Arrow specification.
+
+## Rust Safety and Undefined Behavior
Review Comment:
I am not sure how long https://github.com/apache/arrow/pull/49761 will take so I am going to inline it here
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "etseidl (via GitHub)" <gi...@apache.org>.
etseidl commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3088648387
##########
parquet/README.md:
##########
@@ -71,13 +71,11 @@ The `parquet` crate provides the following features which may be enabled in your
[`simdutf8`]: https://crates.io/crates/simdutf8
[parquet variant]: https://github.com/apache/parquet-format/blob/master/VariantEncoding.md
-## Parquet Feature Status
Review Comment:
Why is this section removed?
##########
arrow/src/lib.rs:
##########
@@ -335,14 +335,24 @@
//! * [`parquet`](https://docs.rs/parquet) - support for [Apache Parquet]
//! * [`arrow-avro`](https://docs.rs/arrow-avro) - support for [Apache Avro]
//!
-//! # Safety and Security
+//! # Security
//!
-//! Like many crates, this crate makes use of unsafe where prudent. However, it endeavours to be
-//! sound. Specifically, **it should not be possible to trigger undefined behaviour using safe APIs.**
+//! This project follows the [Apache Arrow Security Model]. Any exploitable
+//! instance of undefined behavior using `safe` APIs and has a clear explanation
Review Comment:
```suggestion
//! instance of undefined behavior using `safe` APIs and having a clear explanation
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3133346608
##########
SECURITY.md:
##########
@@ -0,0 +1,83 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. In particular:
+
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues.
+
+This implementation provides APIs such as [`ArrayData::validate_full`] to
Review Comment:
Yes I think any gap in this validation would be a bug. If such a gap that allowed malformed data to be read without error and exposed RCE or information, I would think we should treat it like any other security vulnerability.
Following the same critera for security evaluation , it would only be a security *vulnerability* if it allows an attacker RCE / information disclosure
##########
SECURITY.md:
##########
@@ -0,0 +1,83 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. In particular:
+
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues.
+
+This implementation provides APIs such as [`ArrayData::validate_full`] to
+validate that Arrow data conforms to the specification.
+
+Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
+malformed input is generally considered a **bug**, not a security
+vulnerability, unless it is **exploitable** and could allow an attacker to
+
+* Execute arbitrary code (Remote Code Execution);
Review Comment:
Thankfully (?) I am not aware of any such bugs in arrow-rs so I don't have any to find
I had codex find past examples, and the ones it found are as follows, which are mostly old undefined behavior issues
- https://github.com/apache/arrow-rs/issues/198
- https://github.com/apache/arrow-rs/issues/322
- https://github.com/apache/arrow-rs/issues/772
- https://github.com/apache/arrow-rs/issues/773
- https://github.com/apache/arrow-rs/issues/776
- https://github.com/apache/arrow-rs/issues/786
- https://github.com/apache/arrow-rs/issues/817
- https://github.com/apache/arrow-rs/issues/221
- https://github.com/apache/arrow-rs/issues/1874
- https://github.com/apache/arrow-rs/issues/1486
- https://github.com/apache/arrow-rs/issues/1231
- https://github.com/apache/arrow-rs/issues/1144
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "tustvold (via GitHub)" <gi...@apache.org>.
tustvold commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3087955613
##########
SECURITY.md:
##########
@@ -0,0 +1,49 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. Key aspects include:
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues. This implementation provides APIs to validate Arrow data. For example, [`ArrayData::validate_full`] can be used to ensure that data conforms to the Arrow specification.
+
+## Rust Safety and Undefined Behavior
Review Comment:
I think we should define what exploitable means, as it is so important to this section.
Perhaps inline whatever gets merged from https://github.com/apache/arrow/pull/49761/changes or at least link to it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "wjones127 (via GitHub)" <gi...@apache.org>.
wjones127 commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3128841095
##########
SECURITY.md:
##########
@@ -0,0 +1,83 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. In particular:
+
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues.
+
+This implementation provides APIs such as [`ArrayData::validate_full`] to
+validate that Arrow data conforms to the specification.
+
+Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
+malformed input is generally considered a **bug**, not a security
+vulnerability, unless it is **exploitable** and could allow an attacker to
+
+* Execute arbitrary code (Remote Code Execution);
Review Comment:
It might be nice to give an example of past bugs that indicate each, if there are any.
##########
SECURITY.md:
##########
@@ -0,0 +1,83 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. In particular:
+
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues.
+
+This implementation provides APIs such as [`ArrayData::validate_full`] to
Review Comment:
Is a gap in these kinds of methods a security issue then?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#issuecomment-4254490166
> The doc and associated link sprinkling seem very reasonable and welcome,
❤️
> but I don't think I understand how this will "reduce the flow" of "a deluge of low quality bug reports masquerading as security problems" ?
>
> Or does it just make it easier to summarily close them because they don't follow the official guidelines?
Yes, basically having this documented means that upstream filters (aka the apache security team) can point to these guidelines if they get reports that are bugs. At the moment in Arrow sometimes it is not clear which crash is a security issue and which is just a bug
> I think we should define what exploitable means, as it is so important to this section.
Yes that is an excellent idea and I will do so
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "tustvold (via GitHub)" <gi...@apache.org>.
tustvold commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3123155733
##########
arrow/src/lib.rs:
##########
@@ -335,14 +335,28 @@
//! * [`parquet`](https://docs.rs/parquet) - support for [Apache Parquet]
//! * [`arrow-avro`](https://docs.rs/arrow-avro) - support for [Apache Avro]
//!
-//! # Safety and Security
+//! # Security
//!
-//! Like many crates, this crate makes use of unsafe where prudent. However, it endeavours to be
-//! sound. Specifically, **it should not be possible to trigger undefined behaviour using safe APIs.**
+//! This project follows the [Apache Arrow Security Model].
//!
-//! If you think you have found an instance where this is possible, please file
-//! a ticket in our [issue tracker] and it will be triaged and fixed. For more information on
-//! arrow's use of unsafe, see [here](https://github.com/apache/arrow-rs/tree/main/arrow#safety).
+//! Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
+//! malformed input is considered a **bug**, not a security vulnerability,
+//! unless it is **exploitable** by an attacker to
+//!
+//! * Execute arbitrary code (Remote Code Execution);
+//! * Exfiltrate sensitive information from process memory (Information Disclosure);
+//!
+//! If you think you have found a security vulnerability, please follow the
+//! reporting instructions in the repository `SECURITY.md` file.
+//!
+//! # Safety
+//!
+//! Like many crates, this crate makes use of `unsafe` where prudent. However, it endeavors to be
+//! sound. Specifically, **it should not be possible to trigger undefined behavior using safe APIs.**
+//!
+//! For more information on the use of unsafe, see [here](https://github.com/apache/arrow-rs/tree/main/arrow#safety).
Review Comment:
Should a soundness issue be considered a security issue or not? I mainly ask as whilst we want to encourage reporting of soundness issues, they aren't in and of themselves exploitable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3123951047
##########
arrow/src/lib.rs:
##########
@@ -335,14 +335,28 @@
//! * [`parquet`](https://docs.rs/parquet) - support for [Apache Parquet]
//! * [`arrow-avro`](https://docs.rs/arrow-avro) - support for [Apache Avro]
//!
-//! # Safety and Security
+//! # Security
//!
-//! Like many crates, this crate makes use of unsafe where prudent. However, it endeavours to be
-//! sound. Specifically, **it should not be possible to trigger undefined behaviour using safe APIs.**
+//! This project follows the [Apache Arrow Security Model].
//!
-//! If you think you have found an instance where this is possible, please file
-//! a ticket in our [issue tracker] and it will be triaged and fixed. For more information on
-//! arrow's use of unsafe, see [here](https://github.com/apache/arrow-rs/tree/main/arrow#safety).
+//! Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
+//! malformed input is considered a **bug**, not a security vulnerability,
+//! unless it is **exploitable** by an attacker to
+//!
+//! * Execute arbitrary code (Remote Code Execution);
+//! * Exfiltrate sensitive information from process memory (Information Disclosure);
+//!
+//! If you think you have found a security vulnerability, please follow the
+//! reporting instructions in the repository `SECURITY.md` file.
+//!
+//! # Safety
+//!
+//! Like many crates, this crate makes use of `unsafe` where prudent. However, it endeavors to be
+//! sound. Specifically, **it should not be possible to trigger undefined behavior using safe APIs.**
+//!
+//! For more information on the use of unsafe, see [here](https://github.com/apache/arrow-rs/tree/main/arrow#safety).
Review Comment:
I suggest we treat them as a security "issue" but not treated as a security **vulnerability** that requires special reporting / alerting unless there is some evidence it can actually be exploited
I tried to clarify this in the "security" part of arrow/README
> Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
> malformed input, and instances of undefined behavior (UB) triggered via safe
> APIs are considered bugs rather than security vulnerabilities unless they are exploitable
> by an attacker to
I do agree this leaves some interpretation about what "exploitable by an attacker" really means but I think some level of interpretation is unavoidable for undefined behavior in principle (as it is undefined)
I will add a note to the safety section referring to the security section to make this explicit
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#issuecomment-4316835465
Ok, I think this is looking good enough to me, so merging it in and we can iterate on it going forward. Thank you all
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document Security Policy [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #9730:
URL: https://github.com/apache/arrow-rs/pull/9730#discussion_r3133330989
##########
SECURITY.md:
##########
@@ -0,0 +1,83 @@
+<!---
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+
+# Security Policy
+
+This document outlines the security model for the Rust implementation of Apache Arrow (`arrow-rs`) and how to report vulnerabilities.
+
+## Security Model
+
+The `arrow-rs` project follows the [Apache Arrow Security Model]. In particular:
+
+- Reading data from untrusted sources (e.g., over a network or from a file) requires explicit validation.
+- Failure to validate untrusted data before use may lead to security issues.
+
+This implementation provides APIs such as [`ArrayData::validate_full`] to
+validate that Arrow data conforms to the specification.
+
+Unexpected behavior (e.g., panics, crashes, or infinite loops) triggered by
+malformed input is generally considered a **bug**, not a security
+vulnerability, unless it is **exploitable** and could allow an attacker to
+
+* Execute arbitrary code (Remote Code Execution);
Review Comment:
Thankfully (?) I am not aware of any such bugs in arrow-rs so I don't have any to list
I had codex find past examples, and the ones it found are as follows, which are mostly old undefined behavior issues
- https://github.com/apache/arrow-rs/issues/198
- https://github.com/apache/arrow-rs/issues/322
- https://github.com/apache/arrow-rs/issues/772
- https://github.com/apache/arrow-rs/issues/773
- https://github.com/apache/arrow-rs/issues/776
- https://github.com/apache/arrow-rs/issues/786
- https://github.com/apache/arrow-rs/issues/817
- https://github.com/apache/arrow-rs/issues/221
- https://github.com/apache/arrow-rs/issues/1874
- https://github.com/apache/arrow-rs/issues/1486
- https://github.com/apache/arrow-rs/issues/1231
- https://github.com/apache/arrow-rs/issues/1144
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org