You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "fallintoplace (via GitHub)" <gi...@apache.org> on 2026/08/08 15:37:37 UTC
[PR] fix(flightsql): protect configured authorization metadata [arrow-go]
fallintoplace opened a new pull request, #1153:
URL: https://github.com/apache/arrow-go/pull/1153
## What
The Flight SQL credential metadata was populated with configured authentication and then overwritten by arbitrary connection parameters. A parameter named authorization could replace a configured token or basic credential. Parameters are now copied first and configured authentication is applied last.
## Test
- go test ./arrow/flight/flightsql/driver -run TestRequestMetadataKeepsConfiguredAuthorization -count=1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(flightsql): protect configured authorization metadata [arrow-go]
Posted by "zeroshade (via GitHub)" <gi...@apache.org>.
zeroshade merged PR #1153:
URL: https://github.com/apache/arrow-go/pull/1153
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(flightsql): protect configured authorization metadata [arrow-go]
Posted by "zeroshade (via GitHub)" <gi...@apache.org>.
zeroshade commented on code in PR #1153:
URL: https://github.com/apache/arrow-go/pull/1153#discussion_r3761992213
##########
arrow/flight/flightsql/driver/utils.go:
##########
@@ -37,19 +37,17 @@ type grpcCredentials struct {
func (g grpcCredentials) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
md := make(map[string]string, len(g.params)+1)
- // Authentication parameters
+ for k, v := range g.params {
Review Comment:
gRPC lowercases every key returned by `PerRPCCredentials` before sending it, so a parameter named `Authorization` remains distinct in this map but later collides with the configured lowercase `authorization`. Since both maps are iterated, either value can win. An exact-head in-memory gRPC probe reproduced this: the server received `Bearer attacker` on request 5. Please normalize parameter keys before applying configured auth, or exclude `authorization` case-insensitively, and add a mixed-case transport-level regression.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org