You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cassandra.apache.org by Courtney Robinson <sa...@live.co.uk> on 2011/03/29 11:34:21 UTC
PHP Cassandra CQL driver
Okay, Dave Gardner, Nick Telford and myself met at the London Cassandra meetup.
We were keen on getting a PHP CQL driver done and decided to use github while working on it.
This mail is mainly to raise awareness of this as well as to ask a few questions and throw a few things
out there that came up.
These are in no particular order and are just how I remember them.
Firstly, has it already been taken into consideration that CQL implicitly means injections may become a problem?
Secondly and this wasn’t so much of a problem but more of a suggestion. While going through the Java and Python
versions, there was a significant lack of docs. I think at the moment that’s because Eric Evans may be the only one
moulding CQL together but if we’re going to get many drivers done It will help other Devs and not scare off potential
devs. who aren’t close or overly familiar with Cassandra’s internals.
For Devs interested in contributing to the PHP Cassandra (PHPCad) driver, its on github @ https://github.com/zcourts/PHPCad
We also wondered about actually making this an “official” driver. Once it is in a stable state, do we just let Eric or one of the other committers know or is there a particularly long winded process that has to be followed?
The code on Github at the moment is a reversed engineered version of the Java impl. in PHP. I think we’ve agreed that its too “JDBC” like with a lot of methods etc that aren’t necessary/needed so Dave has written up some classes and interfaces off the Python version so we’ll be changing the base code to those as soon as he gets some time.
I’m sure there were other things, possibly more important that I’ve forgotten since the meetup but they’ll come to light in due time. Again, the driving force behind this at the moment seems to need more man power, we’d like to get a bit more momentum behind it and kick off drivers in a few other languages. Anyone wishing to contrib. should get it out there.
For ref, a very good link explaining the CQL syntax posted yesterday I believe
https://svn.apache.org/viewvc/cassandra/trunk/doc/cql/CQL.html?view=co
Re: PHP Cassandra CQL driver
Posted by Eric Evans <ee...@rackspace.com>.
On Tue, 2011-03-29 at 17:22 -0500, Jonathan Ellis wrote:
> >> My suggestion as a means of heavily mitigating the damage of these
> >> attacks would be to only permit a single query at a time (i.e.
> >> remove the ';' token).
> >
> > This is effectively the case. The parser is run exactly once for
> > each request and is only capable of parsing exactly one statement
> > (no less, no more). Terminating a query with ';' is allowed, but
> > has no effect on this.
>
> Batches allow multiple semicolon-delimited statements.
Actually, they require it (since you won't find an EOF terminating any
of the individual statements), but that is a bug.
> I think we'd need to have a separate cql_batch rpc method that took a
> list of statements to solve this. (I.e., begin/apply batch and the
> semicolons would be strictly interactive markers that would be used to
> break it up into the statements to send in that list.)
The intended behavior was to allow but not require them (the same for
statements appearing inside the batch or out), and that's easy enough to
fix.
The semicolon doesn't have any effect on the parser result, it's just
tolerant of them because people are going to use them, and it's one more
condition that we can deal with instead of pushing it on clients.
--
Eric Evans
eevans@rackspace.com
Re: PHP Cassandra CQL driver
Posted by Eric Evans <ee...@rackspace.com>.
On Tue, 2011-03-29 at 17:22 -0500, Jonathan Ellis wrote:
> >> My suggestion as a means of heavily mitigating the damage of these
> >> attacks would be to only permit a single query at a time (i.e.
> >> remove the ';' token).
> >
> > This is effectively the case. The parser is run exactly once for
> > each request and is only capable of parsing exactly one statement
> > (no less, no more). Terminating a query with ';' is allowed, but
> > has no effect on this.
>
> Batches allow multiple semicolon-delimited statements.
Actually, they require it (since you won't find an EOF terminating any
of the individual statements), but that is a bug.
> I think we'd need to have a separate cql_batch rpc method that took a
> list of statements to solve this. (I.e., begin/apply batch and the
> semicolons would be strictly interactive markers that would be used to
> break it up into the statements to send in that list.)
The intended behavior was to allow but not require them (the same for
statements appearing inside the batch or out), and that's easy enough to
fix.
The semicolon doesn't have any effect on the parser result, it's just
tolerant of them because people are going to use them, and it's one more
condition that we can deal with instead of pushing it on clients.
--
Eric Evans
eevans@rackspace.com
Re: PHP Cassandra CQL driver
Posted by Jonathan Ellis <jb...@gmail.com>.
It only really makes sense for mutations.
On Mar 29, 2011 6:32 PM, "Courtney Robinson" <sa...@live.co.uk> wrote:
> Comments inline...
>
> On Tue, Mar 29, 2011 at 5:00 PM, Eric Evans <ee...@rackspace.com> wrote:
>>>> My suggestion as a means of heavily mitigating the damage of these
>>>> attacks would be to only permit a single query at a time (i.e. remove
>>>> the ';' token).
>>
>>> This is effectively the case. The parser is run exactly once for each
>>> request and is only capable of parsing exactly one statement (no less,
>>> no more). Terminating a query with ';' is allowed, but has no effect on
>>> this.
>
>>Batches allow multiple semicolon-delimited statements.
>>I think we'd need to have a separate cql_batch rpc method that took a
>>list of statements to solve this. (I.e., begin/apply batch and the
>>semicolons would be strictly interactive markers that would be used to
>>break it up into the statements to send in that list.)
>
> So effectively cql_batch accepts a list something like:
> List<Statement> batchStatments;
> cql_batch(batchStatments);
>
> where each Statement in the list is limited to exactly one... select or
> whatever ?
> Making it one call to the server but then each statement is processed
> separately...
>
Re: PHP Cassandra CQL driver
Posted by Courtney Robinson <sa...@live.co.uk>.
Comments inline...
On Tue, Mar 29, 2011 at 5:00 PM, Eric Evans <ee...@rackspace.com> wrote:
>>> My suggestion as a means of heavily mitigating the damage of these
>>> attacks would be to only permit a single query at a time (i.e. remove
>>> the ';' token).
>
>> This is effectively the case. The parser is run exactly once for each
>> request and is only capable of parsing exactly one statement (no less,
>> no more). Terminating a query with ';' is allowed, but has no effect on
>> this.
>Batches allow multiple semicolon-delimited statements.
>I think we'd need to have a separate cql_batch rpc method that took a
>list of statements to solve this. (I.e., begin/apply batch and the
>semicolons would be strictly interactive markers that would be used to
>break it up into the statements to send in that list.)
So effectively cql_batch accepts a list something like:
List<Statement> batchStatments;
cql_batch(batchStatments);
where each Statement in the list is limited to exactly one... select or
whatever ?
Making it one call to the server but then each statement is processed
separately...
Re: PHP Cassandra CQL driver
Posted by Courtney Robinson <sa...@live.co.uk>.
Comments inline...
On Tue, Mar 29, 2011 at 5:00 PM, Eric Evans <ee...@rackspace.com> wrote:
>>> My suggestion as a means of heavily mitigating the damage of these
>>> attacks would be to only permit a single query at a time (i.e. remove
>>> the ';' token).
>
>> This is effectively the case. The parser is run exactly once for each
>> request and is only capable of parsing exactly one statement (no less,
>> no more). Terminating a query with ';' is allowed, but has no effect on
>> this.
>Batches allow multiple semicolon-delimited statements.
>I think we'd need to have a separate cql_batch rpc method that took a
>list of statements to solve this. (I.e., begin/apply batch and the
>semicolons would be strictly interactive markers that would be used to
>break it up into the statements to send in that list.)
So effectively cql_batch accepts a list something like:
List<Statement> batchStatments;
cql_batch(batchStatments);
where each Statement in the list is limited to exactly one... select or
whatever ?
Making it one call to the server but then each statement is processed
separately...
Re: PHP Cassandra CQL driver
Posted by Jonathan Ellis <jb...@gmail.com>.
On Tue, Mar 29, 2011 at 5:00 PM, Eric Evans <ee...@rackspace.com> wrote:
>> My suggestion as a means of heavily mitigating the damage of these
>> attacks would be to only permit a single query at a time (i.e. remove
>> the ';' token).
>
> This is effectively the case. The parser is run exactly once for each
> request and is only capable of parsing exactly one statement (no less,
> no more). Terminating a query with ';' is allowed, but has no effect on
> this.
Batches allow multiple semicolon-delimited statements.
I think we'd need to have a separate cql_batch rpc method that took a
list of statements to solve this. (I.e., begin/apply batch and the
semicolons would be strictly interactive markers that would be used to
break it up into the statements to send in that list.)
--
Jonathan Ellis
Project Chair, Apache Cassandra
co-founder of DataStax, the source for professional Cassandra support
http://www.datastax.com
Re: PHP Cassandra CQL driver
Posted by Jonathan Ellis <jb...@gmail.com>.
On Tue, Mar 29, 2011 at 5:00 PM, Eric Evans <ee...@rackspace.com> wrote:
>> My suggestion as a means of heavily mitigating the damage of these
>> attacks would be to only permit a single query at a time (i.e. remove
>> the ';' token).
>
> This is effectively the case. The parser is run exactly once for each
> request and is only capable of parsing exactly one statement (no less,
> no more). Terminating a query with ';' is allowed, but has no effect on
> this.
Batches allow multiple semicolon-delimited statements.
I think we'd need to have a separate cql_batch rpc method that took a
list of statements to solve this. (I.e., begin/apply batch and the
semicolons would be strictly interactive markers that would be used to
break it up into the statements to send in that list.)
--
Jonathan Ellis
Project Chair, Apache Cassandra
co-founder of DataStax, the source for professional Cassandra support
http://www.datastax.com
Re: PHP Cassandra CQL driver
Posted by Eric Evans <ee...@rackspace.com>.
On Tue, 2011-03-29 at 12:06 +0100, Nick Telford wrote:
> With regards to injection, I saw someone state "it's a red herring as
> it's a client concern". While this may be true, experience teaches us
> that pushing the responsibility to the client is dangerous due to the
> many implementations. At the very least, the possibility of injection
> attacks should be *considered*.
No, it's basically the point of this exercise to push as much as
possible server-side.
> My suggestion as a means of heavily mitigating the damage of these
> attacks would be to only permit a single query at a time (i.e. remove
> the ';' token).
This is effectively the case. The parser is run exactly once for each
request and is only capable of parsing exactly one statement (no less,
no more). Terminating a query with ';' is allowed, but has no effect on
this.
> Only trusted, administrative client applications (e.g. a GUI or
> console) should really permit issuing multiple queries like this. Such
> clients could decompose the queries in to separate queries and issue
> them individually.
Easier still, because nothing has that ability. There is a very basic
interactive interpreter bundled with the Python driver, it splits on ';'
and issues individual requests.
--
Eric Evans
eevans@rackspace.com
Re: PHP Cassandra CQL driver
Posted by Courtney Robinson <sa...@live.co.uk>.
Comments inline.
From: Nick Telford
Sent: Tuesday, March 29, 2011 12:06 PM
To: dev@cassandra.apache.org ; client-dev@cassandra.apache.org
Cc: Courtney Robinson
Subject: Re: PHP Cassandra CQL driver
I have to say I'm not a huge fan of reverse-engineering the interface, especially not from the Java implementation. I think we'd be better off using the other drivers (in particular, the python driver) as inspiration and then craft an interface that fits in with PHP.
Agreed, Dave has dome some classes/interfaces based off the python version. He’s going to commit them when he gets a chance.
With regards to injection, I saw someone state "it's a red herring as it's a client concern". While this may be true, experience teaches us that pushing the responsibility to the client is dangerous due to the many implementations. At the very least, the possibility of injection attacks should be *considered*.
My suggestion as a means of heavily mitigating the damage of these attacks would be to only permit a single query at a time (i.e. remove the ';' token). Only trusted, administrative client applications (e.g. a GUI or console) should really permit issuing multiple queries like this. Such clients could decompose the queries in to separate queries and issue them individually.
It might also be helpful for the RPC interface to permit executing a batch of queries (list<string>) to reduce network overheads.
Finally, we should take this conversation over to the client-dev list, rather than add to the noise on the dev list.
Regards,
Nick Telford
On 29 March 2011 10:34, Courtney Robinson <sa...@live.co.uk> wrote:
Okay, Dave Gardner, Nick Telford and myself met at the London Cassandra meetup.
We were keen on getting a PHP CQL driver done and decided to use github while working on it.
This mail is mainly to raise awareness of this as well as to ask a few questions and throw a few things
out there that came up.
These are in no particular order and are just how I remember them.
Firstly, has it already been taken into consideration that CQL implicitly means injections may become a problem?
Secondly and this wasn’t so much of a problem but more of a suggestion. While going through the Java and Python
versions, there was a significant lack of docs. I think at the moment that’s because Eric Evans may be the only one
moulding CQL together but if we’re going to get many drivers done It will help other Devs and not scare off potential
devs. who aren’t close or overly familiar with Cassandra’s internals.
For Devs interested in contributing to the PHP Cassandra (PHPCad) driver, its on github @ https://github.com/zcourts/PHPCad
We also wondered about actually making this an “official” driver. Once it is in a stable state, do we just let Eric or one of the other committers know or is there a particularly long winded process that has to be followed?
The code on Github at the moment is a reversed engineered version of the Java impl. in PHP. I think we’ve agreed that its too “JDBC” like with a lot of methods etc that aren’t necessary/needed so Dave has written up some classes and interfaces off the Python version so we’ll be changing the base code to those as soon as he gets some time.
I’m sure there were other things, possibly more important that I’ve forgotten since the meetup but they’ll come to light in due time. Again, the driving force behind this at the moment seems to need more man power, we’d like to get a bit more momentum behind it and kick off drivers in a few other languages. Anyone wishing to contrib. should get it out there.
For ref, a very good link explaining the CQL syntax posted yesterday I believe
https://svn.apache.org/viewvc/cassandra/trunk/doc/cql/CQL.html?view=co
Re: PHP Cassandra CQL driver
Posted by Eric Evans <ee...@rackspace.com>.
On Tue, 2011-03-29 at 12:06 +0100, Nick Telford wrote:
> With regards to injection, I saw someone state "it's a red herring as
> it's a client concern". While this may be true, experience teaches us
> that pushing the responsibility to the client is dangerous due to the
> many implementations. At the very least, the possibility of injection
> attacks should be *considered*.
No, it's basically the point of this exercise to push as much as
possible server-side.
> My suggestion as a means of heavily mitigating the damage of these
> attacks would be to only permit a single query at a time (i.e. remove
> the ';' token).
This is effectively the case. The parser is run exactly once for each
request and is only capable of parsing exactly one statement (no less,
no more). Terminating a query with ';' is allowed, but has no effect on
this.
> Only trusted, administrative client applications (e.g. a GUI or
> console) should really permit issuing multiple queries like this. Such
> clients could decompose the queries in to separate queries and issue
> them individually.
Easier still, because nothing has that ability. There is a very basic
interactive interpreter bundled with the Python driver, it splits on ';'
and issues individual requests.
--
Eric Evans
eevans@rackspace.com
Re: PHP Cassandra CQL driver
Posted by Jonathan Ellis <jb...@gmail.com>.
On Tue, Mar 29, 2011 at 9:41 AM, Courtney Robinson <sa...@live.co.uk> wrote:
> My suggestion as a means of heavily mitigating the damage of these attacks would be to only permit a single query at a time (i.e. remove the ';' token). Only trusted, administrative client applications (e.g. a GUI or console) should really permit issuing multiple queries like this. Such clients could decompose the queries in to separate queries and issue them individually.
+1.
; should only be used to let an interactive interface to know "that's
the end of my query."
--
Jonathan Ellis
Project Chair, Apache Cassandra
co-founder of DataStax, the source for professional Cassandra support
http://www.datastax.com
Re: PHP Cassandra CQL driver
Posted by Jonathan Ellis <jb...@gmail.com>.
On Tue, Mar 29, 2011 at 9:41 AM, Courtney Robinson <sa...@live.co.uk> wrote:
> My suggestion as a means of heavily mitigating the damage of these attacks would be to only permit a single query at a time (i.e. remove the ';' token). Only trusted, administrative client applications (e.g. a GUI or console) should really permit issuing multiple queries like this. Such clients could decompose the queries in to separate queries and issue them individually.
+1.
; should only be used to let an interactive interface to know "that's
the end of my query."
--
Jonathan Ellis
Project Chair, Apache Cassandra
co-founder of DataStax, the source for professional Cassandra support
http://www.datastax.com
Re: PHP Cassandra CQL driver
Posted by Courtney Robinson <sa...@live.co.uk>.
This is the last post on the dev list, moving over to client-dev
Agreed on the reverse eng. of the java driver. Dave has dome some classes/interfaces based off the python version. He’s going to commit them when he gets a chance.
From: Nick Telford
Sent: Tuesday, March 29, 2011 12:06 PM
To: dev@cassandra.apache.org ; client-dev@cassandra.apache.org
Cc: Courtney Robinson
Subject: Re: PHP Cassandra CQL driver
I have to say I'm not a huge fan of reverse-engineering the interface, especially not from the Java implementation. I think we'd be better off using the other drivers (in particular, the python driver) as inspiration and then craft an interface that fits in with PHP.
With regards to injection, I saw someone state "it's a red herring as it's a client concern". While this may be true, experience teaches us that pushing the responsibility to the client is dangerous due to the many implementations. At the very least, the possibility of injection attacks should be *considered*.
My suggestion as a means of heavily mitigating the damage of these attacks would be to only permit a single query at a time (i.e. remove the ';' token). Only trusted, administrative client applications (e.g. a GUI or console) should really permit issuing multiple queries like this. Such clients could decompose the queries in to separate queries and issue them individually.
It might also be helpful for the RPC interface to permit executing a batch of queries (list<string>) to reduce network overheads.
Finally, we should take this conversation over to the client-dev list, rather than add to the noise on the dev list.
Regards,
Nick Telford
On 29 March 2011 10:34, Courtney Robinson <sa...@live.co.uk> wrote:
Okay, Dave Gardner, Nick Telford and myself met at the London Cassandra meetup.
We were keen on getting a PHP CQL driver done and decided to use github while working on it.
This mail is mainly to raise awareness of this as well as to ask a few questions and throw a few things
out there that came up.
These are in no particular order and are just how I remember them.
Firstly, has it already been taken into consideration that CQL implicitly means injections may become a problem?
Secondly and this wasn’t so much of a problem but more of a suggestion. While going through the Java and Python
versions, there was a significant lack of docs. I think at the moment that’s because Eric Evans may be the only one
moulding CQL together but if we’re going to get many drivers done It will help other Devs and not scare off potential
devs. who aren’t close or overly familiar with Cassandra’s internals.
For Devs interested in contributing to the PHP Cassandra (PHPCad) driver, its on github @ https://github.com/zcourts/PHPCad
We also wondered about actually making this an “official” driver. Once it is in a stable state, do we just let Eric or one of the other committers know or is there a particularly long winded process that has to be followed?
The code on Github at the moment is a reversed engineered version of the Java impl. in PHP. I think we’ve agreed that its too “JDBC” like with a lot of methods etc that aren’t necessary/needed so Dave has written up some classes and interfaces off the Python version so we’ll be changing the base code to those as soon as he gets some time.
I’m sure there were other things, possibly more important that I’ve forgotten since the meetup but they’ll come to light in due time. Again, the driving force behind this at the moment seems to need more man power, we’d like to get a bit more momentum behind it and kick off drivers in a few other languages. Anyone wishing to contrib. should get it out there.
For ref, a very good link explaining the CQL syntax posted yesterday I believe
https://svn.apache.org/viewvc/cassandra/trunk/doc/cql/CQL.html?view=co
Re: PHP Cassandra CQL driver
Posted by Courtney Robinson <sa...@live.co.uk>.
This is the last post on the dev list, moving over to client-dev
Agreed on the reverse eng. of the java driver. Dave has dome some classes/interfaces based off the python version. He’s going to commit them when he gets a chance.
From: Nick Telford
Sent: Tuesday, March 29, 2011 12:06 PM
To: dev@cassandra.apache.org ; client-dev@cassandra.apache.org
Cc: Courtney Robinson
Subject: Re: PHP Cassandra CQL driver
I have to say I'm not a huge fan of reverse-engineering the interface, especially not from the Java implementation. I think we'd be better off using the other drivers (in particular, the python driver) as inspiration and then craft an interface that fits in with PHP.
With regards to injection, I saw someone state "it's a red herring as it's a client concern". While this may be true, experience teaches us that pushing the responsibility to the client is dangerous due to the many implementations. At the very least, the possibility of injection attacks should be *considered*.
My suggestion as a means of heavily mitigating the damage of these attacks would be to only permit a single query at a time (i.e. remove the ';' token). Only trusted, administrative client applications (e.g. a GUI or console) should really permit issuing multiple queries like this. Such clients could decompose the queries in to separate queries and issue them individually.
It might also be helpful for the RPC interface to permit executing a batch of queries (list<string>) to reduce network overheads.
Finally, we should take this conversation over to the client-dev list, rather than add to the noise on the dev list.
Regards,
Nick Telford
On 29 March 2011 10:34, Courtney Robinson <sa...@live.co.uk> wrote:
Okay, Dave Gardner, Nick Telford and myself met at the London Cassandra meetup.
We were keen on getting a PHP CQL driver done and decided to use github while working on it.
This mail is mainly to raise awareness of this as well as to ask a few questions and throw a few things
out there that came up.
These are in no particular order and are just how I remember them.
Firstly, has it already been taken into consideration that CQL implicitly means injections may become a problem?
Secondly and this wasn’t so much of a problem but more of a suggestion. While going through the Java and Python
versions, there was a significant lack of docs. I think at the moment that’s because Eric Evans may be the only one
moulding CQL together but if we’re going to get many drivers done It will help other Devs and not scare off potential
devs. who aren’t close or overly familiar with Cassandra’s internals.
For Devs interested in contributing to the PHP Cassandra (PHPCad) driver, its on github @ https://github.com/zcourts/PHPCad
We also wondered about actually making this an “official” driver. Once it is in a stable state, do we just let Eric or one of the other committers know or is there a particularly long winded process that has to be followed?
The code on Github at the moment is a reversed engineered version of the Java impl. in PHP. I think we’ve agreed that its too “JDBC” like with a lot of methods etc that aren’t necessary/needed so Dave has written up some classes and interfaces off the Python version so we’ll be changing the base code to those as soon as he gets some time.
I’m sure there were other things, possibly more important that I’ve forgotten since the meetup but they’ll come to light in due time. Again, the driving force behind this at the moment seems to need more man power, we’d like to get a bit more momentum behind it and kick off drivers in a few other languages. Anyone wishing to contrib. should get it out there.
For ref, a very good link explaining the CQL syntax posted yesterday I believe
https://svn.apache.org/viewvc/cassandra/trunk/doc/cql/CQL.html?view=co
Re: PHP Cassandra CQL driver
Posted by Nick Telford <ni...@gmail.com>.
I have to say I'm not a huge fan of reverse-engineering the interface,
especially not from the Java implementation. I think we'd be better off
using the other drivers (in particular, the python driver) as inspiration
and then craft an interface that fits in with PHP.
With regards to injection, I saw someone state "it's a red herring as it's a
client concern". While this may be true, experience teaches us that pushing
the responsibility to the client is dangerous due to the many
implementations. At the very least, the possibility of injection attacks
should be *considered*.
My suggestion as a means of heavily mitigating the damage of these attacks
would be to only permit a single query at a time (i.e. remove the ';'
token). Only trusted, administrative client applications (e.g. a GUI or
console) should really permit issuing multiple queries like this. Such
clients could decompose the queries in to separate queries and issue them
individually.
It might also be helpful for the RPC interface to permit executing a batch
of queries (list<string>) to reduce network overheads.
Finally, we should take this conversation over to the client-dev list,
rather than add to the noise on the dev list.
Regards,
Nick Telford
On 29 March 2011 10:34, Courtney Robinson <sa...@live.co.uk> wrote:
> Okay, Dave Gardner, Nick Telford and myself met at the London Cassandra
> meetup.
> We were keen on getting a PHP CQL driver done and decided to use github
> while working on it.
> This mail is mainly to raise awareness of this as well as to ask a few
> questions and throw a few things
> out there that came up.
>
> These are in no particular order and are just how I remember them.
> Firstly, has it already been taken into consideration that CQL implicitly
> means injections may become a problem?
>
> Secondly and this wasn’t so much of a problem but more of a suggestion.
> While going through the Java and Python
> versions, there was a significant lack of docs. I think at the moment
> that’s because Eric Evans may be the only one
> moulding CQL together but if we’re going to get many drivers done It will
> help other Devs and not scare off potential
> devs. who aren’t close or overly familiar with Cassandra’s internals.
>
> For Devs interested in contributing to the PHP Cassandra (PHPCad) driver,
> its on github @ https://github.com/zcourts/PHPCad
>
> We also wondered about actually making this an “official” driver. Once it
> is in a stable state, do we just let Eric or one of the other committers
> know or is there a particularly long winded process that has to be followed?
>
> The code on Github at the moment is a reversed engineered version of the
> Java impl. in PHP. I think we’ve agreed that its too “JDBC” like with a lot
> of methods etc that aren’t necessary/needed so Dave has written up some
> classes and interfaces off the Python version so we’ll be changing the base
> code to those as soon as he gets some time.
>
> I’m sure there were other things, possibly more important that I’ve
> forgotten since the meetup but they’ll come to light in due time. Again, the
> driving force behind this at the moment seems to need more man power, we’d
> like to get a bit more momentum behind it and kick off drivers in a few
> other languages. Anyone wishing to contrib. should get it out there.
>
> For ref, a very good link explaining the CQL syntax posted yesterday I
> believe
> https://svn.apache.org/viewvc/cassandra/trunk/doc/cql/CQL.html?view=co
>
>
Re: PHP Cassandra CQL driver
Posted by Eric Evans <ee...@rackspace.com>.
On Tue, 2011-03-29 at 10:34 +0100, Courtney Robinson wrote:
> Firstly, has it already been taken into consideration that CQL
> implicitly means injections may become a problem?
It is only possible to submit one query at a time w/ CQL.
--
Eric Evans
eevans@rackspace.com
Re: PHP Cassandra CQL driver
Posted by Nick Telford <ni...@gmail.com>.
I have to say I'm not a huge fan of reverse-engineering the interface,
especially not from the Java implementation. I think we'd be better off
using the other drivers (in particular, the python driver) as inspiration
and then craft an interface that fits in with PHP.
With regards to injection, I saw someone state "it's a red herring as it's a
client concern". While this may be true, experience teaches us that pushing
the responsibility to the client is dangerous due to the many
implementations. At the very least, the possibility of injection attacks
should be *considered*.
My suggestion as a means of heavily mitigating the damage of these attacks
would be to only permit a single query at a time (i.e. remove the ';'
token). Only trusted, administrative client applications (e.g. a GUI or
console) should really permit issuing multiple queries like this. Such
clients could decompose the queries in to separate queries and issue them
individually.
It might also be helpful for the RPC interface to permit executing a batch
of queries (list<string>) to reduce network overheads.
Finally, we should take this conversation over to the client-dev list,
rather than add to the noise on the dev list.
Regards,
Nick Telford
On 29 March 2011 10:34, Courtney Robinson <sa...@live.co.uk> wrote:
> Okay, Dave Gardner, Nick Telford and myself met at the London Cassandra
> meetup.
> We were keen on getting a PHP CQL driver done and decided to use github
> while working on it.
> This mail is mainly to raise awareness of this as well as to ask a few
> questions and throw a few things
> out there that came up.
>
> These are in no particular order and are just how I remember them.
> Firstly, has it already been taken into consideration that CQL implicitly
> means injections may become a problem?
>
> Secondly and this wasn’t so much of a problem but more of a suggestion.
> While going through the Java and Python
> versions, there was a significant lack of docs. I think at the moment
> that’s because Eric Evans may be the only one
> moulding CQL together but if we’re going to get many drivers done It will
> help other Devs and not scare off potential
> devs. who aren’t close or overly familiar with Cassandra’s internals.
>
> For Devs interested in contributing to the PHP Cassandra (PHPCad) driver,
> its on github @ https://github.com/zcourts/PHPCad
>
> We also wondered about actually making this an “official” driver. Once it
> is in a stable state, do we just let Eric or one of the other committers
> know or is there a particularly long winded process that has to be followed?
>
> The code on Github at the moment is a reversed engineered version of the
> Java impl. in PHP. I think we’ve agreed that its too “JDBC” like with a lot
> of methods etc that aren’t necessary/needed so Dave has written up some
> classes and interfaces off the Python version so we’ll be changing the base
> code to those as soon as he gets some time.
>
> I’m sure there were other things, possibly more important that I’ve
> forgotten since the meetup but they’ll come to light in due time. Again, the
> driving force behind this at the moment seems to need more man power, we’d
> like to get a bit more momentum behind it and kick off drivers in a few
> other languages. Anyone wishing to contrib. should get it out there.
>
> For ref, a very good link explaining the CQL syntax posted yesterday I
> believe
> https://svn.apache.org/viewvc/cassandra/trunk/doc/cql/CQL.html?view=co
>
>
Re: PHP Cassandra CQL driver
Posted by Jake Farrell <JF...@onesite.com>.
A c++ pdo would work great and easily integrate with thrift to make talking back to cassandra easy. Also if this c++ core was made as a shared object then php/python drivers could be simple wrappers that called into it, thus giving CQL a c++, php and python driver all inheriting from the same core. Would love to help with such a project if this is the avenue it takes
On Mar 29, 2011, at 9:44 AM, Courtney Robinson wrote:
>> Great work, guys! Glad to see CQL picking up steam. I think it will be
>> a game-changer for adoption.
>
> Hopefully!
>
>> Firstly, has it already been taken into consideration that CQL implicitly means injections may become a problem?
>
> Absolutely. The same best practices for a SQL driver apply:
> parametrization should be handled by the API rather than string
> escaping done manually. For the Java driver we are doing this in
> https://issues.apache.org/jira/browse/CASSANDRA-2277. I'm not very
> familiar with PHP but I think PDO is usually used for that?
>
> :-) Nick has some good ideas to help with that
>
>> I believe the plan of record is to host CQL drivers in-tree, so you'd
>> post it to JIRA for review as usual.
>
> cool, will do!
Re: PHP Cassandra CQL driver
Posted by Courtney Robinson <sa...@live.co.uk>.
>Great work, guys! Glad to see CQL picking up steam. I think it will be
>a game-changer for adoption.
Hopefully!
> Firstly, has it already been taken into consideration that CQL implicitly
> means injections may become a problem?
Absolutely. The same best practices for a SQL driver apply:
parametrization should be handled by the API rather than string
escaping done manually. For the Java driver we are doing this in
https://issues.apache.org/jira/browse/CASSANDRA-2277. I'm not very
familiar with PHP but I think PDO is usually used for that?
:-) Nick has some good ideas to help with that
>I believe the plan of record is to host CQL drivers in-tree, so you'd
>post it to JIRA for review as usual.
cool, will do!
Re: PHP Cassandra CQL driver
Posted by Jonathan Ellis <jb...@gmail.com>.
On Tue, Mar 29, 2011 at 4:34 AM, Courtney Robinson <sa...@live.co.uk> wrote:
> Okay, Dave Gardner, Nick Telford and myself met at the London Cassandra meetup.
> We were keen on getting a PHP CQL driver done and decided to use github while working on it.
Great work, guys! Glad to see CQL picking up steam. I think it will be
a game-changer for adoption.
> Firstly, has it already been taken into consideration that CQL implicitly means injections may become a problem?
Absolutely. The same best practices for a SQL driver apply:
parametrization should be handled by the API rather than string
escaping done manually. For the Java driver we are doing this in
https://issues.apache.org/jira/browse/CASSANDRA-2277. I'm not very
familiar with PHP but I think PDO is usually used for that?
> We also wondered about actually making this an “official” driver. Once it is in a stable state, do we just let Eric or one of the other committers know or is there a particularly long winded process that has to be followed?
I believe the plan of record is to host CQL drivers in-tree, so you'd
post it to JIRA for review as usual.
Thanks!
--
Jonathan Ellis
Project Chair, Apache Cassandra
co-founder of DataStax, the source for professional Cassandra support
http://www.datastax.com