You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pinot.apache.org by GitBox <gi...@apache.org> on 2021/08/16 22:05:52 UTC
[GitHub] [pinot] amrishlal opened a new issue #7310: Possible security vulnerability due to use of groovy script in SQL statements.
amrishlal opened a new issue #7310:
URL: https://github.com/apache/pinot/issues/7310
Pinot currently allows for unrestricted use of groovy scripts in SQL statements. As an example consider the following SQL statement:
```
SELECT groovy('{"returnType": "STRING", "isSingleValue": true}','new File("/etc/hosts").text')
FROM baseballStats
```
This statement will return the content of '/etc/hosts' file from server back to the user. Other such statements are possible where an unsuspecting or malicious user could cause damage (SQL injection attacks etc). Hence, we would like to disable the ability to run groovy scripts in SQL statements by default with an option to enable groovy scripts by setting a configuration variable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [pinot] egalpin commented on issue #7310: Disallow groovy script in SQL statements to prevent possible exploitation.
Posted by GitBox <gi...@apache.org>.
egalpin commented on issue #7310:
URL: https://github.com/apache/pinot/issues/7310#issuecomment-1029311052
+1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [pinot] kishoreg commented on issue #7310: Disallow groovy script in SQL statements to prevent possible exploitation.
Posted by GitBox <gi...@apache.org>.
kishoreg commented on issue #7310:
URL: https://github.com/apache/pinot/issues/7310#issuecomment-899858977
+1 Groovy also supports sandboxing and can also be disabled by jvm startup parameters
https://melix.github.io/blog/2015/03/sandboxing.html
https://levelup.gitconnected.com/secure-groovy-script-execution-in-a-sandbox-ea39f80ee87
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
[GitHub] [pinot] mayankshriv commented on issue #7310: Possible security vulnerability due to use of groovy script in SQL statements.
Posted by GitBox <gi...@apache.org>.
mayankshriv commented on issue #7310:
URL: https://github.com/apache/pinot/issues/7310#issuecomment-899851895
Definitely a good idea to add a config to disable groovy scripts in SQL statements. However, we should survey the use cases and the usage model on deciding the default value (ON vs OFF). I vote for keeping the current behavior and only disabling it when explicitly specified. My reasoning is that the more common case is not prone to this issue:
- Most Pinot deployments do not expose a free form SQL endpoint to their external users. Almost in all cases, the SQL is generated within the org that is running Pinot.
- Typically, there's a data model between external user and the data store. Most such attacks would be stopped right by the data model by not allowing any way for user to create such a SQL query.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org