You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shardingsphere.apache.org by "xs996 (via GitHub)" <gi...@apache.org> on 2024/03/26 09:23:29 UTC
[I] shardingsphere H2database snyk issue [shardingsphere]
xs996 opened a new issue, #30656:
URL: https://github.com/apache/shardingsphere/issues/30656
## Bug Report
**For English only**, other languages will not accept.
Before report a bug, make sure you have:
- Searched open and closed [GitHub issues](https://github.com/apache/shardingsphere/issues).
- Read documentation: [ShardingSphere Doc](https://shardingsphere.apache.org/document/current/en/overview).
Please pay attention on issues you submitted, because we maybe need more details.
If no response anymore and we cannot reproduce it on current information, we will **close it**.
Please answer these questions before submitting your issue. Thanks!
### Which version of ShardingSphere did you use?
shardingsphere-jdbc-core 5.4.1
### Which project did you use? ShardingSphere-JDBC or ShardingSphere-Proxy?
ShardingSphere-JDBC
### Expected behavior
snyk scan passed
### Actual behavior
snyk reported a high issue about h2database
### Reason analyze (If you can)
When we use h2database, snyk provides a high issue, and prompts that it cannot be repaired, The following is a detailed report:
_Affected versions of this package are vulnerable to Remote Code Execution (RCE). It provides a web console for managing the database, and by default it does not have a password set. The CREATE ALIAS function calls Java code, allowing an attacker to execute arbitrary Java code on projects running the h2 database.
Snyk report link: https://security.snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-31685
### Steps to reproduce the behavior, such as: SQL to execute, sharding rule configuration, when exception occur etc.
snyk monitor
### Example codes for reproduce this issue (such as a github link).
**Snyk report link: https://security.snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-31685**
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "20001931 (via GitHub)" <gi...@apache.org>.
20001931 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2022099276
thank your suggestion，let us try it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2041906862
- If you’re referring to encrypting a metadata entry in the Zookeeper or H2database Metadata Repository that stores a database password, this requires a separate schema implementation.
- And considering the US export controls and China export controls that come with the concept of encryption algorithms, which also involve Apache LICENSE conflicts with regulatory approaches, you’ll want to consider a closed source implementation of your own.
- If you just need to encrypt a local YAML configuration file, you can do this in a separate `org.apache.shardingsphere.infra.url.ShardingSphereURLLoader` implementation, such as MD5 salted with a private key. Refer to https://shardingsphere.apache.org/document/current/en/user-manual/shardingsphere-jdbc/yaml-config/jdbc-driver/known-implementation/ .
- IMHO, this topic has gone beyond the current issue description, and I fully recommend opening a new issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2019934616
- I tend to think this is a false positive from a low-quality security platform, since CVE-2018-10054 as pointed out by https://security.snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-31685 , and `com.h2database:h2` almost doesn't matter. This CVE comes from `com.datomic:datomic-free`, which `org.apache.shardingsphere:shardingsphere-jdbc` does not depend on. Refer to https://github.com/advisories/GHSA-9pf8-qqhm-7w64 .
- I recommend you check further with Synk.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2044639425
- I'm not sure what you are talking about. A custom implementation of `org.apache.shardingsphere.infra.url.ShardingSphereURLLoader` can place the key of a certain private key inside. When such an implementation exists, you can directly reference the YAML file containing the encryption information. I assume that the string returned by your implementation of `getType()` is `classpath-with-encrypt`.
```yaml
jdbc:shardingsphere:classpath-with-encrypt:config.yaml
```
- `org.apache.shardingsphere.infra.url.ShardingSphereURLLoader` can also read JDBCURL parameters, it depends on whether you need to pass in the public key for verification.
- This is completely beyond what the issue describes. I don't think there's any way to handle a PR without opening a new issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2021997423
- To add support for Postgres, TiDB or other databases, you need to add files like https://github.com/apache/shardingsphere/tree/master/mode%2Ftype%2Fstandalone%2Frepository%2Fprovider%2Fjdbc%2Fsrc%2Fmain%2Fresources%2Fsql to the `/sql/` folder of the project's classpath. These xml files define how ShardingSphere CRUDs the database to save metadata. These files do not take into account SPI.
- Or you can use cluster mode, in which case the metadata is in zoookeeper etc.
- IMHO, the original CVE description is bullshit, as h2database V2 does not allow access to the web console by default. This CVE is for the `com.datomic:datomic-free` dependency. For this CVE, the maintainer has requested to revoke the CVE, and you can see that the CVE has been marked as disputed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "20001931 (via GitHub)" <gi...@apache.org>.
20001931 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2046679976
Could you share more detail? Where i can refer to code template?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "20001931 (via GitHub)" <gi...@apache.org>.
20001931 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2041998058
I have checked shardingsphere 5.4.1,https://github.com/apache/shardingsphere/tree/5.4.1/infra/executor/src
there is not any class org.apache.shardingsphere.infra.url.ShardingSphereURLLoader.
<parent>
<groupId>org.apache.shardingsphere</groupId>
<artifactId>shardingsphere-infra-url</artifactId>
<version>5.4.2-SNAPSHOT</version>
</parent>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2247776094
https://shardingsphere.apache.org/document/current/cn/user-manual/common-config/builtin-algorithm/metadata-repository/ has been updated by #32192. Now you can use MySQL Server, Embedded Derby, Derby Network Server, HyperSQL HSQL Server, HyperSQL HTTP Server, HyperSQL HTTP Servlet, (Embedded) HyperSQL to configure ShardingSphere Standalone Mode. So-called MySQL Server-compatible databases such as TiDB should also work.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "xs996 (via GitHub)" <gi...@apache.org>.
xs996 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2021828819
> * You can set the place to keep Metadata to other JDBC URL, whether it is MySQL or PostgreSQL.
If I don't use h2datbase and mysql to save my metadata, what should I do? Is there any corresponding documentation? Because I found in the documentation that Database Repository only supports H2 and Mysql
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2046644926
- The easiest way to do this is to implement a custom Mode, which is a repeatable operation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2034505485
- It's hard to say what the significance of this issue is, because the h2database team does not think this CVE is meaningful. Unless someone plans to provide the ShardingSphere Standalone mode implementation for `org.hsqldb:hsqldb:2.7.2` or `org.apache.derby:derby:10.17.1.0`, two of the alternatives to h2database.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "20001931 (via GitHub)" <gi...@apache.org>.
20001931 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2046773832
I got you point ,you mean i need change SPI org.apache.shardingsphere.mode.repository.standalone.StandalonePersistRepository to custom implementation class for example (JDBCRepositoryAli) ,so i will control dataSource init ,that is right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "20001931 (via GitHub)" <gi...@apache.org>.
20001931 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2044587039
I have other question for decrypt password for DB in shardingsphere 5.4.1
As you konw i have encrypted password for DB in classpath yaml
But where i intercept code shardingsphere read classpath yaml?
url: jdbc:shardingsphere:classpath:sharding-dev.yaml?placeholder-type=system_props
password: $${fixture.config.driver.password::}
I konw can use ShardingSphereURLLoader to replace $${} But where i intercept code shardingsphere read classpath yaml
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2059749502
- To summarize, I've opened #30926. I don't have time to deal with it at the moment. Maybe the related issues will be resolved at the 5.6.0 milestone.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "xs996 (via GitHub)" <gi...@apache.org>.
xs996 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2056405468
Regarding database password encryption, I submitted a new Issue:
https://github.com/apache/shardingsphere/issues/30896
I will close this issue
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2042006168
- @20001931 I remember another PMC and I refactored the related SPI design to support potential file transformations at the 5.5.0 milestone, so you need to manually compile the master branch at this stage.
- As for when 5.5.0 will be released, this is not a question that can be discussed on github.com, you need to go to the shardingsphere mailing list to discuss it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "20001931 (via GitHub)" <gi...@apache.org>.
20001931 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2041785049
I have other question for encrypt password for DB in shardingsphere 5.4.1
Could you provide suggestion for encrypt password for DB?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2046979260
> I got you point ,you mean i need change SPI org.apache.shardingsphere.mode.repository.standalone.StandalonePersistRepository to custom implementation class for example (JDBCRepositoryAli.class ) ,so i will control dataSource init ,that is right?
- Yes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "20001931 (via GitHub)" <gi...@apache.org>.
20001931 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2046302959
you did not get my point ,i konw to use ShardingSphereURLLoader reading YAML file,But i need to intercept code jdbcRepositoryProps.getValue(JDBCRepositoryPropertyKey.PASSWORD))
i need to decrypt this password and retuen the ShardingSphere dataSource
you can not intercept the ShardingSphere dataSource if you just custom implementation ShardingSphereURLLoader
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "20001931 (via GitHub)" <gi...@apache.org>.
20001931 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2021814568
Snyk reported https://security.snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-2331071 please double check this high issue
h2database import from shardingsphere 5.4.1
![Uploading Screenshot 2024-03-27 104037.png…]()
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "xs996 (via GitHub)" <gi...@apache.org>.
xs996 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2020047969
I don't think this is a false positive from Snyk, here are the details I provided：
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "xs996 (via GitHub)" <gi...@apache.org>.
xs996 commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2020059903
I found from the documentation that when I use Mode: Standalone I have to use H2 or MySQL to load my metadata，But we did not use the above database. Is there any way to remove h2database from source code?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2020070270
- Snyk only reported CVE-2018-10054, which is not specific to h2database. You need to check the original report of CVE.
- You can set the place to keep Metadata to other JDBC URL, whether it is MySQL or PostgreSQL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "linghengqian (via GitHub)" <gi...@apache.org>.
linghengqian commented on issue #30656:
URL: https://github.com/apache/shardingsphere/issues/30656#issuecomment-2046706128
- The answer is yes. See https://shardingsphere.apache.org/document/current/en/dev-manual/mode/. I still don't think that encrypting entries within a YAML file requires a reimplementation of Mode, as you said earlier, only encrypting local files.
- It's hard to say what the reference template is, since under normal circumstances, JDBC implementations cover most scenarios. Just refer to the processing of normal unit tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] shardingsphere H2database snyk issue [shardingsphere]
Posted by "xs996 (via GitHub)" <gi...@apache.org>.
xs996 closed issue #30656: shardingsphere H2database snyk issue
URL: https://github.com/apache/shardingsphere/issues/30656
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org