potiuk commented on code in PR #5126: URL: https://github.com/apache/calcite/pull/5126#discussion_r3862052416
########## AGENTS.md: ########## @@ -0,0 +1,43 @@ +# Agent guidance + +This file is read by automated agents (security scanners, code analyzers, +AI assistants) operating on this repository. It points them at the +human-authored references they should consult before producing output. + +## Security + +Security model: [SECURITY.md](./SECURITY.md), which links to the project's +threat model at +[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md). + +Calcite is an embedded SQL framework, not a server. It opens no socket and +has no authentication or authorization of its own; the host application +owns transport, identity, and schema scoping. Read the threat model before +reporting anything — it is explicit about what it does and does not treat +as a vulnerability. + +Two rules carry most of the triage weight: + +- **Surprising vs unsurprising class loading.** A class named through a + Calcite SPI position — `schemaFactory`, `parserFactory`, `typeSystem`, + `metaTableFactory`, `metaColumnFactory`, `tableFactory`, function + classes, `dataSource`, `jdbcDriver`, `model` — is loaded only through + that SPI, gated by `Class.forName(name, false, loader)` plus an + `isAssignableFrom` check. A class that does not implement the SPI for + its position is never instantiated by name. SQL may name SPI classes, + but only SPI implementations run, and only through their SPI. +- **Pushed-down SQL.** The SQL Calcite generates and sends to a backend + the operator configured is *not* a vulnerability — the query author can + already reach that endpoint through the visible schemas. A pushdown bug + that reads *beyond* the configured schemas is P4 and *is* one. + +Explicitly not vulnerabilities (see the model's "Not a vulnerability" +section): the os-adapter running OS commands, the file/CSV/JSON adapters +reading paths they were configured with, anything requiring a changed +system property or classpath, a third-party driver's behaviour past the +connection boundary, and cross-tenant reads that follow from the embedder +exposing several principals' schemas on one connection. + +The model also lists what belongs to the host rather than the library — +transport and identity, schema scoping, adapter selection, the classpath, +and whatever a `model` points at — under "Downstream responsibilities". Review Comment: Correct. I am not even sure why it ended up here eventually (long time ago and I had about 100 of similar PRs :( and most of them were bare minimum and linking to SECURITY.md for more details. This is a bit of the problem with Agentically generated PRs that things like that can slip - especially when you do a lot of those in a short time (learning for me as well to pay more attention). Thanks @vlsi for updating it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
