This is an automated email from the ASF dual-hosted git repository.
asf-ci-deploy pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/calcite-site.git
The following commit(s) were added to refs/heads/main by this push:
new 1fa4a3898 Website deployed from
calcite@e1040a73dbb5187327e004440b094014ab31af50
1fa4a3898 is described below
commit 1fa4a3898c59894d4cdd7a01977f45475c187ffe
Author: rubenada <[email protected]>
AuthorDate: Thu Sep 10 16:26:59 2026 +0000
Website deployed from calcite@e1040a73dbb5187327e004440b094014ab31af50
---
docs/history.html | 5 +++++
docs/security_threat_model.html | 11 +++++++++++
2 files changed, 16 insertions(+)
diff --git a/docs/history.html b/docs/history.html
index 76616bcd2..3e890ccb0 100644
--- a/docs/history.html
+++ b/docs/history.html
@@ -159,6 +159,11 @@ check the width of each group, and turned `1-2-3-4-5` into
requires exactly 16 bytes; a longer value used to be truncated. Blanks are not
trimmed.
+* [<a
href="https://issues.apache.org/jira/browse/CALCITE-7760";>CALCITE-7760</a>]
+The Spark engine now requires the operator-level opt-in system property
+`-Dcalcite.enable.spark=true`. The `spark` connection property alone no longer
+activates it; a connection using `spark=true` without the opt-in will fail.
+
#### New features
{: #new-features-1-43-0}
diff --git a/docs/security_threat_model.html b/docs/security_threat_model.html
index 795910022..9a999c643 100644
--- a/docs/security_threat_model.html
+++ b/docs/security_threat_model.html
@@ -286,6 +286,17 @@ visible.</li>
must add it on purpose.</li>
<li>A file, CSV, or JSON adapter reading the local path it was configured
with. Opt-in, by the same reasoning as the os-adapter.</li>
+ <li>The Spark engine and its side effects: a local <code
class="language-plaintext highlighter-rouge">JavaSparkContext</code>, a
+local HTTP class server that serves compiled query classes, and setting
+the <code class="language-plaintext
highlighter-rouge">spark.repl.class.uri</code> JVM system property. The <code
class="language-plaintext highlighter-rouge">spark</code> connection
+property alone does not activate the engine; it additionally requires
+the operator-set JVM system property <code class="language-plaintext
highlighter-rouge">calcite.enable.spark=true</code>, a
+capability a query author does not have (see
+<a href="#attacker-and-trust-boundary">Attacker and trust boundary</a>).
Opt-in,
+by the same reasoning as the os-adapter.</li>
+ <li>Reading the file or URL named by <code class="language-plaintext
highlighter-rouge">model=<uri></code>. The property names a
+resource the model handler reads on connection; letting an untrusted
+principal set connection properties authorises that read.</li>
<li>Anything that needs a changed system property or classpath. Both are
outside the attacker’s reach by assumption.</li>
<li>The behavior of a third-party driver once Calcite has connected to the
