[
https://issues.apache.org/jira/browse/CASSPYTHON-29?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126500#comment-18126500
]
Brad Schoening edited comment on CASSPYTHON-29 at 10/12/26 8:47 PM:
--------------------------------------------------------------------
[~jeremiah] [~absurdfarce] :
1) The Co-pilot review also flagged the accidental exposure security
vulnerability this introduces.
CopilotAI (Medium)
{quote}{color:#172b4d}Because these options may be surfaced server-side (e.g.,
{color}{{{}system_views.clients{}}}{color:#172b4d}) and can be observable by
operators, the docs should explicitly warn users not to include
secrets/credentials in {color}{{{}extra_startup_options{}}}{color:#172b4d}.
Adding a short note here (and/or in the API docs page) would help prevent
accidental sensitive-data exposure.{color}
{quote}
Instead of warning users not to leak secrets in {{STARTUP}} options, we
shouldn't open a vector that design-pattern-wise invites credential leakage in
the first place.
2) My second concern is the Multi-Stage Backdoor where each individual
stand-alone commit looks innocuous but acts as a piece of a puzzle. This is a
generic example:
* *Commit 1:* Introduces a source (e.g., accepting an unvalidated input or
helper function).
* *Commit 2:* Modifies memory limits or buffers.
* *Commit 3:* Introduces a sink (e.g., executing or decoding the payload using
the changes from earlier commits).
The best way to prevent Multi-Stage Backdoor is to follow OWASP best practices
by validating input and allowlisting expected keys. For an example, see the
[PostgreSQL JDBC SCRAM Loop Hole
CVE-2026-42198|https://nvd.nist.gov/vuln/detail/cve-2026-42198]
was (Author: bschoeni):
[~jeremiah] [~absurdfarce] :
1) The Co-pilot review also flagged the accidental exposure security
vulnerability this introduces.
CopilotAI (Medium)
{quote}{color:#172b4d}Because these options may be surfaced server-side (e.g.,
{color}{{{}system_views.clients{}}}{color:#172b4d}) and can be observable by
operators, the docs should explicitly warn users not to include
secrets/credentials in {color}{{{}extra_startup_options{}}}{color:#172b4d}.
Adding a short note here (and/or in the API docs page) would help prevent
accidental sensitive-data exposure.{color}{quote}
Instead of warning users not to leak secrets in {{STARTUP}} options, we
shouldn't open a vector that design-pattern-wise invites credential leakage in
the first place.
2) My second concern is the Multi-Stage Backdoor where each individual
stand-alone commit looks innocuous but acts as a piece of a puzzle. This is a
generic example:
* *Commit 1:* Introduces a source (e.g., accepting an unvalidated input or
helper function).
* *Commit 2:* Modifies memory limits or buffers.
* *Commit 3:* Introduces a sink (e.g., executing or decoding the payload using
the changes from earlier commits).
The best way to prevent Multi-Stage Backdoor is to follow OWASP best practices
by validating input and allowlisting expected keys.
> Allow user to specify arbitrary parameters for STARTUP message
> --------------------------------------------------------------
>
> Key: CASSPYTHON-29
> URL: https://issues.apache.org/jira/browse/CASSPYTHON-29
> Project: Apache Cassandra Python driver
> Issue Type: Improvement
> Components: Core
> Reporter: Swathi Sekar
> Assignee: Bohdan Siryk
> Priority: Normal
> Fix For: 4.0.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Modify the driver to allow sending arbitrary STARTUP message options.
> Proposed design:
> - Add `extra_startup_options` param to Cluster constructor.
> - Thread it through Cluster -> connection setup (cluster.py) ->
> StartupMessage.
> - Define clear precedence/conflict behavior when duplicate/conflicting
> options are passed into the StartupMessage constructor.
> *Note:*
> This Jira was originally created for sending the client's application name
> and version as `APPLICATION_NAME` /
> `APPLICATION_VERSION` options in the STARTUP message, which is tied to the
> now-defunct DataStax Insights offering.
> Since the Java driver (5.0.0) and eventually C/C++ driver (3.0.0) are
> removing withApplicationName()/withApplicationVersion() entirely, this ticket
> has been updated.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
