JoegenUSTC opened a new issue, #11839:
URL: https://github.com/apache/gravitino/issues/11839
### Version
main branch
### Describe what's wrong
### Describe what's wrong
Two SQL injection vulnerabilities exist in the ClickHouse catalog:
**1. `ClickHouseDatabaseOperations` does not override
`generateDatabaseExistSql`.**
The inherited default from `JdbcDatabaseOperations` queries
`information_schema.SCHEMATA`, which ClickHouse does not support. Calling
`exist()` therefore always fails. Even if the SQL were valid for ClickHouse,
the database name is interpolated via `String.format("'...%s...'")` without
escaping single quotes, leaving it open to injection.
**2. `ClickHouseTableOperations.getIndexes()` does not escape `databaseName`
or `tableName`.**
Both arguments are interpolated into `QUERY_INDEXES_SQL` via
`String.formatted()` without escaping. A name containing a single quote breaks
the SQL and could be exploited.
The project already has `ClickHouseClusterUtils.escapeSingleQuotes()` — the
same utility used by `generateCreateDatabaseSql`, `generateAlterTableSql`, and
others. Both code paths should reuse it.
### Error message and/or stacktrace
N/A. Found via code review. Normal names work; names with single quotes
cause a SQL syntax error or potential injection.
### How to reproduce
1. Create a ClickHouse catalog in Gravitino.
2. Call `exist("test'db")` or load a table whose database/table name
contains a single quote.
3. `exist()` silently fails (the default SQL targets `information_schema`
which ClickHouse lacks).
4. `getIndexes()` throws a SQL syntax error because the single quote is
unescaped.
### Additional context
Fix:
- Override `generateDatabaseExistSql` in `ClickHouseDatabaseOperations` to
query `system.databases` with escaped single quotes.
- Escape `databaseName` and `tableName` in `getIndexes()` using the
existing `escapeSingleQuotes` utility.
Both patterns are already established in the module (e.g.,
`generateCreateDatabaseSql`, `generateAlterTableSql`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
