cgivre opened a new pull request, #3091: URL: https://github.com/apache/drill/pull/3091
# [MINOR-UPDATE]: Threat model: staging-area precondition for CREATE FUNCTION / CREATE DAFFODIL SCHEMA USING JAR ## Description We have received several reports claiming a user can load a malicious jar via `CREATE FUNCTION USING JAR` (and, by the same logic, a malicious DFDL schema via `CREATE DAFFODIL SCHEMA USING JAR`). Neither statement uploads content. Each only registers a jar that already exists in its staging area on the cluster filesystem (`drill.exec.udf.directory.staging` / `drill.exec.daffodil.directory.staging`); `CreateFunctionHandler` and `CreateDaffodilSchemaHandler` fail if the file is missing. Exploitation therefore requires prior write access to the Drill cluster's filesystem, which the model already treats as out of scope. Changes to `THREAT_MODEL.md`: - **§11a:** new known non-finding routing these reports to `OUT-OF-MODEL: adversary-not-in-scope`. Stays in-model only if a low-privilege client can write attacker-controlled bytes into a staging directory *through Drill itself*. Arbitrary Daffodil `schemaURI` is admin-tier format config (`OUT-OF-MODEL: trusted-input`). - **§3:** clarifies the actual trust gate for dynamic UDFs and DFDL schemas. - **§10:** operators should restrict write access to both staging directories, and may disable `exec.udf.enable_dynamic_support`. - **§14 Q4 / header:** marked partially answered; confidence counts updated. ## Documentation Threat model only; no user-visible changes. ## Testing Documentation change; behavior verified by reading the handler code. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
