Aias00 opened a new pull request, #4259:
URL: https://github.com/apache/hertzbeat/pull/4259
## Summary
Fixes SQL injection in the QuestDB history-data query path.
### Vulnerability
`QuestdbDataStorage` builds all four history-query SQL templates with
`String.format`, interpolating `metric` (a column name), `table`, and
`instance` directly into the SQL. These values trace back to REST path
variables:
```
GET /api/monitor/{instance}/metric/{metricFull} // metricFull ->
app.metrics.metric
```
So `instance` and `metricFull` are attacker-controlled. Two concrete gaps:
1. **Identifiers** (`metric`, `table`) are placed inside double-quoted
identifiers with no charset check. A path value carrying a `"` or other SQL
metacharacter can break out of the identifier.
2. **String literal** for `instance` in the `WHERE metric_labels = '...'`
clause is escaped with `replace("'", "\\'")`. QuestDB does **not** treat
backslash as an escape (it follows the ANSI rule of doubling the quote), so a
stored `metric_labels` value containing a `'` stayed injectable.
### Fix
QuestDB's HTTP `/exec` endpoint does not support bind parameters, so the
read path is hardened with validation + correct escaping:
- `validateIdentifier(name, label)` — rejects `metric` and `table` values
outside `^[A-Za-z0-9_-]+$` before they reach `String.format`. Fails closed with
`IllegalArgumentException`. None of the allowed characters can terminate the
surrounding `"..."` identifier or introduce SQL syntax (a `--` inside a quoted
identifier is harmless).
- `escapeStringLiteral(value)` — replaces the broken backslash escape with
the correct QuestDB/ANSI escape: doubling the single quote (`'` → `''`).
### Verification
- `mvn -pl hertzbeat-warehouse -am compile` ✅ (JDK 25)
- `mvn -pl hertzbeat-warehouse -am checkstyle:check` ✅
- Existing valid inputs continue to work: `instance=127.0.0.1:8080` → table
`linux_cpu_127_0_0_1_8080` (matches allowlist); hyphenated hostnames also pass.
No QuestDB unit tests exist in the module today, so no existing test
coverage was extended here.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
