zqr10159 commented on PR #4275: URL: https://github.com/apache/hertzbeat/pull/4275#issuecomment-5127715110
This is useful executor-level read-only validation, but it does not close the complete alert-query exposure. Low-privilege callers can still issue broad telemetry reads, expensive SELECTs, and raw PromQL; SELECT-only parsing also permits unions/subqueries across available tables. Please add an authorization/ownership boundary for preview and authoring, scope readable sources/tables, and enforce time/range/cost limits for both SQL and PromQL. I would treat the current patch as one defense-in-depth layer, not a complete remediation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
