vlsi opened a new pull request, #5115: URL: https://github.com/apache/calcite/pull/5115
## Jira Link [CALCITE-7605] Add threat model ## Why Calcite has no written statement of what it treats as a security vulnerability, so reporters and committers triage each report from scratch. This PR adds one: an attacker model, the properties Calcite promises and disclaims (P1–P4), and a triage rule for the class-loading sinks behind most of the recent CVEs. This builds directly on the draft in #5020 by @rubenada, which in turn started from an earlier draft of mine. The normative content here (P1–P4, "always / not a vulnerability", the surprising-vs-unsurprising class-loading rule, the DoS goals) is the same material, reorganized. Credit for getting this moving goes to that PR. ### Why a separate PR instead of comments on #5020 The changes I'm proposing are structural — drop two sections, split one out into its own file, restore some content — and that reads much better as a diff you can view whole than as a long review thread reconstructing the same edits in prose. Treat this as an alternative draft for the same Jira, not a competing effort: the PMC can merge whichever framing it prefers, or cherry-pick between them. I'm happy to fold this into #5020 instead if that's easier for the reviewers. ## What - `site/_docs/security_threat_model.md` — the normative model: attacker and trust boundary, assets, P1–P4, "always / not a vulnerability", surprising-vs-unsurprising class loading with the triage rule, and denial of service as a hardening goal. Stable content; it should not need editing per CVE. - `site/_docs/security_known_class_loading_sinks.md` — a **living, non-normative** inventory of the concrete sinks the triage rule currently applies to (`AvaticaUtils.instantiatePlugin`, `RelJson.typeNameToClass`, `JdbcSchema.create`, the `ClassNameFilter` denylist, paths to audit), carrying a `Last reviewed` date. Keeping the class names out of the policy document means a new CVE updates this page, not the ratified model. - `site/_data/docs.yml` — a "Security" menu group so both pages appear in the sidebar. - `SECURITY.md` and `AGENTS.md` are carried over from #5020; they add the private-reporting channel and are worth keeping regardless of which draft wins. ### What I dropped from #5020, and why - **The STRIDE table.** STRIDE is a discovery technique for the authoring phase, not a publication format. Run against P1–P4 it surfaces no in-scope threat the properties don't already cover more precisely, and it forces near-empty rows for categories Calcite has no surface for (Spoofing and Repudiation both need identities and sessions Calcite doesn't have). One row also mischaracterized the mechanism: it described Janino "arbitrary code execution" as attacker SQL injected into bytecode generation, but Janino compiles Calcite-generated code, and the real primitive — loading a class by name — is already covered by P1 and the class-loading section. If the PMC wants a STRIDE-style completeness check, a six-line "STRIDE category → P1–P4 / out of scope" mapping does that without a low-fidelity threat table. - **The ASCII data-flow diagram.** It restates the trust boundary the prose already defines, adds a maintenance burden, and doesn't survive screen readers or narrow viewports. The "Attacker and trust boundary" and "Assets" sections carry the same information in text. ## How to verify - `cd site && bundle exec jekyll build` (or the project's usual site build) renders both pages, and the "Security" group appears in the sidebar. - Read the two pages: every normative claim from #5020 is present, the concrete sink list has moved to the living document, and the threat-model page links to it from the triage-rule section. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
