This is an automated email from the ASF dual-hosted git repository.
asf-ci-deploy pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/calcite-site.git
The following commit(s) were added to refs/heads/main by this push:
new 00b4dc863 Website deployed from
calcite@ba8f1f9499f6a50ac47ce46b5510bbd21bfbc9f9
00b4dc863 is described below
commit 00b4dc863549c19c8c628feaf22395cc707a0852
Author: rubenada <[email protected]>
AuthorDate: Thu Oct 29 18:23:34 2026 +0000
Website deployed from calcite@ba8f1f9499f6a50ac47ce46b5510bbd21bfbc9f9
---
docs/file_adapter.html | 19 ++++++++++++++++++-
docs/history.html | 7 +++++++
docs/security_threat_model.html | 26 +++++++++++++++++++++++++-
docs/tutorial.html | 6 ++++++
img/avatars/caicancai.png | Bin 214512 -> 222133 bytes
img/avatars/jacques-n.png | Bin 276298 -> 286797 bytes
img/avatars/jpullokkaran.png | Bin 1527 -> 3254 bytes
img/avatars/kgyrtkirk.png | Bin 1506 -> 3174 bytes
img/avatars/liyafan82.png | Bin 1523 -> 3260 bytes
img/avatars/minji-kim.png | Bin 71156 -> 73732 bytes
img/avatars/snuyanzin.png | Bin 1557 -> 3275 bytes
img/avatars/vvysotskyi.png | Bin 1558 -> 3250 bytes
12 files changed, 56 insertions(+), 2 deletions(-)
diff --git a/docs/file_adapter.html b/docs/file_adapter.html
index efe1aa843..a6af26758 100644
--- a/docs/file_adapter.html
+++ b/docs/file_adapter.html
@@ -101,6 +101,12 @@
<p>The file adapter is able to read files in a variety of formats,
and can also read files over various protocols, such as HTTP.</p>
+<p>The file adapter dereferences only local <code class="language-plaintext
highlighter-rouge">file:</code> sources by default. Table <code
class="language-plaintext highlighter-rouge">url</code>
+operands naming remote protocols (<code class="language-plaintext
highlighter-rouge">http</code>, <code class="language-plaintext
highlighter-rouge">https</code>, <code class="language-plaintext
highlighter-rouge">ftp</code>, <code class="language-plaintext
highlighter-rouge">jar</code>, …) or remote
+<code class="language-plaintext highlighter-rouge">file:</code> URLs (<code
class="language-plaintext highlighter-rouge">file://host/...</code>) are
+supported only if the adapter is deployed with the appropriate system
+property, see <a href="#enabling-remote-fetches">Enabling remote
fetches</a>.</p>
+
<p>For example if you define:</p>
<ul>
@@ -227,7 +233,10 @@ sqlline> <span class="k">select</span> <span
class="k">*</span> from sales.em
<p>Now for a more complex example. This time we connect to Wikipedia via
HTTP, read pages for US states and cities, and extract data from HTML
tables on those pages. The tables have more complex formats, and the
-file adapter helps us locate and parse data in those tables.</p>
+file adapter helps us locate and parse data in those tables.
+Note: since remote protocols are disabled by default (see
+<a href="#enabling-remote-fetches">Enabling remote fetches</a>), run this
example with
+<code class="language-plaintext
highlighter-rouge">JAVA_OPTS='-Dcalcite.file.urls.allowed=https?://en\.wikipedia\.org/.*'
./sqlline</code>.</p>
<p>Tables can be simply defined for immediate gratification:</p>
@@ -393,6 +402,14 @@ sqlline> <span class="k">select </span>distinct deptno
from depts<span class=
+--------+
3 rows selected <span class="o">(</span>0.985 seconds<span
class="o">)</span></code></pre></figure>
+<h2 id="enabling-remote-fetches">Enabling remote fetches</h2>
+
+<p>From version 1.43.0 onwards, the file adapter dereferences only local <code
class="language-plaintext highlighter-rouge">file:</code> sources by default.
+Table <code class="language-plaintext highlighter-rouge">url</code> operands
naming remote URLs (<code class="language-plaintext
highlighter-rouge">http</code>, <code class="language-plaintext
highlighter-rouge">https</code>, <code class="language-plaintext
highlighter-rouge">ftp</code>, <code class="language-plaintext
highlighter-rouge">jar</code>, <code class="language-plaintext
highlighter-rouge">file://host/</code>, …) are
+rejected with <code class="language-plaintext
highlighter-rouge">IllegalArgumentException</code> unless they match the
regular expression specified by the
+<a
href="/javadocAggregate/org/apache/calcite/config/CalciteSystemProperty.html#FILE_URLS_ALLOWED"><code
class="language-plaintext
highlighter-rouge">calcite.file.urls.allowed</code></a>
+system property.</p>
+
<h2 id="future-improvements">Future improvements</h2>
<p>We are continuing to enhance the adapter, and would welcome
diff --git a/docs/history.html b/docs/history.html
index a6f7d8f1b..0d9822c8a 100644
--- a/docs/history.html
+++ b/docs/history.html
@@ -187,6 +187,13 @@ check the width of each group, and turned `1-2-3-4-5` into
requires exactly 16 bytes; a longer value used to be truncated. Blanks are not
trimmed.
+* [<a
href="https://issues.apache.org/jira/browse/CALCITE-7860";>CALCITE-7860</a>]
+The file adapter now dereferences only local `file:` sources by default. Table
+`url` operands naming remote URLs (`http`, `https`, `ftp`, ...; including
`file://localhost/`,
+and `jar:` even when it wraps a local file) are rejected with
`IllegalArgumentException`
+unless they match the new `calcite.file.urls.allowed` system property. See
+[Enabling remote fetches](/docs/file_adapter.html#enabling-remote-fetches).
+
* [<a
href="https://issues.apache.org/jira/browse/CALCITE-7760";>CALCITE-7760</a>]
The Spark engine now requires the operator-level opt-in system property
`-Dcalcite.enable.spark=true`. The `spark` connection property alone no longer
diff --git a/docs/security_threat_model.html b/docs/security_threat_model.html
index 9a999c643..3fcbfcc98 100644
--- a/docs/security_threat_model.html
+++ b/docs/security_threat_model.html
@@ -112,7 +112,11 @@ vulnerability.</p>
<li><a href="#security-properties"
id="markdown-toc-security-properties">Security properties</a></li>
<li><a href="#always-a-vulnerability"
id="markdown-toc-always-a-vulnerability">Always a vulnerability</a></li>
<li><a href="#not-a-vulnerability" id="markdown-toc-not-a-vulnerability">Not
a vulnerability</a></li>
- <li><a href="#downstream-responsibilities"
id="markdown-toc-downstream-responsibilities">Downstream
responsibilities</a></li>
+ <li>
+<a href="#downstream-responsibilities"
id="markdown-toc-downstream-responsibilities">Downstream responsibilities</a>
<ul>
+ <li><a href="#example-modules" id="markdown-toc-example-modules">Example
modules</a></li>
+ </ul>
+ </li>
<li>
<a href="#surprising-vs-unsurprising-class-loading"
id="markdown-toc-surprising-vs-unsurprising-class-loading">Surprising vs
unsurprising class loading</a> <ul>
<li><a href="#triage-rule-for-class-loading-sinks"
id="markdown-toc-triage-rule-for-class-loading-sinks">Triage rule for
class-loading sinks</a></li>
@@ -286,6 +290,17 @@ visible.</li>
must add it on purpose.</li>
<li>A file, CSV, or JSON adapter reading the local path it was configured
with. Opt-in, by the same reasoning as the os-adapter.</li>
+ <li>The file adapter dereferencing a remote URL (<code
class="language-plaintext highlighter-rouge">http</code>, <code
class="language-plaintext highlighter-rouge">https</code>, <code
class="language-plaintext highlighter-rouge">ftp</code>, <code
class="language-plaintext highlighter-rouge">jar</code>,
+…, or a <code class="language-plaintext highlighter-rouge">file:</code> URL
naming a host, which Windows opens over SMB) named in a
+table <code class="language-plaintext highlighter-rouge">url</code> operand,
once the URL matches the regular expression that the
+operator has set in the JVM system property <code class="language-plaintext
highlighter-rouge">calcite.file.urls.allowed</code>. Only
+local <code class="language-plaintext highlighter-rouge">file:</code> is
dereferenced by default; a query author cannot set the property
+(see <a href="#attacker-and-trust-boundary">Attacker and trust boundary</a>),
so any
+fetch of an allowed URL is operator-authorised behaviour, not a P3
+violation. This includes any redirect the remote server returns:
+<code class="language-plaintext
highlighter-rouge">calcite.file.urls.allowed</code> constrains only the URL in
the operand,
+not where the server redirects the request. Opt-in, by the same reasoning
+as the os-adapter.</li>
<li>The Spark engine and its side effects: a local <code
class="language-plaintext highlighter-rouge">JavaSparkContext</code>, a
local HTTP class server that serves compiled query classes, and setting
the <code class="language-plaintext
highlighter-rouge">spark.repl.class.uri</code> JVM system property. The <code
class="language-plaintext highlighter-rouge">spark</code> connection
@@ -342,6 +357,15 @@ references is configured and patched by the operator; its
behavior past the
connection boundary is out of this model.</li>
</ul>
+<h3 id="example-modules">Example modules</h3>
+
+<p>Modules under <code class="language-plaintext
highlighter-rouge">example/</code> (<code class="language-plaintext
highlighter-rouge">example-csv</code>, <code class="language-plaintext
highlighter-rouge">example-function</code>) are teaching
+artifacts referenced from the <a href="/docs/tutorial.html">tutorial</a>,
+not production adapters. They are held to a lower bar than the rest of Calcite:
+a finding whose only reachable path is through an <code
class="language-plaintext highlighter-rouge">example/</code> module, with no
+matching path in a production module, is a documentation issue rather than a
+vulnerability.</p>
+
<h2 id="surprising-vs-unsurprising-class-loading">Surprising vs unsurprising
class loading</h2>
<p>Calcite loads a class named in a connection property or in SQL only to use
it
diff --git a/docs/tutorial.html b/docs/tutorial.html
index e81bdddf8..6eb449a11 100644
--- a/docs/tutorial.html
+++ b/docs/tutorial.html
@@ -127,6 +127,12 @@ filter out rows according to simple predicates;</li>
to relational operators using planner rules.</li>
</ul>
+<p><strong>Note:</strong> Calcite-example-CSV is pedagogical code. It is
intentionally minimal
+and does not carry the security hardening that ships in the production
+<a href="/docs/file_adapter.html">file adapter</a>. Do not embed
+it in a service that exposes its <code class="language-plaintext
highlighter-rouge">model</code> or JDBC connection properties to an
+untrusted query author; use <code class="language-plaintext
highlighter-rouge">calcite-file</code> instead.</p>
+
<h2 id="download-and-build">Download and build</h2>
<p>You need Java (version 8, 9 or 10) and Git.</p>
diff --git a/img/avatars/caicancai.png b/img/avatars/caicancai.png
index aa5f8124d..df5efc89b 100644
Binary files a/img/avatars/caicancai.png and b/img/avatars/caicancai.png differ
diff --git a/img/avatars/jacques-n.png b/img/avatars/jacques-n.png
index 6712d7461..0c3628461 100644
Binary files a/img/avatars/jacques-n.png and b/img/avatars/jacques-n.png differ
diff --git a/img/avatars/jpullokkaran.png b/img/avatars/jpullokkaran.png
index 52686fc98..b6ed4c7f7 100644
Binary files a/img/avatars/jpullokkaran.png and b/img/avatars/jpullokkaran.png
differ
diff --git a/img/avatars/kgyrtkirk.png b/img/avatars/kgyrtkirk.png
index 3c2764135..ffaf28d37 100644
Binary files a/img/avatars/kgyrtkirk.png and b/img/avatars/kgyrtkirk.png differ
diff --git a/img/avatars/liyafan82.png b/img/avatars/liyafan82.png
index 426aea919..ccbbf0c2c 100644
Binary files a/img/avatars/liyafan82.png and b/img/avatars/liyafan82.png differ
diff --git a/img/avatars/minji-kim.png b/img/avatars/minji-kim.png
index bc3cdcc97..20fb9cad2 100644
Binary files a/img/avatars/minji-kim.png and b/img/avatars/minji-kim.png differ
diff --git a/img/avatars/snuyanzin.png b/img/avatars/snuyanzin.png
index 0e7eee778..225c94be3 100644
Binary files a/img/avatars/snuyanzin.png and b/img/avatars/snuyanzin.png differ
diff --git a/img/avatars/vvysotskyi.png b/img/avatars/vvysotskyi.png
index aad50adad..23b9f3b88 100644
Binary files a/img/avatars/vvysotskyi.png and b/img/avatars/vvysotskyi.png
differ
