[
https://issues.apache.org/jira/browse/CASSPYTHON-29?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126381#comment-18126381
]
Brad Schoening edited comment on CASSPYTHON-29 at 10/12/26 3:36 PM:
--------------------------------------------------------------------
[~bohdansiryk] quick clarification: is the 64K limit applied per *<k>* and
*<v>* string, or to the entire map payload? I'm trying to understand whether
someone could send an extremely large map (e.g. 20GB) and potentially crash
nodes with OOM.
Also (maybe out of scope for this ticket): restricting keys/values to
*printable characters* (similar to the Postgres constraint) seems much safter.
I'm not seeing a practical benefit to allowing control characters like \0 or
backspace (^H) in keys/values.
{*}OWSAP Input Validation Cheat Sheet{*}: recommends allowlisting and rejecting
unexpected characters, especially those that can alter parsing or
representation.
{*}OWSAP Logging Cheat Sheet{*}: warns that control characters (notably \r, \n,
and other non-printable) can enable log forging/injection unless
normalized/escaped.
{*}OWSAP ASVS (Application Security Verification Standard){*}: has requirements
around validating and constraining inputs (type, length, character set) and
handling untrusted data safely.
was (Author: bschoeni):
[~bohdansiryk] quick clarification: is the 64K limit applied per *<k>* and
*<v>* string, or to the entire map payload? I'm trying to understand whether
someone could send an extremely large map (e.g. 20GB) and potentially crash
nodes with OOM.
Also, separate thought (and maybe out of scope for this ticket): restricting
keys/values to *printable characters* (similar to the Postgres constraint)
seems much safter. I'm not seeing a practical benefit to allowing control
characters like \0 or backspace (^H) in keys/values.
{*}OWSAP Input Validation Cheat Sheet{*}: recommends allowlisting and rejecting
unexpected characters, especially those that can alter parsing or
representation.
{*}OWSAP Logging Cheat Sheet{*}: warns that control characters (notably \r, \n,
and other non-printable) can enable log forging/injection unless
normalized/escaped.
{*}OWSAP ASVS (Application Security Verification Standard){*}: has requirements
around validating and constraining inputs (type, length, character set) and
handling untrusted data safely.
> Allow user to specify arbitrary parameters for STARTUP message
> --------------------------------------------------------------
>
> Key: CASSPYTHON-29
> URL: https://issues.apache.org/jira/browse/CASSPYTHON-29
> Project: Apache Cassandra Python driver
> Issue Type: Improvement
> Components: Core
> Reporter: Swathi Sekar
> Assignee: Bohdan Siryk
> Priority: Normal
> Fix For: 4.0.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Modify the driver to allow sending arbitrary STARTUP message options.
> Proposed design:
> - Add `extra_startup_options` param to Cluster constructor.
> - Thread it through Cluster -> connection setup (cluster.py) ->
> StartupMessage.
> - Define clear precedence/conflict behavior when duplicate/conflicting
> options are passed into the StartupMessage constructor.
> *Note:*
> This Jira was originally created for sending the client's application name
> and version as `APPLICATION_NAME` /
> `APPLICATION_VERSION` options in the STARTUP message, which is tied to the
> now-defunct DataStax Insights offering.
> Since the Java driver (5.0.0) and eventually C/C++ driver (3.0.0) are
> removing withApplicationName()/withApplicationVersion() entirely, this ticket
> has been updated.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
