CalvinKirs opened a new pull request, #66580:
URL: https://github.com/apache/doris/pull/66580
## Proposed changes
The builtin audit plugin frames its stream-load payload for
`__internal_schema.audit_log` with `0x1F` as the column separator and
`0x1E` as the row delimiter (see `AuditLoader.AUDIT_TABLE_COL_SEPARATOR`
/ `AUDIT_TABLE_LINE_DELIMITER`). In `AuditLoader.fillLogBuffer`, however,
the string columns — statement text, catalog/db, user, changed
variables, error message, workload group, etc. — were appended without
escaping.
Because these fields can carry user-controlled content (and a SQL
statement may legitimately contain arbitrary bytes inside a block
comment or string literal, which the lexer accepts), a crafted statement
containing raw `0x1F`/`0x1E` could end its own audit row early and have
the trailing bytes parsed as an additional, fully attacker-controlled
row. This allows forging or misattributing rows in the audit table
(CWE-117 log injection).
### Changes
- Add `sanitizeField()` in `AuditLoader`, which replaces the two framing
bytes (`0x1F`, `0x1E`) with a space. Only these two bytes are
structural, so all other content — including newlines and tabs already
present in SQL text — is preserved unchanged.
- Route every string column in `fillLogBuffer` through the new
`appendField()` helper so that new string columns added in the future
are covered automatically. Numeric and boolean columns are appended
directly since they can never contain these bytes.
- Add unit tests asserting that injected delimiters cannot add rows or
columns, and that ordinary statements pass through unchanged.
The text-file audit sink (`AuditLogBuilder`, `fe.audit.log`) uses a
`|key=value` format and is unaffected.
## Types of changes
- [x] Bugfix (non-breaking change which fixes an issue)
## Further comments
Behavior-preserving: only the two structural bytes, which are not
meaningful data, are affected. Existing clusters and audit consumers are
unchanged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
