[jira] [Work logged] (KNOX-3442) Harden H2 JDBC URL construction against connection-string injection via gateway.database.name

[ASF GitHub Bot (Jira)]

     [ 
https://issues.apache.org/jira/browse/KNOX-3442?focusedWorklogId=1040302&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1040302
 ]

ASF GitHub Bot logged work on KNOX-3442:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 08/Sep/26 17:36
            Start Date: 08/Sep/26 17:36
    Worklog Time Spent: 10m 
      Work Description: github-actions[bot] commented on PR #1383:
URL: https://github.com/apache/knox/pull/1383#issuecomment-5589290478

   ## Test Results
     4 files    4 suites   23s ⏱️
    84 tests  84 ✅ 0 💤 0 ❌
   102 runs  102 ✅ 0 💤 0 ❌
   
   Results for commit 45acc418.
   
   
[test-results]:data:application/gzip;base64,H4sIAI9HoGoC/13MQQ6DIBCF4asY1l0AjhV7mWY6YDKpSoOwMr170ailXX7/S94ieh7cLG4VXCoxJ44nbAoY2U+Zus7OS1w3AwfucyL6K09+5SLP0CMPP8GF4MNeQprWRyX1juOxLN/HzcXh5vKP/DhyzBDQIBEoA1SjdWhUp6V1D+2UArwai7ZpQbWdeH8AH8TgLgIBAAA=
   




Issue Time Tracking
-------------------

    Worklog Id:     (was: 1040302)
    Time Spent: 20m  (was: 10m)

> Harden H2 JDBC URL construction against connection-string injection via 
> gateway.database.name
> ---------------------------------------------------------------------------------------------
>
>                 Key: KNOX-3442
>                 URL: https://issues.apache.org/jira/browse/KNOX-3442
>             Project: Apache Knox
>          Issue Type: Improvement
>          Components: Server
>    Affects Versions: 3.1.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> KNOX-3401 added H2. H2DataSourceFactory builds the URL by raw concatenation:
> {noformat}
> String url = "jdbc:h2:" + gatewayConfig.getDatabaseName();   // :49
> {noformat}
> {{gateway.database.name}} comes straight from {{gateway-site.xml}}, 
> unvalidated. H2 URLs are an RCE sink: an appended {{;INIT=RUNSCRIPT FROM 
> 'http://…'}} (or CREATE ALIAS …) runs arbitrary code at datasource creation.
> The embedded path is safe ({{{}EmbeddedH2Database{}}} sets a trusted 
> {{securityDir}} file path), but a manually-configured non-embedded H2 
> deployment flows the raw value into the URL. Operator-controlled/trusted 
> config, so low severity, but cheap defense-in-depth.
> Fix: reject H2 code-execution tokens ({{{}INIT/RUNSCRIPT/ALIAS{}}}, 
> case-insensitive) in the name at URL construction, fail-fast. Not a blanket 
> {{';'}} ban, because valid H2 settings exist (e.g. 
> {{{}mem:knox;DB_CLOSE_DELAY=-1{}}}).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)