fix(jdbc): stop executing the caller-supplied selectLimit query in getTables (CVE-2026-82583) - #200
Closed
benjodo wants to merge 1 commit into
Conversation
…tTables (CVE-2026-82583) POST /connectors/jdbc/_getTables ran the selectLimit query parameter verbatim against every matched table, so any user with access to the Database connector could execute arbitrary SQL through the server (CWE-89). The query is now resolved server-side from the configured driver list (ConfigurationController.getDatabaseDrivers(), matched by driver class name or alternative class name). A caller-supplied value is only honored when it is identical to that configured query; anything else is ignored with a warning. When the driver is unknown or has no select limit configured, getTables falls back to the existing DatabaseMetaData.getColumns() path. The parameter stays on the API so existing Administrator clients keep working; they already send the server-configured value. Adds DatabaseConnectorServletTest (in-memory Derby, no external infra) proving that caller SQL never executes, including table redirection and file-write attempts, and that the configured and fallback paths still return metadata.
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
POST /connectors/jdbc/_getTables ran the selectLimit query parameter verbatim against every matched table, so any user with access to the Database connector could execute arbitrary SQL through the server (CWE-89).
The query is now resolved server-side from the configured driver list (ConfigurationController.getDatabaseDrivers(), matched by driver class name or alternative class name). A caller-supplied value is only honored when it is identical to that configured query; anything else is ignored with a warning. When the driver is unknown or has no select limit configured, getTables falls back to the existing DatabaseMetaData.getColumns() path. The parameter stays on the API so existing Administrator clients keep working; they already send the server-configured value.
Adds DatabaseConnectorServletTest (in-memory Derby, no external infra) proving that caller SQL never executes, including table redirection and file-write attempts, and that the configured and fallback paths still return metadata.