Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SQL control characters are able to rewrite log information #33020

Open
bkuschel opened this issue Dec 21, 2021 · 0 comments
Open

SQL control characters are able to rewrite log information #33020

bkuschel opened this issue Dec 21, 2021 · 0 comments
Labels
feature minor Priority: minor

Comments

@bkuschel
Copy link
Contributor

bkuschel commented Dec 21, 2021

You have to provide the following information whenever possible.

Certain type of log output could contain control characters and rewrite the log output, potentially providing the ability to spoof false entries.
Example (constructed together with @alexey-milovidov):

echo -e "SELECT '\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x1b[2;37;41m <Error> Alert! Reset your password here at https://clickhouse.owned/resetpassword\x1b[2;37;0m'" | clickhouse-client

This will write the following to the logs:

2021.12.21 16:31:21.113844 [ 17527 ] {29ed3a0f-ff56-4747-8bc4-dec99a488fb7} <Error> Alert! Reset your password here at https://clickhouse.owned/resetpassword'
2021.12.21 16:31:21.114009 [ 17527 ] {29ed3a0f-ff56-4747-8bc4-dec99a488fb7} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON system.one

A clear and concise description of what works not as it is supposed to.

The logger's OwnPatternFormatter may need to support the containment of control character output from SQL and other logging output so that it is not able to spoof log output.

Reporting for release 21.3+

@bkuschel bkuschel added the potential bug To be reviewed by developers and confirmed/rejected. label Dec 21, 2021
@alexey-milovidov alexey-milovidov added the minor Priority: minor label Dec 21, 2021
@alexey-milovidov alexey-milovidov self-assigned this Dec 21, 2021
@alexey-milovidov alexey-milovidov added feature and removed potential bug To be reviewed by developers and confirmed/rejected. labels Jan 9, 2022
@alexey-milovidov alexey-milovidov removed their assignment Feb 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature minor Priority: minor
Projects
None yet
Development

No branches or pull requests

2 participants