Merged
Conversation
Client V2 CoverageCoverage Report
Class Coverage
|
JDBC V2 CoverageCoverage Report
Class Coverage
|
JDBC V1 CoverageCoverage Report
Class Coverage
|
Client V1 CoverageCoverage Report
Class Coverage
|
Member
|
@claude review |
|
Claude finished @mshustov's task in 2m 21s —— View job Code Review
Findings1. SQL Injection via cluster name —
|
| What changed | New cluster_name driver property in jdbc-v2 (DriverProperties, ConnectionImpl); when set, cancel() appends ON CLUSTER <name> to KILL QUERY. |
| Compatibility risk | Low — the new property is opt-in with a null default, and existing behavior (cancel without ON CLUSTER) is fully preserved when not set. No public API signatures changed. |
| Tests | An integration test is included but has a resource leak and relies on a fragile error-message assertion. No positive path test. |
| Docs | docs/features.md should be updated to document the new cluster-aware cancellation behavior. |
| Security | The cluster name should be properly quoted with SQLUtils.enquoteIdentifier() before SQL embedding. |
Contributor
Author
|
@claude[agent] review |
Contributor
Author
|
@claude[agent] review |
Contributor
Author
|
@claude review |
|
Claude finished @chernser's task in 2m 3s —— View job Code Review
FindingsMediumSQL injection still possible — The previous review flagged unquoted cluster name interpolation. Single quotes were added, but embedded single quotes in the cluster name are not escaped: connection.onCluster ? " ON CLUSTER '" + connection.cluster + "' " : " ",If KILL QUERY ON CLUSTER 'my'cluster' WHERE query_id = '...'This is malformed SQL. The codebase already has the right helper: LowUnrelated test disabled in v1 JDBC —
This should either be reverted and handled in a separate PR, or the justification made explicit with a linked issue. Very LowRedundant
this.cluster = tmpClusterName == null ? null : tmpClusterName.trim(); // trimmed here
this.onCluster = this.cluster != null && !this.cluster.trim().isEmpty(); // .trim() redundantUnused import —
Unnecessary cast in test —
Resolved from Previous Review
Human Review Instructions for Important Changes
Verdict
The SQL injection risk from unescaped single quotes in the cluster name was not fully resolved — the quoted but unescaped interpolation is still exploitable if the cluster name contains a |
Contributor
Author
|
@claude review |
|
Claude finished @chernser's task in 1m 40s —— View job Code Review
FindingsMediumSQL injection still present — The cluster name is now quoted with backticks, but embedded backticks are not escaped: connection.onCluster ? " ON CLUSTER `" + connection.cluster + "` " : " ",If KILL QUERY ON CLUSTER `test`cluster` WHERE query_id = '...'This is malformed SQL. The correct fix is to use the existing helper Low
The compatibility-sensitive trait added in
But the actual SQL uses backtick quoting, not single-quote quoting. If the quoting is fixed to Unrelated test disabled —
Very LowRedundant
this.cluster = tmpClusterName == null ? null : tmpClusterName.trim(); // trimmed here
this.onCluster = this.cluster != null && !this.cluster.trim().isEmpty(); // .trim() redundantUnused import —
Unnecessary cast —
Resolved from Previous Reviews
Human Review Instructions for Important Changes
Verdict
The SQL injection path via unescaped backtick quoting (Medium finding) remains. Replace the raw string concatenation with |
Contributor
Author
|
@claude review |
|
Claude finished @chernser's task in 1m 12s —— View job Code Review
FindingsPreviously reported issues — now resolved
Remaining IssuesLow —
|
Contributor
Author
|
@claude review |
|
Claude finished @chernser's task in 1m 33s —— View job Code Review
FindingsHigh
Medium
LowSQL injection — fully resolved ✅
Both the feature entry (line 52) and the compatibility-sensitive trait (line 70) describe the generated SQL as Unrelated test disabled —
Very LowUnused import —
Unnecessary cast in test —
Previously Reported — Now Resolved
Human Review Instructions for Important Changes
Verdict
The core SQL injection risk from the cluster name is properly resolved using |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds the ability to define a target cluster for statements like
KILL QUERYwhen using thejdbc-v2driver. In environments where ClickHouse runs as a cluster, cancelling a query requires theON CLUSTER <cluster_name>clause to effectively stop the execution across all nodes.Changes Made
cluster_nametoDriverPropertiesto allow users to specify their target cluster during connection initialization.ConnectionImplnow reads thecluster_nameproperty and activates the internalonClusterstate if it is provided.testCancelOnClusterinStatementTestto verify thatStatement.cancel()successfully includes the cluster clause when thecluster_nameproperty is set.Closes #2837
Checklist
Delete items not relevant to your PR: