branch-4.1: [fix](audit) escape 0x1F/0x1E in audit_log stream load to prevent row forgery #66580 - #66592
Open
github-actions[bot] wants to merge 1 commit into
Open
branch-4.1: [fix](audit) escape 0x1F/0x1E in audit_log stream load to prevent row forgery #66580#66592github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
… forgery (#66580) ## Proposed changes The builtin audit plugin frames its stream-load payload for `__internal_schema.audit_log` with `0x1F` as the column separator and `0x1E` as the row delimiter (see `AuditLoader.AUDIT_TABLE_COL_SEPARATOR` / `AUDIT_TABLE_LINE_DELIMITER`). In `AuditLoader.fillLogBuffer`, however, the string columns — statement text, catalog/db, user, changed variables, error message, workload group, etc. — were appended without escaping. Because these fields can carry user-controlled content (and a SQL statement may legitimately contain arbitrary bytes inside a block comment or string literal, which the lexer accepts), a crafted statement containing raw `0x1F`/`0x1E` could end its own audit row early and have the trailing bytes parsed as an additional, fully attacker-controlled row. This allows forging or misattributing rows in the audit table (CWE-117 log injection). ### Changes - Add `sanitizeField()` in `AuditLoader`, which replaces the two framing bytes (`0x1F`, `0x1E`) with a space. Only these two bytes are structural, so all other content — including newlines and tabs already present in SQL text — is preserved unchanged. - Route every string column in `fillLogBuffer` through the new `appendField()` helper so that new string columns added in the future are covered automatically. Numeric and boolean columns are appended directly since they can never contain these bytes. - Add unit tests asserting that injected delimiters cannot add rows or columns, and that ordinary statements pass through unchanged. The text-file audit sink (`AuditLogBuilder`, `fe.audit.log`) uses a `|key=value` format and is unaffected. ## Types of changes - [x] Bugfix (non-breaking change which fixes an issue) ## Further comments Behavior-preserving: only the two structural bytes, which are not meaningful data, are affected. Existing clusters and audit consumers are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picked from #66580