Skip to content

DotRocks 1.3.2

Choose a tag to compare

View all tags
@kidoz kidoz released this 08 Jul 18:20
v1.3.2
87b4354

A patch release of DotRocks — a native .NET driver, Entity Framework Core provider, and Roslyn analyzer suite built specifically for StarRocks. It implements its own managed StarRocks client protocol and takes no runtime dependency on any MySQL driver. This release comes from a focused security review of the driver: it hardens Stream Load against SSRF and DNS rebinding, makes connection-string validation fail closed instead of silently downgrading, stops session state leaking across pooled leases, bounds pool growth, and turns a malformed-TIME parser crash into a controlled protocol error.

Fixed

  • A binary TIME value whose components overflow TimeSpan now surfaces as a controlled malformed-packet error instead of an uncaught OverflowException.
  • Dormant connection pools (no idle connections and no outstanding leases) are reaped from the process-wide registry so connection strings that vary per request no longer accumulate pool objects and their eviction timers; reaping is coordinated with lease admission.

Security

  • Stream Load redirects are vetted at connect time: the request host is resolved once and the socket connects to exactly that vetted address, refusing loopback, link-local (including the 169.254.169.254 and IPv6 fd00:ec2::254 cloud-metadata endpoints), multicast, unspecified, and IPv6 unique-local targets unless the configured endpoint is itself loopback. This closes an SSRF / credential-forwarding and DNS-rebinding gap and fails closed on resolution failure; the configured endpoint host is trusted and exempt, so only server-chosen redirect hosts are vetted.
  • Unrecognized Ssl Mode values — including out-of-range numeric strings and undefined typed-enum values set through the connection-string builder — now fail closed instead of silently negotiating a plaintext connection.
  • Session state mutated by a prepared statement (for example SET @tenant := ? or a SELECT ... := ... user-variable assignment) is no longer reused across leases of a pooled connection.
  • Maximum Pool Size is bounded (rejected at both the connection-string builder setter and parse) to resist resource exhaustion from an oversized pool.

Compatibility

  • .NET 10 / C# 14. Source-compatible with 1.3.1 — no public API surface changes. Behavior changes worth noting: an unrecognized Ssl Mode, an oversized Maximum Pool Size, and a Stream Load redirect to an internal/loopback address now fail fast instead of silently proceeding.

Full Changelog: v1.3.1...v1.3.2

Assets 2
Loading