Skip to content

[Bug] IoTDB Python Client v0.13.3: Password Authentication Bypass When enable_rpc_compression is Set to False #15016

@SunnySaman

Description

@SunnySaman

Search before asking

  • I searched in the issues and found nothing similar.

Version

I>pip list | findstr iot
apache-iotdb              0.13.3

>pip list | findstr sess

>python --version
Python 3.10.1

Describe the bug and provide the minimal reproduce step

描述:

Issue Summary:
In the IoTDB Python client library version 0.13.3, there appears to be an issue with password authentication when the parameter enable_rpc_compression in the Session.open() method is set to False. Specifically, regardless of the password provided, a successful connection can be established, which should not be the case if the password is incorrect.

Steps to Reproduce:

  1. Install IoTDB Python client library version 0.13.3.
  2. Attempt to establish a session using the following code snippet:
    from iotdb.Session import Session
    
    ip_address = "your_iotdb_ip"
    port = 6667  # Default IoTDB port
    user = "your_username"
    password = "incorrect_password"  # Intentionally incorrect password
    
    session = Session(ip_address, port, user, password)
    session.open(False)  # Setting enable_rpc_compression to False
  3. Observe that despite providing an incorrect password, the session establishes successfully without any authentication failure.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions