[Java][FlightSQL][JDBC] Driver drops TLS for endpoint locations advertised by the server
- Langage dominant
- Java
- Étoiles
- 94
- Forks
- 152
- Merge moyen
- 3 j 16 h
- PR mergées (30 j)
- 11
Description
When a query result has endpoints with non-empty locations, `ArrowFlightSqlClientHandler.getStreams` clones the connection's `Builder` and connects to each advertised location. The clone keeps `username`/`password`, `token` and the OAuth config, and encryption is then set from the location scheme alone:
```java
.withEncryption(endpointUri.getScheme().equals(LocationSchemes.GRPC_TLS))
```
So a location with any other scheme (`grpc+tcp://` in particular) turns encryption off for that endpoint client even when the connection was opened with `useEncryption=true`. `build()` then runs the handshake and sends the credentials over the plaintext channel to the advertised host.
The documented meaning of `useEncryption` (default `true`) is "Whether to use TLS (the default is an encrypted connection)", so a server-supplied string silently overriding it is surprising: a compromised or hostile Flight SQL server, or anything able to influence the `FlightInfo` it returns, can have the driver hand over the user's credentials in cleartext, and a passive attacker on the endpoint path can read them.
Reproduced against a handler built with `withEncryption(true)` plus a username/password, given a `FlightInfo` with one endpoint at `Location.forGrpcInsecure(...)`: the driver attempts the connection and reaches `ClientHandshakeWrapper` on the unencrypted channel instead of refusing it.
`arrow-flight-sql-jdbc-driver`, main.
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Commencez dans ArrowFlightSqlClientHandler.getStreams et suivez la manière dont les emplacements des endpoints annoncés configurent les clients clonés ; inspectez ClientHandshakeWrapper pour le chemin de handshake observé. Reproduisez le problème avec withEncryption(true), credentials et un endpoint FlightInfo non sécurisé, puis ajoutez une couverture de régression montrant que l’exigence de chiffrement configurée n’est pas perdue silencieusement et que credentials ne sont pas envoyés en texte clair.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- java
- Domaine
- security
- Type d'issue
- Bug
- Difficulté
- 3/5
- Temps estimé
- 1-2 jours
- Activité
- Calme
- Clarté
- Clairement spécifiée
- Accessibilité débutants
- 72/100