[Java][FlightSQL][JDBC] Driver drops TLS for endpoint locations advertised by the server
- Linguagem predominante
- Java
- Estrelas
- 94
- Forks
- 152
- Merge médio
- 3d 16h
- PRs com merge (30d)
- 11
Descrição
When a query result has endpoints with non-empty locations, `ArrowFlightSqlClientHandler.getStreams` clones the connection's `Builder` and connects to each advertised location. The clone keeps `username`/`password`, `token` and the OAuth config, and encryption is then set from the location scheme alone:
```java
.withEncryption(endpointUri.getScheme().equals(LocationSchemes.GRPC_TLS))
```
So a location with any other scheme (`grpc+tcp://` in particular) turns encryption off for that endpoint client even when the connection was opened with `useEncryption=true`. `build()` then runs the handshake and sends the credentials over the plaintext channel to the advertised host.
The documented meaning of `useEncryption` (default `true`) is "Whether to use TLS (the default is an encrypted connection)", so a server-supplied string silently overriding it is surprising: a compromised or hostile Flight SQL server, or anything able to influence the `FlightInfo` it returns, can have the driver hand over the user's credentials in cleartext, and a passive attacker on the endpoint path can read them.
Reproduced against a handler built with `withEncryption(true)` plus a username/password, given a `FlightInfo` with one endpoint at `Location.forGrpcInsecure(...)`: the driver attempts the connection and reaches `ClientHandshakeWrapper` on the unencrypted channel instead of refusing it.
`arrow-flight-sql-jdbc-driver`, main.
Guia de contribuição
Direção de pesquisa
Comece em ArrowFlightSqlClientHandler.getStreams e rastreie como as localizações dos endpoints anunciados configuram os clientes clonados; inspecione ClientHandshakeWrapper para verificar o caminho de handshake observado. Reproduza com withEncryption(true), credentials e um endpoint FlightInfo inseguro e, em seguida, adicione cobertura de regressão mostrando que o requisito de criptografia configurado não é perdido silenciosamente e que credentials não são enviados em texto simples.
Escrita pelo modelo de indexação a partir do texto da issue.
Avaliação
- Stack de tecnologia
- java
- Domínio
- security
- Tipo de issue
- Bug
- Dificuldade
- 3/5
- Tempo estimado
- 1-2 dias
- Status de atividade
- Pouca atividade
- Clareza
- Claramente especificada
- Facilidade para iniciantes
- 72/100