Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Always make sure to escape all strings #17649

Merged
merged 4 commits into from
Jan 30, 2025
Merged

Always make sure to escape all strings #17649

merged 4 commits into from
Jan 30, 2025

Conversation

dbussink
Copy link
Contributor

Don't directly interpolate these strings. We don't know of any user controllable ways to do this, but it's still too risky to ever do this. We always need to escape all strings.

Ideally we refactor this as well to use better statement binding in the future.

Marked this also for backports out of an abundance of care. We don't know of any way this would be abused, but we don't want to take the risk here either.

Related Issue(s)

https://github.com/vitessio/vitess/security/code-scanning/1928
https://github.com/vitessio/vitess/security/code-scanning/369

Checklist

  • "Backport to:" labels have been added if this change should be back-ported to release branches
  • If this change is to be back-ported to previous releases, a justification is included in the PR description
  • Tests were added or are not required
  • Did the new or modified tests pass consistently locally and on CI?
  • Documentation was added or is not required

@dbussink dbussink added Type: Internal Cleanup Component: VReplication Backport to: release-19.0 Needs to be back ported to release-19.0 Backport to: release-20.0 Needs to be backport to release-20.0 Backport to: release-21.0 Needs to be backport to release-21.0 labels Jan 29, 2025
@vitess-bot vitess-bot
Copy link
Contributor

vitess-bot bot commented Jan 29, 2025

Review Checklist

Hello reviewers! 👋 Please follow this checklist when reviewing this Pull Request.

General

  • Ensure that the Pull Request has a descriptive title.
  • Ensure there is a link to an issue (except for internal cleanup and flaky test fixes), new features should have an RFC that documents use cases and test cases.

Tests

  • Bug fixes should have at least one unit or end-to-end test, enhancement and new features should have a sufficient number of tests.

Documentation

  • Apply the release notes (needs details) label if users need to know about this change.
  • New features should be documented.
  • There should be some code comments as to why things are implemented the way they are.
  • There should be a comment at the top of each new or modified test to explain what the test does.

New flags

  • Is this flag really necessary?
  • Flag names must be clear and intuitive, use dashes (-), and have a clear help text.

If a workflow is added or modified:

  • Each item in Jobs should be named in order to mark it as required.
  • If the workflow needs to be marked as required, the maintainer team must be notified.

Backward compatibility

  • Protobuf changes should be wire-compatible.
  • Changes to _vt tables and RPCs need to be backward compatible.
  • RPC changes should be compatible with vitess-operator
  • If a flag is removed, then it should also be removed from vitess-operator and arewefastyet, if used there.
  • vtctl command output order should be stable and awk-able.

@vitess-bot vitess-bot bot added NeedsBackportReason If backport labels have been applied to a PR, a justification is required NeedsDescriptionUpdate The description is not clear or comprehensive enough, and needs work NeedsIssue A linked issue is missing for this Pull Request NeedsWebsiteDocsUpdate What it says labels Jan 29, 2025
@github-actions github-actions bot added this to the v22.0.0 milestone Jan 29, 2025
@GrahamCampbell
Copy link
Contributor

Does this PR need to be tested by the benchmarking system?

@dbussink dbussink removed NeedsDescriptionUpdate The description is not clear or comprehensive enough, and needs work NeedsWebsiteDocsUpdate What it says NeedsIssue A linked issue is missing for this Pull Request NeedsBackportReason If backport labels have been applied to a PR, a justification is required labels Jan 29, 2025
@dbussink
Copy link
Contributor Author

Does this PR need to be tested by the benchmarking system?

These are not in the hot path, so I don't think that really provides much value.

@dbussink dbussink force-pushed the dbussink/remove-direct-string-interpolation branch 2 times, most recently from 2550c89 to a74da36 Compare January 29, 2025 09:49
@dbussink
Always make sure to escape all strings
359128d 
Don't directly interpolate these strings. We don't know of any user
controllable ways to do this, but it's still too risky to ever do this.
We always need to escape all strings.

Ideally we refactor this as well to use better statement binding in the
future.

Signed-off-by: Dirkjan Bussink <[email protected]>
@dbussink dbussink force-pushed the dbussink/remove-direct-string-interpolation branch from a74da36 to 359128d Compare January 29, 2025 09:51
@GrahamCampbell
Copy link
Contributor

Are there no benchmarks covering vreplication performance?

@codecov Codecov
Copy link

codecov bot commented Jan 29, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 82.35294% with 6 lines in your changes missing coverage. Please review.

Project coverage is 67.74%. Comparing base (fd1186c) to head (abe155a).
Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
go/vt/vtctl/workflow/traffic_switcher.go 20.00% 4 Missing ⚠️
go/vt/vttablet/onlineddl/executor.go 0.00% 2 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #17649      +/-   ##
==========================================
- Coverage   67.75%   67.74%   -0.02%     
==========================================
  Files        1586     1586              
  Lines      255726   255753      +27     
==========================================
- Hits       173261   173252       -9     
- Misses      82465    82501      +36

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@dbussink
Copy link
Contributor Author

Are there no benchmarks covering vreplication performance?

I don't know that, but these changes here affect the metadata tracking about vreplication. It does not affect actually replaying the rows in vreplication, so hence I mentioned it's not in the hot path. I was referring here already to the vreplication hot path.

@GrahamCampbell
Copy link
Contributor

Ah, OK.

dbussink
dbussink commented Jan 29, 2025
View reviewed changes
go/vt/vttablet/tabletserver/schema/tracker.go
@@ -231,10 +231,15 @@ func (tr *Tracker) saveCurrentSchemaToDb(ctx context.Context, gtid, ddl string,
}
defer conn.Recycle()

// We serialize a blob here, encodeString is for strings only
// and should not be used for binary data.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found this with cleaning up the helpers, that here we were encoding a blob as a string which shouldn't be done.

@dbussink
Quote final string
4a05d48 
This needs to be then quoted once everything is properly escaped to be
inserted.

Signed-off-by: Dirkjan Bussink <[email protected]>
@dbussink
Revert dot change for quoted entry
abe155a 
Signed-off-by: Dirkjan Bussink <[email protected]>
timvaillancourt
timvaillancourt reviewed Jan 29, 2025
View reviewed changes
go/vt/vtctl/workflow/utils.go
@@ -627,9 +626,7 @@ func ReverseWorkflowName(workflow string) string {
// this public, but it doesn't belong in package workflow. Maybe package sqltypes,
// or maybe package sqlescape?
func encodeString(in string) string {
Copy link
Contributor

@timvaillancourt timvaillancourt Jan 29, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This identical func is defined in several files, should we make a common helper or just use sqltypes.EncodeStringSQL(...) directly? 🤔

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, we can clean up these as well now.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@timvaillancourt (and also @mattlord since you asked me about this too) Given that I aim to back port this, I think this is better / safer in a separate change. Making this change is a lot of churn / changes across many files which makes the back port harder.

So currently thinking of doing this cleanup then in a follow up PR that we don't need to back port.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good!

timvaillancourt
timvaillancourt approved these changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@timvaillancourt timvaillancourt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍. Added one optional question/nit re: func encodeString

mattlord
mattlord approved these changes Jan 29, 2025
View reviewed changes
Copy link
Contributor

@mattlord mattlord left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @dbussink !

@dbussink dbussink merged commit 10d36cb into vitessio:main Jan 30, 2025
104 checks passed
@dbussink dbussink deleted the dbussink/remove-direct-string-interpolation branch January 30, 2025 08:34
This was referenced Jan 30, 2025
Merged
Merged
Merged
dbussink pushed a commit that referenced this pull request Jan 30, 2025
@vitess-bot
[release-21.0] Always make sure to escape all strings (#17649) (#17657)
fbee63c 
Signed-off-by: Dirkjan Bussink <[email protected]>
Co-authored-by: vitess-bot[bot] <108069721+vitess-bot[bot]@users.noreply.github.com>
dbussink pushed a commit that referenced this pull request Jan 30, 2025
@vitess-bot
[release-20.0] Always make sure to escape all strings (#17649) (#17656)
052f613 
Signed-off-by: Dirkjan Bussink <[email protected]>
Co-authored-by: vitess-bot[bot] <108069721+vitess-bot[bot]@users.noreply.github.com>
dbussink pushed a commit that referenced this pull request Jan 30, 2025
@vitess-bot
[release-19.0] Always make sure to escape all strings (#17649) (#17655)
74fc34c 
Signed-off-by: Dirkjan Bussink <[email protected]>
Co-authored-by: vitess-bot[bot] <108069721+vitess-bot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@timvaillancourt timvaillancourt timvaillancourt approved these changes

@mattlord mattlord mattlord approved these changes

@rohit-nayak-ps rohit-nayak-ps Awaiting requested review from rohit-nayak-ps rohit-nayak-ps is a code owner

@deepthi deepthi Awaiting requested review from deepthi deepthi is a code owner

@harshit-gangal harshit-gangal Awaiting requested review from harshit-gangal harshit-gangal is a code owner

@systay systay Awaiting requested review from systay systay is a code owner

@shlomi-noach shlomi-noach Awaiting requested review from shlomi-noach shlomi-noach is a code owner

@ajm188 ajm188 Awaiting requested review from ajm188 ajm188 is a code owner

Assignees
No one assigned
Labels
Backport to: release-19.0 Needs to be back ported to release-19.0 Backport to: release-20.0 Needs to be backport to release-20.0 Backport to: release-21.0 Needs to be backport to release-21.0 Component: VReplication Security Type: Internal Cleanup
Projects
None yet
Milestone
v22.0.0
Development

Successfully merging this pull request may close these issues.
4 participants
@dbussink @GrahamCampbell @mattlord @timvaillancourt