[Java][FlightSQL][JDBC] Driver drops TLS for endpoint locations advertised by the server

Open
#1,232 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java
Domain
security

Research direction

Start in ArrowFlightSqlClientHandler.getStreams and trace how advertised endpoint locations configure cloned clients; inspect ClientHandshakeWrapper for the observed handshake path. Reproduce with withEncryption(true), credentials, and an insecure FlightInfo endpoint, then add regression coverage showing that the configured encryption requirement is not silently lost and that credentials are not sent over plaintext.

Written by the indexing model from the issue text.

Description

When a query result has endpoints with non-empty locations, ArrowFlightSqlClientHandler.getStreams clones the connection's Builder and connects to each advertised location. The clone keeps username/password, token and the OAuth config, and encryption is then set from the location scheme alone:

.withEncryption(endpointUri.getScheme().equals(LocationSchemes.GRPC_TLS))

So a location with any other scheme (grpc+tcp:// in particular) turns encryption off for that endpoint client even when the connection was opened with useEncryption=true. build() then runs the handshake and sends the credentials over the plaintext channel to the advertised host.

The documented meaning of useEncryption (default true) is "Whether to use TLS (the default is an encrypted connection)", so a server-supplied string silently overriding it is surprising: a compromised or hostile Flight SQL server, or anything able to influence the FlightInfo it returns, can have the driver hand over the user's credentials in cleartext, and a passive attacker on the endpoint path can read them.

Reproduced against a handler built with withEncryption(true) plus a username/password, given a FlightInfo with one endpoint at Location.forGrpcInsecure(...): the driver attempts the connection and reaches ClientHandshakeWrapper on the unencrypted channel instead of refusing it.

arrow-flight-sql-jdbc-driver, main.

Dominant language
Java
Stars
95
Forks
154
Avg merge
2d 10h
Merged PRs (30d)
11

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/arrow-java

All issues in apache/arrow-java

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.