Flight SQL JDBC parses boolean properties case-sensitively, silently disabling TLS for useEncryption=TRUE
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 79/100
Research direction
Find ArrowFlightConnectionConfigImpl.ArrowFlightConnectionProperty.getBoolean and inspect how it reads property values. Check the existing tests for JDBC connection properties, then add coverage for true, TRUE, True, and 1. Done means all these values enable encryption and the relevant tests pass.
Written by the indexing model from the issue text.
Description
In the Flight SQL JDBC driver, ArrowFlightConnectionConfigImpl.ArrowFlightConnectionProperty.getBoolean compares the property value with:
return valueFromProperties.equals("1") || valueFromProperties.equals("true");
Only the exact lowercase true (or 1) is treated as true. Values coming from the JDBC URL or Properties are not normalized, so a perfectly reasonable value such as useEncryption=TRUE or useEncryption=True is parsed as false.
useEncryption defaults to true and feeds ArrowFlightSqlClientHandler.Builder.withEncryption(...). When it is parsed as false, the driver connects to the server over plaintext gRPC and performs the authentication handshake (username/password, bearer token, or OAuth credentials) over the unencrypted channel. A user who believes they enabled TLS gets a cleartext connection and credential exposure instead.
Most JDBC drivers parse boolean options case-insensitively, so this is surprising and security-relevant. getBoolean should accept true case-insensitively (still honoring 1).
- Dominant language
- Java
- Stars
- 98
- Forks
- 160
- Avg merge
- 5d 9h
- Merged PRs (30d)
- 26
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/arrow-java
-
ArrowBuf.setBytes(long, ByteBuffer, int, int) does not bounds-check the source bufferPossibly taken @aryan9948 claimed this 5 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
apache/arrow-java#1336 · 1 comment ·
Maintainers usually reply within 1 day
-
ArrowFlightJdbcArray.getArray(index, count) can read past the end of the array slicePossibly taken @Arawoof06 claimed this 85 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
apache/arrow-java#1236 ·
Maintainers usually reply within 1 day
-
[Java][JDBC] ClobConsumer writes past VarCharVector data buffer for large CLOBsPossibly taken @Arawoof06 claimed this 90 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
apache/arrow-java#1230 ·
Maintainers usually reply within 1 day
-
[Java] DictionaryEncoder doesn't crash when decoding index outside of DictionaryPossibly taken @jakobhok-neo4j claimed this 147 days ago. OpenType: bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
apache/arrow-java#1158 ·
Maintainers usually reply within 1 day
-
Type: enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
apache/arrow-java#1100 ·
Maintainers usually reply within 1 day
All issues in apache/arrow-java
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
apache/rocketmq-dashboard#6610 ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
MetricsHub/metricshub-community#1396 ·
Maintainers usually reply within 1 day
-
L: java:gradle L: java:maven L: ruby:bundler T: bug 🐞
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
dependabot/dependabot-core#16547 ·
Maintainers usually reply within 1 day
-
Citationcount column sorts alphabetically instead of numericallyPossibly taken @kpunia306 claimed this today. Openstatus: needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
JabRef/jabref#17459 · 4 comments ·
Maintainers usually reply within 1 day
-
`RedisList.reversed()` view returns an empty `range` and `trim` removes all elementsPossibly taken @CCCLL claimed this today. Openstatus: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
spring-projects/spring-data-redis#3461 ·
Maintainers usually reply within 2 days