Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

🔍 Deep Repository Review: 16 Critical, 34 High, 48 Medium findings

Aperta
  • Qualcosa non va?
#64 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

@allenkim0129 ci sta già lavorando.

Dal 8/7/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

🔍 Deep Repository Review: microsoft/multiclouddb-sdk-for-java

Date: 2026-04-27
Repo: https://github.com/microsoft/multiclouddb-sdk-for-java
Reviewer: Copilot deep-review pipeline (7 parallel agents)

📊 Aggregate Finding Counts

Severity API/Arch Cosmos DB DynamoDB Spanner Query DSL CI/CD Tests Total
🔴 CRITICAL 3 2 0 3 2 3 3 16
🟠 HIGH 7 4 4 4 5 6 4 34
🟡 MEDIUM 8 6 7 8 6 7 6 48
🟢 LOW 6 4 7 6 5 5 3 36
Total 24 16 18 21 18 21 16 134

🚨 CRITICAL Findings (Must Fix Before GA)

C1. Spanner Provider Storage Model Is Fundamentally Broken

Source: SpannerProviderClient.java, SpannerConstants.java

DDL creates tables with 3 columns (partitionKey, sortKey, data STRING(MAX)), but writeMutationFields() writes each document field as an individual Spanner column. The data column is never written to. Every write on a provisioned table fails.

Fix: Serialize docs to JSON in data column, or generate DDL matching the document schema.

C2. SQL Injection via Unquoted Table Names in Spanner

Source: SpannerExpressionTranslator.java, SpannerProviderClient.java

Table names injected via String.format() without backtick-quoting. "users; DROP TABLE users--" achieves full injection. Cosmos (fixed c alias) and DynamoDB (double-quotes) are safe.

Fix: Backtick-quote all identifiers + validate names against [a-zA-Z_][a-zA-Z0-9_]*.

C3. String Literal Injection in Expression Translators

Source: All three translator files

Inline string literals bypass parameterization. Spanner translator also missing backslash escaping.

C4. Spanner ABORTED Mapped to CONFLICT Instead of Retry

Source: SpannerErrorMapper.java

Should be TRANSIENT_FAILURE per GCP docs.

C5. No Maven Central Publishing in Release Pipeline

Source: .github/workflows/release.yml

No GPG signing, no Sonatype, no distributionManagement. Consumers can't <dependency> on this.

C6. No Spanner Emulator Integration Tests in CI

CI covers Cosmos + DynamoDB but not Spanner. Regressions ship undetected.

C7. Mutable Exception — Thread Safety Violation

Source: MulticloudDbException.java

withDiagnostics() mutates non-final field in-place. Data race across threads.

C8. Dead Conformance Tests — Never Execute

ResultSetControlConformanceTest and TtlAndMetadataConformanceTest are abstract with zero subclasses. Spanner missing from SortKeyOrderingConformanceTest.

C9. No Document Size Validation in Cosmos Provider

399KB limit mentioned in README but not enforced in provider write path.

🟠 HIGH Findings

API & Architecture
ID Finding
A-H1 Jackson ObjectNode leaked in public API — DocumentResult returns ObjectNode, writes use Map
A-H2 Inconsistent document type across read/write/query
A-H3 read() returns null instead of Optional<DocumentResult>
A-H4 Missing TIMEOUT and PRECONDITION_FAILED error categories
A-H5 expressionTranslator volatile + setter — race condition window
A-H6 QueryPage deep-copies all items on construction
A-H7 No module-info.java — internal package accessible
Cosmos DB Provider
ID Finding Best Practice
Co-H1 No retry-after for 429 throttling MS 429 docs
Co-H2 Default Gateway mode (not Direct) — latency penalty MS Direct vs Gateway
Co-H3 RU charge missing from point-op diagnostics
Co-H4 Consistency level hardcoded — not configurable
DynamoDB Provider
ID Finding Best Practice
Dy-H1 Client-side sort on scan mixes partitions Scan has no ordering
Dy-H2 No Binary/Binary Set support — data silently dropped AWS Data Types
Dy-H3 toAttributeValue() can't handle List/Map params
Dy-H4 update() bypasses DynamoErrorMapper
Spanner Provider
ID Finding Best Practice
Sp-H1 OFFSET pagination is O(n²) GCP keyset pagination
Sp-H2 TRANSACTIONS_CAP declared but unimplemented GCP R/W Transactions
Sp-H3 Spanner client leak on construction failure
Sp-H4 ORDER BY fields not sanitized — injection
Query DSL
ID Finding
Q-H1 No recursion depth limit → StackOverflow
Q-H2 No expression length limit → OOM
Q-H3 BetweenExpression/InExpression accept unvalidated Objects
Q-H4 Silent no-op on unknown Expression types
Q-H5 DynamoDB reserved words not quoted (status, name, count…)
CI/CD
ID Finding
CI-H1 No static analysis (Checkstyle/SpotBugs/PMD)
CI-H2 No JaCoCo coverage
CI-H3 No Dependabot/Renovate
CI-H4 No OWASP dependency-check
CI-H5 Release has no integration test gate
CI-H6 junit-jupiter missing <scope>test</scope> in conformance POM
Tests
ID Finding
T-H1 No thread-safety tests
T-H2 No Testcontainers — manual emulator setup
T-H3 Spanner has only 2 unit tests
T-H4 Inconsistent @Tag usage

🟡 MEDIUM Findings (48 total — summarized by area)

API (8): Missing equals/hashCode on error types, no timeout validation, capability naming collision, unbounded thread pool in provisionSchema, missing toString fields, no @Nullable annotations

Cosmos (6): No throughput/indexing in provisioning, sync-only API, query results leak system fields, setMaxBufferedItemCount misuse, capability docs wrong on TTL field name, no projection support

DynamoDB (7): No 400KB size check, binary keys break pagination, strong consistency not configurable, incompatible token formats, reserved words unquoted, number precision loss, TTL not enabled on table

Spanner (8): read() uses SQL not readRow(), translator doesn't quote tables, BATCH/CHANGE_FEED caps unimplemented, toString() for complex objects, fragile WHERE detection, brittle DDL error check, missing type handling

Query DSL (6): Negative number ambiguity, dead isAtBetweenAnd(), no function arity validation, Cosmos ignores container param, Literal accepts arbitrary Objects, DynamoDB drops missing params

CI/CD (7): Javadoc lint disabled, PAT for docs deploy, test modules not excluded from deploy, no dependency convergence, no BOM, stale plugins, no permissions block

Tests (6): Size test only on DynamoDB, fragile @Order cleanup, new client per test, no edge cases, user-agent test only on DynamoDB

✅ What's Done Well

Area Assessment
API Design Clean builders, good Javadoc, solid SPI, extensible value objects
Error Model Comprehensive categories with retryability flags
Query DSL Sealed interfaces + records, correct precedence, parameterized queries
DynamoDB Excellent error mapping, correct Query vs Scan routing, PAY_PER_REQUEST default
Cosmos Singleton client, session consistency, point-read optimization, user-agent
Module Structure Clean multi-module layout, independent versioning, centralized deps
Community Complete CONTRIBUTING, SECURITY, CLA, CODE_OF_CONDUCT, PR/issue templates
Tests 281+ tests, good parser/validator/translator coverage

Provider Best Practice Cross-Check

Azure Cosmos DB
Practice Status
Singleton client ✅
Direct mode default ⚠️ Defaults to Gateway
Session consistency ✅
Retry-after on 429 ❌
RU tracking ⚠️ Queries only
Point read via readItem ✅
User-agent tagging ✅
Amazon DynamoDB
Practice Status
AWS SDK v2 ✅
PAY_PER_REQUEST ✅
Query vs Scan routing ✅
GetItem for reads ✅
ReturnConsumedCapacity ✅ (except PartiQL)
Reserved word quoting ❌
Binary support ❌ Silently dropped
TTL enablement ❌
Google Cloud Spanner
Practice Status
readRow for point reads ❌ Uses SQL
Keyset pagination ❌ Uses OFFSET
R/W transactions ❌ Bare mutations
ABORTED retry ❌ Mapped to CONFLICT
Identifier quoting ❌ Injection risk
JSON document storage ❌ DDL mismatch
Emulator support ✅

🎯 Top 10 Priority Actions

# Action Impact
1 Fix Spanner storage model (serialize to data JSON column) Provider non-functional
2 Fix SQL injection (backtick-quote Spanner identifiers) Security
3 Fix Spanner ABORTED → TRANSIENT_FAILURE Retry handling
4 Add parser recursion/length limits DoS prevention
5 Unify document type to Map<String, Object> API consistency
6 Add Spanner CI tests + fill conformance gaps Coverage
7 Quote DynamoDB field names in PartiQL Correctness
8 Enable TTL on DynamoDB tables during provisioning Silent failure
9 Add Dependabot + OWASP + SpotBugs Security/quality
10 Cosmos: default Direct mode + configurable consistency Performance
Lingua principale
Java
Stelle
7
Fork
7
Merge medio
1g 19h
PR unite (30g)
3

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/multiclouddb-sdk-for-java

Tutte le issue di microsoft/multiclouddb-sdk-for-java

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.