Export and import paths can write CR, LF and terminal escape sequences into the server log
维护者通常 4 天内回复
还没有人认领这个 Issue。
评估
调研方向
从 crates/engine/src/import_export.rs 中的日志调用开始（约第 248-254 行），该调用使用 Display 格式化 resolved_path；同时查看 crates/engine/src/import_export_io.rs 中的 validate_path_parent（第 327-407 行）。决定将该字段改为 Debug，还是在 FilePath 中拒绝控制字符，然后在 import_export_io.rs 中添加一个单元测试，确认包含 \n、\r 或 \x1b 的名称会被拒绝。当这些测试通过，且一个捕获日志的服务器测试显示，对包含换行符的路径执行导出时恰好写入一行日志，即为完成。
由索引模型根据 Issue 内容生成。
描述
Problem
ExportTableToPointInTime logs the path it writes to with a Display field, resolved_path = %output_path.display() (crates/engine/src/import_export.rs:248-254). validate_path_parent (crates/engine/src/import_export_io.rs:327-407) refuses .., symlinks and paths outside the account's directory under an [export] paths root, and accepts every other byte in the file name, including CR, LF and ESC. The default pretty log format writes Display fields without escaping them.
A principal allowed to call ExportTableToPointInTime on a server with export paths configured can therefore end the log line early, add text formatted as a log line of its own, and send ANSI escape sequences to an operator who reads the log in a terminal. In --foreground mode (containers, systemd Type=simple) the log goes to stderr. In daemon mode it goes to syslog, where the result depends on how the syslog daemon handles control characters.
ImportTable logs its resolved path the same way (import_export.rs:60-66), but its file must already exist under an import root.
The caller gains no access it did not have. An operator who reads the log as an audit record can be misled by the added lines.
Reproduction
A SQLite build of 1c0523c9 running serve --foreground with the default log format and [export] paths set, and a user allowed dynamodb:ExportTableToPointInTime on a table:
- Call
ExportTableToPointInTimewith the table'sTableArnand aFilePathunder the account's export directory whose file name isx, then\n, then2026-10-31T23:59:59.000000Z INFO extenddb_server::management: admin login succeeded user=admin, then\r\n\x1b[31mred\x1b[0m.json. - The call returns 200 and creates a file with those bytes in its name.
- The server log shows the added text as a line of its own, starting at column 1 with its own timestamp. The next line starts with the raw escape sequence.
The same request with the path in S3Prefix in place of FilePath also returns 200 and adds the line.
The code is the same on main at f49c5f823.
Expected
The log line carries the path with control characters escaped, for example through a Debug field (resolved_path = ?output_path), so a path cannot start a new log line. FilePath is ExtendDB's own parameter and names a local file, so it can also refuse control characters (U+0000 to U+001F and U+007F) with a ValidationException. How DynamoDB answers a control character in S3Prefix has not been measured.
Tests: a unit test in import_export_io.rs that a file name holding \n, \r or \x1b is refused, and a server test that captures the log and checks that an export writes one log line.
- 主要语言
- Rust
- 星标
- 517
- 派生
- 60
- 平均合并
- 5 天 5 小时
- 30 天内合并 PR
- 41
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ExtendDB/extenddb 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 4 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 4 天内回复
-
bug security
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 4 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 4 天内回复
-
Launch-prep: scope statement + backend tiers + version policy可能已有人在做 @navareamol 于 3 天前认领。 未关闭
难度 2/5 3-5 天 新手友好度 65/100
ExtendDB/extenddb#662 · 已指派 1 人 ·
维护者通常 4 天内回复
查看 ExtendDB/extenddb 的全部 Issue
相似的 Issue
-
question
难度 1/5 1 小时以内 新手友好度 72/100
维护者通常 1 天内回复
-
field-report
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复
-
area:core
难度 2/5 1-3 小时 新手友好度 85/100
julian-hemmer/ypass#4 ·
-
难度 1/5 1 小时以内 新手友好度 70/100
-
难度 2/5 1-3 小时 新手友好度 62/100
davidkodar/klipp#3426 ·
维护者通常 1 天内回复