jffwang
/
hetu-core
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

add white list for code injection using external input parameters

This commit is contained in:
Yize Li 2020-09-08 14:15:06 +08:00
parent 411496c301
commit 894bb69c4a
14 changed files with 315 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Constants.java
View File

@ -14,6 +14,21 @@
*/
package io.hetu.core.plugin.hbase.utils;
import io.prestosql.spi.type.BigintType;
import io.prestosql.spi.type.BooleanType;
import io.prestosql.spi.type.DateType;
import io.prestosql.spi.type.DoubleType;
import io.prestosql.spi.type.IntegerType;
import io.prestosql.spi.type.SmallintType;
import io.prestosql.spi.type.TimeType;
import io.prestosql.spi.type.TimestampType;
import io.prestosql.spi.type.TinyintType;
import io.prestosql.spi.type.VarcharType;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
/**
* constants
*
@ -196,5 +211,23 @@ public class Constants
*/
public static final String HDFS_AUTHENTICATION_KERBEROS = "KERBEROS";
/**
* type class names' list
*/
public static final List<String> HBASE_DATA_TYPE_NAME_LIST = Collections.unmodifiableList(new ArrayList<String>() {
{
this.add(VarcharType.class.getName());
this.add(TinyintType.class.getName());
this.add(SmallintType.class.getName());
this.add(IntegerType.class.getName());
this.add(BigintType.class.getName());
this.add(DoubleType.class.getName());
this.add(BooleanType.class.getName());
this.add(TimeType.class.getName());
this.add(DateType.class.getName());
this.add(TimestampType.class.getName());
}
});
private Constants() {}
}

5
hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/Utils.java
View File

@ -27,6 +27,8 @@ import java.lang.reflect.Field;
import java.util.Map;
import java.util.Optional;
import static io.hetu.core.plugin.hbase.utils.Constants.HBASE_DATA_TYPE_NAME_LIST;
/**
* Utils
*
@ -76,6 +78,9 @@ public class Utils
public static Type createTypeByName(String type)
{
Type result = null;
if (!HBASE_DATA_TYPE_NAME_LIST.contains(type)) {
return Optional.ofNullable(result).orElse(result);
}
try {
Class clazz = Class.forName(type);
Field[] fields = clazz.getFields();

3
hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/HBaseRowSerializer.java
View File

@ -269,6 +269,9 @@ public interface HBaseRowSerializer
static HBaseRowSerializer getSerializerInstance(String serializerClassName)
{
try {
if (!SerializerConstants.WHITE_LIST_HBASEROWSERIALIZER_NAME.contains(serializerClassName)) {
throw new PrestoException(NOT_FOUND, "Illegal configured serializer class.");
}
return (HBaseRowSerializer) Class.forName(serializerClassName).getConstructor().newInstance();
}
catch (ClassNotFoundException

35
hetu-hbase/src/main/java/io/hetu/core/plugin/hbase/utils/serializers/SerializerConstants.java Normal file
View File

@ -0,0 +1,35 @@
/*
* Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.hetu.core.plugin.hbase.utils.serializers;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
public class SerializerConstants
{
/**
* HBaseRowSerializer implementation class list
*/
public static final List<String> WHITE_LIST_HBASEROWSERIALIZER_NAME = Collections.unmodifiableList(new ArrayList<String>(){
{
this.add(StringRowSerializer.class.getName());
}
});
private SerializerConstants()
{
}
}

4
hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/CsvDataSource.java
View File

@ -31,6 +31,7 @@ import java.util.List;
import java.util.Map;
import java.util.Properties;
import static io.hetu.core.heuristicindex.HeuristicIndexUtConstants.CVS_COLUMNS_DATA_TYPES;
import static java.util.Objects.requireNonNull;
public class CsvDataSource
@ -133,6 +134,9 @@ public class CsvDataSource
result.put(i, values);
}
if (!CVS_COLUMNS_DATA_TYPES.contains(types[i])) {
throw new IllegalStateException("The input data type is not support");
}
if (Class.forName(types[i]).equals(String.class)) {
values.add(columns[i]);
}

36
hetu-heuristic-index/src/test/java/io/hetu/core/heuristicindex/HeuristicIndexUtConstants.java Normal file
View File

@ -0,0 +1,36 @@
/*
* Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.hetu.core.heuristicindex;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
public class HeuristicIndexUtConstants
{
/**
* list of cvs columns data types
*/
public static final List<String> CVS_COLUMNS_DATA_TYPES = Collections.unmodifiableList(new ArrayList<String>() {
{
this.add(Integer.class.getName());
this.add(String.class.getName());
}
});
private HeuristicIndexUtConstants()
{
}
}

46
presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftConstants.java Normal file
View File

@ -0,0 +1,46 @@
/*
* Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.prestosql.plugin.hive.metastore.thrift;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
public class ThriftConstants
{
/**
* White list for MetastoreClientFactory implementation's class name
*/
public static final List<String> WHITE_LIST_FOR_METASTORECLIENTFACTORY_CLASS = Collections.unmodifiableList(new ArrayList<String>() {
{
this.add("io.prestosql.plugin.hive.metastore.thrift.MockThriftMetastoreClientFactory");
this.add(ThriftMetastoreClientFactory.class.getName());
}
});
/**
* White list for ThriftMetastore implementation's class name
*/
public static final List<String> WHITE_LIST_FOR_THRIFTMETASTORE_CLASS = Collections.unmodifiableList(new ArrayList<String>() {
{
this.add("io.prestosql.plugin.hive.metastore.thrift.InMemoryThriftMetastore");
this.add(ThriftHiveMetastore.class.getName());
}
});
private ThriftConstants()
{
}
}

8
presto-hive/src/main/java/io/prestosql/plugin/hive/metastore/thrift/ThriftMetastoreModule.java
View File

@ -33,6 +33,8 @@ import io.prestosql.spi.procedure.Procedure;
import static com.google.inject.multibindings.Multibinder.newSetBinder;
import static io.airlift.configuration.ConfigBinder.configBinder;
import static io.prestosql.plugin.hive.metastore.thrift.ThriftConstants.WHITE_LIST_FOR_METASTORECLIENTFACTORY_CLASS;
import static io.prestosql.plugin.hive.metastore.thrift.ThriftConstants.WHITE_LIST_FOR_THRIFTMETASTORE_CLASS;
import static org.weakref.jmx.guice.ExportBinder.newExporter;
public class ThriftMetastoreModule
@ -52,6 +54,9 @@ public class ThriftMetastoreModule
binder.bind(MetastoreClientFactory.class).to(ThriftMetastoreClientFactory.class).in(Scopes.SINGLETON);
}
else {
if (!WHITE_LIST_FOR_METASTORECLIENTFACTORY_CLASS.contains(config.getMetastoreClientFactoryImp().trim())) {
throw new PrestoException(HiveErrorCode.HIVE_FILE_NOT_FOUND, "Found illegal class when binding MetastoreClientFactory.");
}
log.info("Binding MetastoreClientFactory.class to %s", config.getMetastoreClientFactoryImp().trim());
binder.bind(MetastoreClientFactory.class)
.to((Class<? extends MetastoreClientFactory>) Class.forName(config.getMetastoreClientFactoryImp().trim()))
@ -67,6 +72,9 @@ public class ThriftMetastoreModule
binder.bind(ThriftMetastore.class).to(ThriftHiveMetastore.class).in(Scopes.SINGLETON);
}
else {
if (!WHITE_LIST_FOR_THRIFTMETASTORE_CLASS.contains(config.getThriftMetastoreImp().trim())) {
throw new PrestoException(HiveErrorCode.HIVE_FILE_NOT_FOUND, "Found illegal class when binding ThriftMetastore.");
}
log.info("Binding ThriftMetastore.class to %s", config.getThriftMetastoreImp().trim());
binder.bind(ThriftMetastore.class)
.to((Class<? extends ThriftMetastore>) Class.forName(config.getThriftMetastoreImp().trim()))

42
presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3Constants.java Normal file
View File

@ -0,0 +1,42 @@
/*
* Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.prestosql.plugin.hive.s3;
import com.amazonaws.services.s3.model.KMSEncryptionMaterialsProvider;
import com.amazonaws.services.s3.model.SimpleMaterialProvider;
import com.amazonaws.services.s3.model.StaticEncryptionMaterialsProvider;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
public class PrestoS3Constants
{
/**
* EncryptionMaterialsProvider Implementation List
*/
public static final List<String> ENCRYPTIONMATERIALSPROVIDER_IMPL_LIST = Collections.unmodifiableList(new ArrayList<String>() {
{
this.add("io.prestosql.plugin.hive.s3.TestPrestoS3FileSystem$TestEncryptionMaterialsProvider");
this.add(KMSEncryptionMaterialsProvider.class.getName());
this.add(SimpleMaterialProvider.class.getName());
this.add(StaticEncryptionMaterialsProvider.class.getName());
}
});
private PrestoS3Constants()
{
}
}

4
presto-hive/src/main/java/io/prestosql/plugin/hive/s3/PrestoS3FileSystem.java
View File

@ -107,6 +107,7 @@ import static com.google.common.base.Throwables.throwIfUnchecked;
import static com.google.common.base.Verify.verify;
import static com.google.common.collect.Iterables.toArray;
import static io.airlift.units.DataSize.Unit.MEGABYTE;
import static io.prestosql.plugin.hive.s3.PrestoS3Constants.ENCRYPTIONMATERIALSPROVIDER_IMPL_LIST;
import static java.lang.Math.max;
import static java.lang.Math.toIntExact;
import static java.lang.String.format;
@ -730,6 +731,9 @@ public class PrestoS3FileSystem
}
try {
if (!ENCRYPTIONMATERIALSPROVIDER_IMPL_LIST.contains(empClassName)) {
throw new RuntimeException("Invalid provider class: " + empClassName);
}
Object instance = Class.forName(empClassName).getConstructor().newInstance();
if (!(instance instanceof EncryptionMaterialsProvider)) {
throw new RuntimeException("Invalid encryption materials provider class: " + instance.getClass().getName());

50
presto-hive/src/main/java/io/prestosql/plugin/hive/security/SecurityConstants.java Normal file
View File

@ -0,0 +1,50 @@
/*
* Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.prestosql.plugin.hive.security;
import io.prestosql.plugin.base.security.AllowAllAccessControl;
import io.prestosql.plugin.base.security.FileBasedAccessControl;
import io.prestosql.plugin.base.security.ForwardingConnectorAccessControl;
import io.prestosql.plugin.base.security.ReadOnlyAccessControl;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
public class SecurityConstants
{
/**
* SqlStandardAccessControl implementation white list
*/
public static final List<String> WHITE_LIST_SQLSTANDARDACCESSCONTROL_IMPL = Collections.unmodifiableList(new ArrayList<String>() {
{
// for a full name of class string will cause a maven-dependency-plugin issue, we need to separate it into two string
String classPackage = "io.prestosql.security";
String className = ".TestAccessControlManager$DenyConnectorAccessControl";
this.add(classPackage + className);
this.add(AllowAllAccessControl.class.getName());
this.add(ForwardingConnectorAccessControl.class.getName());
this.add(FileBasedAccessControl.class.getName());
this.add(LegacyAccessControl.class.getName());
this.add(ReadOnlyAccessControl.class.getName());
this.add(SqlStandardAccessControl.class.getName());
this.add(SystemTableAwareAccessControl.class.getName());
}
});
private SecurityConstants()
{
}
}

5
presto-hive/src/main/java/io/prestosql/plugin/hive/security/SqlStandardSecurityModule.java
View File

@ -22,6 +22,8 @@ import io.prestosql.plugin.hive.metastore.SemiTransactionalHiveMetastore;
import io.prestosql.spi.PrestoException;
import io.prestosql.spi.connector.ConnectorAccessControl;
import static io.prestosql.plugin.hive.security.SecurityConstants.WHITE_LIST_SQLSTANDARDACCESSCONTROL_IMPL;
public class SqlStandardSecurityModule
implements Module
{
@ -42,6 +44,9 @@ public class SqlStandardSecurityModule
}
else {
try {
if (!WHITE_LIST_SQLSTANDARDACCESSCONTROL_IMPL.contains(sqlStandardAccessControlImp)) {
throw new PrestoException(HiveErrorCode.HIVE_FILE_NOT_FOUND, "Found illegal class when binding ConnectorAccessControl.");
}
log.info("Binding ConnectorAccessControl.class to %s", sqlStandardAccessControlImp);
binder.bind(ConnectorAccessControl.class)
.to((Class<? extends ConnectorAccessControl>) Class.forName(this.sqlStandardAccessControlImp))

40
presto-verifier/src/main/java/io/prestosql/verifier/VerifierConstants.java Normal file
View File

@ -0,0 +1,40 @@
/*
* Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.prestosql.verifier;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
public class VerifierConstants
{
/**
* Jdbc driver list
*/
public static final List<String> variableJdbcList = Collections.unmodifiableList(new ArrayList<String>() {
{
this.add("com.sap.db.jdbc.Driver");
this.add("oracle.jdbc.driver.OracleDriver");
this.add("com.microsoft.jdbc.sqlserver.SQLServerDriver");
this.add("com.mysql.jdbc.Driver");
this.add("org.postgresql.Driver");
this.add("org.h2.Driver");
}
});
private VerifierConstants()
{
}
}

4
presto-verifier/src/main/java/io/prestosql/verifier/VerifyCommand.java
View File

@ -83,6 +83,7 @@ import static io.prestosql.sql.parser.ParsingOptions.DecimalLiteralTreatment.AS_
import static io.prestosql.verifier.QueryType.CREATE;
import static io.prestosql.verifier.QueryType.MODIFY;
import static io.prestosql.verifier.QueryType.READ;
import static io.prestosql.verifier.VerifierConstants.variableJdbcList;
import static java.util.concurrent.Executors.newFixedThreadPool;
import static java.util.concurrent.TimeUnit.MINUTES;
@ -178,6 +179,9 @@ public class VerifyCommand
private static void loadJdbcDriver(URL[] urls, String jdbcClassName)
{
if (!variableJdbcList.contains(jdbcClassName)) {
throw new RuntimeException("Illegal jdbc driver name.");
}
try (URLClassLoader classLoader = new URLClassLoader(urls)) {
Driver driver = (Driver) Class.forName(jdbcClassName, true, classLoader).getConstructor().newInstance();
// The code calling the DriverManager to load the driver needs to be in the same class loader as the driver