A 32-bit length field read from the wire by CBUtil.readValue (and its
siblings) flowed directly into new byte[length] with no upper bound,
allowing an unauthenticated client to drive the JVM into
OutOfMemoryError: 'Requested array size exceeds VM limit' — and, with
the default -XX:OnOutOfMemoryError=kill -9 %p, terminate the process —
by declaring Integer.MAX_VALUE as the SASL-token length in AUTH_RESPONSE.
Guard the allocation in the single private readRawBytes(ByteBuf, int)
that all int32-length readers funnel through, rejecting lengths that
exceed the buffer's readable bytes with a ProtocolException.
patch by Francisco Guerrero; reviewed by Stefan Miklosovic for CASSANDRA-21521
Cassandra resolves pluggable extensions by class name from configuration, schema, and tooling
inputs. These names were loaded with an initializing Class.forName(name) and type-checked only
afterward, so the named class ran its static initializer before its type was confirmed. After this
change such classes will be loaded without initialization, verified against the expected interface or
base class, and initialized only through normal use after validation.
A shared FBUtilities.classForNameWithoutInitialization helper and typed
instanceOrConstruct/construct overloads apply this to the configurable extension points loaded by
class name: the authentication, authorization, role-management, network and
internode-authenticator backends, the partitioner, audit logger, configuration loader, seed provider,
snitch, abstract types, secondary and custom indexes, compaction strategy, compressor, replication
strategy, SASI analyzers, key and cache providers, query handler, storage and stream hooks, tracing,
the JMX authorization proxy, MBeans, the monotonic clock, nodetool Sjk, triggers, the
sstableloader and stress class options, and diagnostic event classes (loaded without initialization
and checked against DiagnosticEvent, preserving the InvalidClassException contract and the existing
package restriction).
Regression tests confirm that an invalid-type load is rejected without initializing the target
class, and that valid implementations still resolve.
Hadoop client integration and hard-coded JDK and internal class probes are left unchanged.
patch by Jeremiah Jordan; reviewed by Stefan Miklosovic for CASSANDRA-21525
Adds missing @Test annotations to testPasswordUpdateRateLimiting and testPasswordUpdateRateLimitingDisabled.
Also fixes minor typos in comments and assertion strings.
Fix flaky CassandraRoleManagerTest by grouping per-role rate limit checks consecutively.
patch by Arvind Kandpal; reviewed by Stefan Miklosovic, Michael Semb Wever for CASSANDRA-21262
When BTreeRow.merge reconciles an update into a row whose existing deletion
shadows the update's cells, it filtered the update (incoming) side of the merge
with Reconciler.retain, which records the removal via
PostReconciliationFunction.delete. On the memtable write path that subtracts the
shadowed cells' on-heap size from the allocator's ownership even though that
incoming data was never allocated to the memtable. Under overwrite/delete churn
that re-applies cells already covered by a newer row/partition deletion (e.g.
repair re-streaming), the allocator's "owns" counter drifts negative and the next
flush trips "AssertionError: Negative released" in MemtablePool$SubPool.released
via MemtableAllocator$SubAllocator.releaseAll during discard.
Filter the update (incoming) side with a non-recording variant,
Reconciler.removeShadowed, and keep retain() for the existing side,
whose data the memtable already owns. The filtered result is identical; only the
erroneous accounting notification is dropped. This mirrors the already-correct
complex-column path in ColumnData.merge.
patch by Stefan Miklosovic; reviewed by Dmitry Konstantinov for CASSANDRA-21469
Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
The validation of snapshot names is turned off by default.
It is controlled by system property cassandra.snapshot.validation which is by default
set to false except 7.0 branch.
When the validation is turned on, the allowed characters are AWS safe characters together
with "+" character. A user can not specify any path separators in snapshot names even if
the validation as such is turned off.
patch by Stefan Miklosovic; reviewed by Francisco Guerrero, Matt Byrd for CASSANDRA-21389
patch by Andrés Beck-Ruiz, Runtian Liu; reviewed by Zhao Yang, Benedict Elliott Smith for CASSANDRA-21216
Co-authored-by: Runtian Liu <runtian@uber.com>
Introduces property cassandra.role_password_update_interval_in_ms, with default value of 5000.
Logging added when passwords on roles are changed or are rate-limited.
patch by Mick Semb Wever; reviewed by Doug Rohrer, Jeremiah Jordan for CASSANDRA-21202
Converting collections or UDTs to raw bytes is nonsensical - it
allows reading raw serialized bytes which have no meaningful
interpretation.
patch by Mikołaj Diakowski; reviewed by Stefan Miklosovic, Brandon Williams for CASSANDRA-20982
Before the fix during a capacity extension BufferPoolAllocator returned to BufferPool a sliced ByteBuffer wrapper object instead of the originally allocated one, so the ByteBuffer was not recycled by BufferPool
Adjust BufferPoolAllocatorTest to test the ByteBuf capacity extension with a real BufferPool behavior
Patch by Dmitry Konstantinov; reviewed by Michael Semb Wever for CASSANDRA-20753
CASSANDRA-20389 implemented limit on table name length of 222
characters. This commit updates the documentation to reflect this.
It also adds an assert in CreateTableValidationTest to ensure that the
documented limit matches the actual constant.
patch by Ruslan Fomkin; reviewed by Brad Schoening, Dmitry Konstantinov for CASSANDRA-20914
Francisco Guerrero