Metabase H2驱动不支持函数访问控制修复

漏洞概述 该漏洞涉及在Metabase中，对于不支持的H2函数，错误消息的改进。具体来说，当用户尝试使用不支持的H2函数时，系统会提供更清晰的错误信息，帮助用户理解问题所在。 影响范围 受影响版本：Metabase v0.65.0.3-beta 影响功能：H2数据库驱动中的函数支持 影响用户：使用Metabase进行数据分析的用户，特别是那些使用H2数据库的用户 修复方案 1. 改进错误消息： - 在 文件中，增加了对不支持的H2函数的检测和错误消息的改进。 - 新增了一个私有函数 ，列出了所有不支持的H2函数。 - 新增了一个私有函数 ，用于匹配SQL查询中的不支持的H2函数。 - 新增了一个私有函数 ，用于扫描SQL查询中的不支持的H2函数。 - 新增了一个私有函数 ，用于检查SQL查询中是否包含不支持的H2函数，并在发现时抛出异常。 2. 测试用例： - 在 文件中，增加了多个测试用例，确保上述功能正常工作。 - 测试用例包括对不支持的H2函数的检测、错误消息的生成以及查询分类的正确性。 POC代码 以下是相关的代码片段： `` sql`, or nil if none. Scans the SQL text rather than the parsed command, so it still applies when the H2 parser is unavailable." [sql] (when sql (when-not-empty (into #{} (map #(upper-case-en %)) (re-seq unsupported-built-in-functions-regex (StringFiles/toUpperEnglish sql))))) (defn- check-no-unsupported-functions [sql] (when-let [fns (unsupported-functions-in-query sql)] (throw (ex-info "These functions are not supported in native queries: {0}" (str/join ", " (sort fns))) {:type :driver-api/qp/error-type.db :functions fns}))) (defn- every-command-allowed-for-actions? [[keys [command-types remaining-sql]]] (let [cmd-type-nums command-types] (boolean (when-not (every? command-allowed-for-actions? query-classification) (throw (ex-info "DDL commands are not allowed to be used with H2." {:map [map [query string?]]}]))))) (defn- check-action-commands-allowed [[keys [database] [keys [query]] :native]] (when query (check-no-unsupported-functions query) (when-let [query-classification (classify-query database query)] (when-not (every-command-allowed-for-actions? query-classification) (throw (ex-info "DDL commands are not allowed to be used with H2." {:map [map [query string?]]})))))) (defn- check-no-unsupported-functions [sql] (when sql (when-let [query-classification (classify-query (driver-api/database-provider (driver-api/metadata-provider)) sql)] (when-not (read-only-statements? query-classification) (throw (ex-info "These functions are not supported in native queries: {0}" (str/join ", " (sort fns))) {:type :driver-api/qp/error-type.db :functions fns})))) (defn- check-read-only-rejects-unsupported-functions-test "Testing 'unsupported built-in functions are rejected even inside an allowed SELECT/CALL'" [are [query] (throw-with-msg) clojure.lang.ExceptionInfo "not supported in native queries" (at/with-metadata-provider (at/id) (#'h2/check-read-only-statements {:database 1 :type :native :query query})) "SELECT FILE_READ('a','UTF-8')" "CALL CSVREAD('a')" "CALL LINK_SCHEMA('LK','org.h2.Driver','jdbc:h2:mem:test','sa','','PUBLIC')"]) (defn- disallowed-commands-in-action-test (mt/test-driver :h2 (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/w

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Metabase H2驱动不支持函数访问控制修复

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Metabase H2驱动不支持函数访问控制修复

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！