Metabase H2 Driver: Prevention of File Read/Write via Unsupported Built-in Functions

Vulnerability Overview This vulnerability involves improvements to error messages for unsupported H2 functions in Metabase. Specifically, when a user attempts to use an unsupported H2 function, the system provides clearer error information to help users understand the issue. Affected Scope Affected Version: Metabase v0.65.0.3-beta Affected Functionality: Function support in the H2 database driver Affected Users: Users performing data analysis with Metabase, particularly those using the H2 database Remediation 1. Improved Error Messages: - In the file, detection of unsupported H2 functions and improvements to error messages were implemented. - A new private function was added, listing all unsupported H2 functions. - A new private function was added to match unsupported H2 functions in SQL queries. - A new private function was added to scan SQL queries for unsupported H2 functions. - A new private function was added to check if SQL queries contain unsupported H2 functions and throw an exception if found. 2. Test Cases: - In the file, multiple test cases were added to ensure the aforementioned features work correctly. - Test cases include detection of unsupported H2 functions, generation of error messages, and correctness of query classification. POC Code Below are the relevant code snippets: `` sql`, or nil if none. Scans the SQL text rather than the parsed command, so it still applies when the H2 parser is unavailable." [sql] (when sql (when-not-empty (into #{} (map #(upper-case-en %)) (re-seq unsupported-built-in-functions-regex (StringFiles/toUpperEnglish sql))))) (defn- check-no-unsupported-functions [sql] (when-let [fns (unsupported-functions-in-query sql)] (throw (ex-info "These functions are not supported in native queries: {0}" (str/join ", " (sort fns))) {:type :driver-api/qp/error-type.db :functions fns}))) (defn- every-command-allowed-for-actions? [[keys [command-types remaining-sql]]] (let [cmd-type-nums command-types] (boolean (when-not (every? command-allowed-for-actions? query-classification) (throw (ex-info "DDL commands are not allowed to be used with H2." {:map [map [query string?]]})))))) (defn- check-action-commands-allowed [[keys [database] [keys [query]] :native]] (when query (check-no-unsupported-functions query) (when-let [query-classification (classify-query database query)] (when-not (every-command-allowed-for-actions? query-classification) (throw (ex-info "DDL commands are not allowed to be used with H2." {:map [map [query string?]]})))))) (defn- check-no-unsupported-functions [sql] (when sql (when-let [query-classification (classify-query (driver-api/database-provider (driver-api/metadata-provider)) sql)] (when-not (read-only-statements? query-classification) (throw (ex-info "These functions are not supported in native queries: {0}" (str/join ", " (sort fns))) {:type :driver-api/qp/error-type.db :functions fns})))) (defn- check-read-only-rejects-unsupported-functions-test "Testing 'unsupported built-in functions are rejected even inside an allowed SELECT/CALL'" [are [query] (throw-with-msg) clojure.lang.ExceptionInfo "not supported in native queries" (at/with-metadata-provider (at/id) (#'h2/check-read-only-statements {:database 1 :type :native :query query})) "SELECT FILE_READ('a','UTF-8')" "CALL CSVREAD('a')" "CALL LINK_SCHEMA('LK','org.h2.Driver','jdbc:h2:mem:test','sa','','PUBLIC')"]) (defn- disallowed-commands-in-action-test (mt/test-driver :h2 (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-actions-test-data-and-actions-enabled (mt/with-act

Goal Reached Thanks to every supporter — we hit 100%!

Metabase H2 Driver: Prevention of File Read/Write via Unsupported Built-in Functions

More from this source