[CALCITE-7605] Threat model: add Inputs table, Downstream responsibilities, and Triage dispositions#3
Open
potiuk wants to merge 1 commit into
Conversation
… Triage dispositions Additive sections rounding out the threat model against a standard threat-model rubric; no existing content is changed. Inputs maps each attacker-controlled input to its governing property/rule; Downstream responsibilities collects the host/operator duties; Triage dispositions gives a closed outcome set for routing reports. Generated-by: Claude Opus 4.8 (1M context)
vlsi
added a commit
that referenced
this pull request
Jul 21, 2026
… Triage dispositions Fold in the three additive sections proposed in #3, corrected against the code: - Inputs: map every attacker-controlled input to its governing rule. Add the metaTableFactory/metaColumnFactory PLUGIN properties, place operator under the RelJson row (SqlOperator loads only via RelJson), and note that fun selects built-in libraries rather than loading a class. - Downstream responsibilities: collect the host/operator duties in one place and drop the now-duplicated transport paragraph from the attacker section. - Triage dispositions: a closed outcome set a human or agent can route against. - Not a vulnerability: state that pushed-down SQL is by design, while a pushdown bug that reads beyond the configured schemas is P4. Also record the ModelHandler.addFunctions raw Class.forName sink in the living inventory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vlsi
added a commit
that referenced
this pull request
Jul 21, 2026
… Triage dispositions Fold in the three additive sections proposed in #3, corrected against the code: - Inputs: map every attacker-controlled input to its governing rule. Add the metaTableFactory/metaColumnFactory PLUGIN properties, place operator under the RelJson row (SqlOperator loads only via RelJson), and note that fun selects built-in libraries rather than loading a class. - Downstream responsibilities: collect the host/operator duties in one place and drop the now-duplicated transport paragraph from the attacker section. - Triage dispositions: a closed outcome set a human or agent can route against. - Not a vulnerability: state that pushed-down SQL is by design, while a pushdown bug that reads beyond the configured schemas is P4. Also record the ModelHandler.addFunctions raw Class.forName sink in the living inventory. Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These three sections round out the threat model against a standard threat-model rubric. All additive — nothing here edits existing content; each section just consolidates something the model already implies into a form a triager (human or automated) can route against mechanically.
Targeting this branch (the more complete and internally-consistent of the two CALCITE-7605 drafts) so it folds directly into apache#5115.
Two things I guessed at — please correct:
schemaFactory,tableFactory, function, operator,parserFactory,typeSystem) — istypeSystemright, and isfunkeyword-only (I left it out)?Take, edit, or drop any of it — the model is yours.
Generated-by: Claude Opus 4.8 (1M context)