Comments (3)
Currently chproxy
doesn't parse the incoming query at all - it just proxies it as-is to clickhouse
. The requested feature would require adding non-trivial query parser into chproxy
. There is a hacky solution - just scan the first word of the query and determine whether it is allowed. It is already used when determining whether to cache the response - see canCacheQuery. Such hacky solution may fail when the query starts with unexpected syntax, for instance with a -- comment
or WITH
statement. So the solution may break at any time.
As you already mentioned, clickhouse
already provides readonly mechanism for disabling non-readonly queries, thus lowering the importance of the feature.
@alivelimeli , could your provide use cases for this feature?
from chproxy.
Yes its possible to make a hacky solution like that. I've thought that maybe chproxy can be behaves like a WAF (Web Application Firewall) to limit some kind of queries. Thanks
from chproxy.
From security POV it would be better to implement only allowed_query_prefixes
, because disallowed_query_prefixes
can be easily misconfigured.
But even the simplest allowed_query_prefixes: SELECT
gives false sense of security, since:
SELECT
query may be specially crafted the way that exhausts all the available RAM or CPU resources;SELECT
syntax may be extended in the future in unsafe ways allowing writing output files on the server side, creating new tables or doing other nasty things;ClickHouse
may contain security bugs that may be easily triggered via specially craftedSELECT
queries.
It is bad practice from security POV to allow untrusted direct SELECT
access to any DBMS, not only ClickHouse
. So even allowed_query_prefixes
has little sense :(
from chproxy.
Related Issues (20)
- timeout for user errors HOT 2
- 可以支持cpu和mem的metrics收集来做负载均衡吗?
- [BUG] Redis password gets exposed in info logs when redis username is empty HOT 1
- [QUESTION] Custom 401 error page?
- [Feature] <Allow overriding values of allowed parameters at runtime>
- [Feature] Change status code to concurrent query failed on cancelled requests HOT 3
- [Feature] Аdd a metric for clickhouse proxy responses HOT 2
- [QUESTION] may be a bug of proxied_response_duration_seconds metric HOT 1
- [QUESTION] why only one replica node in each shard have a high load? HOT 1
- [BUG] host header on requests to ClickHouse HOT 3
- [BUG] fix linter issues
- [Feature] Fallback/backup node
- [BUG] OOM when clickhouse is slow and a lot of insert queries are sent HOT 4
- [Feature] allow log_comment in query parameters
- [QUESTION] Availability of max_query_size Flag in Chproxy HOT 1
- killQuery needs luck with a TCP-balanced cluster
- why disable docker build for arm HOT 3
- [Feature] Weighted round robin load balancing HOT 1
- [QUESTION] Need some more context on cached_response_duration_seconds HOT 7
- when clickhouse-java compress=1 and query result is empty,then clickhouse jdbc throw Magic is not correct: xx
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from chproxy.