Skip to content

Conversation

bchapuis
Copy link
Member

@bchapuis bchapuis commented Apr 5, 2025

No description provided.

@bchapuis bchapuis force-pushed the calcite-framework branch from 748872f to 7105e06 Compare April 7, 2025 14:49
Copy link

@github-advanced-security github-advanced-security bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

…ance PostgreSQL type conversion, and update integration tests for schema registration.
…nhance handling of envelope values in data retrieval.
@bchapuis bchapuis force-pushed the calcite-framework branch from b0fce07 to 83cdca3 Compare April 10, 2025 20:54
return null;
}

if (geometry instanceof Point point) {

Check notice

Code scanning / CodeQL

Chain of 'instanceof' tests Note

This if block performs a chain of 7 type tests - consider alternatives, e.g. polymorphism or the visitor pattern.
Comment on lines +171 to +172
"SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = '" +
sanitizedTableName + "')")) {

Check failure

Code scanning / CodeQL

Query built by concatenation with a possibly-untrusted string High

Query built by concatenation with
this expression
, which may be untrusted.
Comment on lines +147 to +148
"SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = '" +
sanitizedTableName + "')")) {

Check failure

Code scanning / CodeQL

Query built by concatenation with a possibly-untrusted string High

Query built by concatenation with
this expression
, which may be untrusted.
Comment on lines +149 to +148
"SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = '" +
tableName + "')")) {

Check failure

Code scanning / CodeQL

Query built by concatenation with a possibly-untrusted string High

Query built by concatenation with
this expression
, which may be untrusted.
Comment on lines +84 to +85
"SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = '" +
tableName + "')")) {

Check failure

Code scanning / CodeQL

Query built by concatenation with a possibly-untrusted string High test

Query built by concatenation with
this expression
, which may be untrusted.
Comment on lines +87 to +88
"SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = '" +
tableName + "')")) {

Check failure

Code scanning / CodeQL

Query built by concatenation with a possibly-untrusted string High test

Query built by concatenation with
this expression
, which may be untrusted.
@bchapuis bchapuis force-pushed the calcite-framework branch from b976bb2 to c678597 Compare April 11, 2025 09:31
@Test
void testCsvWithoutHeader() throws Exception {
// Create a temporary file without a header
File tempFile = File.createTempFile("no_header", ".csv");

Check warning

Code scanning / CodeQL

Local information disclosure in a temporary directory Medium test

Local information disclosure vulnerability due to use of file readable by other local users.

Copilot Autofix

AI 6 months ago

To fix the problem, we need to ensure that the temporary file is created with secure permissions that restrict access to the owner only. This can be achieved by using the java.nio.file.Files.createTempFile method, which allows specifying file attributes, including permissions. We will replace the File.createTempFile method with Files.createTempFile and set the appropriate file permissions.

Suggested changeset 1
baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java b/baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java
--- a/baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java
+++ b/baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java
@@ -22,2 +22,6 @@
 import java.io.File;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermission;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.util.EnumSet;
 import java.io.IOException;
@@ -133,7 +137,7 @@
     // Create a temporary file without a header
-    File tempFile = File.createTempFile("no_header", ".csv");
-    tempFile.deleteOnExit();
+    Path tempFilePath = Files.createTempFile("no_header", ".csv");
+    tempFilePath.toFile().deleteOnExit();
 
     // Write data without header
-    Files.writeString(tempFile.toPath(),
+    Files.writeString(tempFilePath,
         "Paris,France,2148000\n" +
EOF
@@ -22,2 +22,6 @@
import java.io.File;
import java.nio.file.Path;
import java.nio.file.attribute.PosixFilePermission;
import java.nio.file.attribute.PosixFilePermissions;
import java.util.EnumSet;
import java.io.IOException;
@@ -133,7 +137,7 @@
// Create a temporary file without a header
File tempFile = File.createTempFile("no_header", ".csv");
tempFile.deleteOnExit();
Path tempFilePath = Files.createTempFile("no_header", ".csv");
tempFilePath.toFile().deleteOnExit();

// Write data without header
Files.writeString(tempFile.toPath(),
Files.writeString(tempFilePath,
"Paris,France,2148000\n" +
Copilot is powered by AI and may make mistakes. Always verify output.
@Test
void testCsvWithCustomSeparator() throws Exception {
// Create a temporary file with a custom separator
File tempFile = File.createTempFile("custom_separator", ".csv");

Check warning

Code scanning / CodeQL

Local information disclosure in a temporary directory Medium test

Local information disclosure vulnerability due to use of file readable by other local users.

Copilot Autofix

AI 6 months ago

To fix the problem, we need to ensure that the temporary files created in the test have restricted permissions, preventing other local users from reading them. We can achieve this by using the java.nio.file.Files.createTempFile method, which allows us to specify file attributes, including permissions.

We will replace the File.createTempFile calls with Files.createTempFile and ensure the files have permissions set to -rw------- (read and write permissions for the owner only).

Suggested changeset 1
baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java b/baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java
--- a/baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java
+++ b/baremaps-calcite/src/test/java/org/apache/baremaps/calcite/csv/CsvTableTest.java
@@ -133,4 +133,5 @@
     // Create a temporary file without a header
-    File tempFile = File.createTempFile("no_header", ".csv");
-    tempFile.deleteOnExit();
+    Path tempFilePath = Files.createTempFile("no_header", ".csv");
+    tempFilePath.toFile().deleteOnExit();
+    Files.setPosixFilePermissions(tempFilePath, EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE));
 
@@ -165,4 +166,5 @@
     // Create a temporary file with a custom separator
-    File tempFile = File.createTempFile("custom_separator", ".csv");
-    tempFile.deleteOnExit();
+    Path tempFilePath = Files.createTempFile("custom_separator", ".csv");
+    tempFilePath.toFile().deleteOnExit();
+    Files.setPosixFilePermissions(tempFilePath, EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE));
 
EOF
@@ -133,4 +133,5 @@
// Create a temporary file without a header
File tempFile = File.createTempFile("no_header", ".csv");
tempFile.deleteOnExit();
Path tempFilePath = Files.createTempFile("no_header", ".csv");
tempFilePath.toFile().deleteOnExit();
Files.setPosixFilePermissions(tempFilePath, EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE));

@@ -165,4 +166,5 @@
// Create a temporary file with a custom separator
File tempFile = File.createTempFile("custom_separator", ".csv");
tempFile.deleteOnExit();
Path tempFilePath = Files.createTempFile("custom_separator", ".csv");
tempFilePath.toFile().deleteOnExit();
Files.setPosixFilePermissions(tempFilePath, EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE));

Copilot is powered by AI and may make mistakes. Always verify output.
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
23 Security Hotspots
6.8% Duplication on New Code (required ≤ 3%)
B Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@bchapuis bchapuis merged commit 2b90033 into main Apr 12, 2025
8 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant