Fix CQL injection in Connection keyspace escaping#758
Fix CQL injection in Connection keyspace escaping#758mykaul wants to merge 1 commit intoscylladb:masterfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR addresses a CQL injection vector in the low-level Connection.set_keyspace_blocking / Connection.set_keyspace_async methods by properly escaping embedded double quotes in keyspace names when constructing USE statements.
Changes:
- Escape
"as""when buildingUSE "<keyspace>"in both blocking and async keyspace setters. - Add unit tests asserting the produced
USEquery correctly escapes keyspace names containing".
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
cassandra/connection.py |
Escapes double quotes in keyspace names before interpolating into USE statements. |
tests/unit/test_connection.py |
Adds unit coverage ensuring both blocking and async code paths emit correctly-escaped USE queries. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…e_async Escape double quotes in keyspace names when constructing USE statements to prevent CQL injection. A keyspace name containing '"' would produce malformed or injectable CQL (e.g., USE "foo"bar"). This is the Python equivalent of the vulnerability fixed in the Go driver (gocql#783). The fix escapes '"' as '""' per CQL quoted-identifier rules, matching the existing escape_name() function in cassandra/metadata.py.
mykaul
force-pushed
the
fix/cql-injection-keyspace-escape
branch
from
6fafe05 to
3281c9f
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Lorak-mmk
left a comment
Lorak-mmk
left a comment
There was a problem hiding this comment.
Could you add a test that calls Session.set_keyspace with such name?
Summary
") as""in keyspace names when constructingUSEstatements inConnection.set_keyspace_blockingandConnection.set_keyspace_async, preventing CQL injectionDetails
The
set_keyspace_blockingandset_keyspace_asyncmethods incassandra/connection.pyconstruct CQLUSEstatements by directly interpolating the keyspace name into'USE "%s"'without escaping embedded"characters. A keyspace name containing"produces malformed or injectable CQL.The higher-level
Session.set_keyspacealready handles this correctly viaprotect_name(), but these lower-level connection methods are called directly from pool management code (cassandra/pool.py) andcassandra/cluster.py, bypassing that protection.The fix escapes
"as""per CQL quoted-identifier rules, consistent with the existingescape_name()function incassandra/metadata.py.