Fix escaper selection for DELETE and CTAS to prevent SQL injection (CVE-2026-65321) - #745
Merged
Merged
Conversation
DefaultParameterFormatter routed DELETE and CTAS (CREATE TABLE ... AS
SELECT) statements through the Hive escaper, which backslash-escapes
single quotes (' -> \'). Trino and Athena do not treat a backslash as an
escape character inside a string literal, so a parameter value containing
a single quote could terminate the literal and inject SQL.
Invert the escaper selection: default to the Trino-safe escaper that
doubles single quotes, and only use the Hive escaper for statements
positively identified as Hive DDL. Leading comments are stripped before
detection so a comment cannot hide the statement type, and CTAS is
excluded from the Hive branch.
CVE-2026-65321
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The escaper selection strips leading SQL comments before detecting the statement type. Existing tests covered leading comments only on the Trino side (DELETE); add coverage for leading comments before Hive DDL (DROP, ALTER, stacked line comments before CREATE EXTERNAL TABLE) so a commented Hive statement keeps its backslash escaping, plus stacked and newline-spanning leading comments on the Trino side. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pin the escaper selection against future regressions: statements whose prefix is adjacent to the Hive allowlist but which Trino executes (ALTER VIEW, DROP VIEW, CREATE OR REPLACE VIEW, VALUES) must stay on the quote-doubling escaper, and complete the Hive-side coverage of the allowlist (CREATE SCHEMA, DROP DATABASE, ALTER DATABASE). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHAT
Invert the escaper selection in
DefaultParameterFormatter.format(). Parameter values now default to the Trino/Athena-safe escaper (_escape_presto, which doubles'->''), and the Hive backslash escaper (_escape_hive) is used only for statements positively identified as Hive DDL via_HIVE_STATEMENT_PATTERN. Leading SQL comments are stripped before statement-type detection, and CTAS (CREATE TABLE ... AS SELECT) is excluded from the Hive branch. Adds 37 regression tests toTestDefaultParameterFormatter.WHY
DELETEand CTAS statements were routed to_escape_hive, which backslash-escapes single quotes ('->\'). Trino and Athena do not treat a backslash as an escape character inside a string literal, so\'is parsed as a literal backslash followed by a quote that terminates the literal. A parameter value such asa' OR 1=1 --could therefore break out of its string literal and inject SQL.Defaulting to the quote-doubling escaper is the fail-safe direction: doubling a quote in a Hive statement is at worst a formatting artifact, whereas backslash-escaping in a Trino statement is exploitable.
Fixes CVE-2026-65321 (GHSA-xwj5-g6cv-4r5c, CWE-89). Affected: all releases up to and including 3.35.3.