diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000000..09c0a5f2ce163 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,102 @@ + + +# Security Policy + +This document outlines the security model for Apache DataFusion and how to +report vulnerabilities. + +This model also applies to the [datafusion-cli] command line tool, which is +a thin wrapper around the DataFusion library. + +## Security Model + +DataFusion is a low level library, designed to be embedded in applications +that have their own security model. This section describes DataFusion's own +model: what counts as a bug versus a vulnerability. + +In general, crashes, panics, hangs, and excessive resource consumption +(memory, CPU, or disk) are treated as **bugs**, not vulnerabilities, unless +they are **exploitable** and could let an attacker: + +* Execute arbitrary code (Remote Code Execution), or +* Exfiltrate sensitive information from process memory (Information Disclosure). + +If the exploitation path is unclear, please report the issue as a bug rather +than a vulnerability. The sections below describe what DataFusion treats as +trusted input in a few specific areas. + +### SQL and DataFrame Queries + +SQL and DataFrame queries are executable code, comparable to a scripting +language: a query can legitimately read files, open network connections +(e.g. via `CREATE EXTERNAL TABLE`), and consume significant CPU, memory, or +disk. Running such a query is not, on its own, a vulnerability. + +It is the embedding application's responsibility to decide whether a query is +safe to run (e.g. validating externally supplied SQL text or URLs) and to +sandbox untrusted queries at the OS/container level if needed. APIs such as +[`SQLOptions::with_allow_dml`] can help restrict what a query is allowed to +do, but do not guarantee that all input is safe to execute. + +### Data Files + +Format readers (e.g. Parquet, CSV, JSON, Avro, and Arrow IPC) assume a +well-formed file from a trusted writer; use the [arrow validation APIs] to +validate an untrusted file's structure. Issues due to malformed files, and +well-formed files that contain unexpected or adversarial *data*, are bugs rather +than vulnerabilities, as explained above. + +### Serialized Plans + +Serialized plans, such as [Substrait] and [`datafusion-proto`], are treated +as trusted input. If received from an untrusted source, they should be +validated before being passed to DataFusion for execution. + +### Extensions and Other Uses of Public APIs + +Code that uses DataFusion's public extension APIs (e.g. user defined functions, +`TableProvider`, `ExecutionPlan`) is trusted to uphold their contracts (for +example, that any `ArrayRef` is a valid Arrow array). Issues arising from +violating the API contracts are not considered a DataFusion vulnerability. + +## Reporting a Bug + +We treat all bugs seriously and welcome help fixing them. If you find a bug +that does not meet the criteria for a security vulnerability, please report it +in the [public issue tracker](https://github.com/apache/datafusion/issues/). + +## Reporting a Vulnerability + +For security vulnerabilities **do not file a public issue.** Follow the [ASF +security reporting process] by emailing +[security@apache.org](mailto:security@apache.org). + +Include in your report: + +- A clear description and minimal reproducer. +- Affected crates and versions. +- Potential impact. + +[datafusion-cli]: https://datafusion.apache.org/user-guide/cli/index.html +[`sqloptions::with_allow_dml`]: https://docs.rs/datafusion/latest/datafusion/execution/context/struct.SQLOptions.html#method.with_allow_dml +[arrow validation apis]: https://docs.rs/arrow/latest/arrow/array/struct.ArrayData.html#method.validate_full +[substrait]: https://docs.rs/datafusion-substrait/latest/datafusion_substrait/ +[`datafusion-proto`]: https://docs.rs/datafusion-proto/latest/datafusion_proto/ +[asf security reporting process]: https://www.apache.org/security/#reporting-a-vulnerability diff --git a/datafusion/proto/src/lib.rs b/datafusion/proto/src/lib.rs index 7a965fcebeb4d..f1cafd56c8fc6 100644 --- a/datafusion/proto/src/lib.rs +++ b/datafusion/proto/src/lib.rs @@ -59,6 +59,14 @@ //! [datafusion-substrait]: https://docs.rs/datafusion-substrait/latest/datafusion_substrait //! [substrait.io]: https://substrait.io //! +//! # Security +//! +//! Serialized plans are treated as trusted input. The application must validate +//! untrusted inputs as this crate does not validate that a plan is safe to +//! execute. See the [DataFusion Security Model] for more details. +//! +//! [DataFusion Security Model]: https://github.com/apache/datafusion/blob/main/SECURITY.md#serialized-plans +//! //! # Example: Serializing [`Expr`]s //! ``` //! # use datafusion_common::Result; diff --git a/datafusion/substrait/src/lib.rs b/datafusion/substrait/src/lib.rs index 0819fd3a592f9..9958959177ebd 100644 --- a/datafusion/substrait/src/lib.rs +++ b/datafusion/substrait/src/lib.rs @@ -48,15 +48,23 @@ //! # See Also //! //! Substrait does not (yet) support the full range of plans and expressions -//! that DataFusion offers. See the [datafusion-proto] crate for a DataFusion -//! specific format that does support of the full range. +//! that DataFusion offers. See the [datafusion-proto] crate for a DataFusion +//! specific format that does support the full range. //! //! [datafusion-proto]: https://docs.rs/datafusion-proto/latest/datafusion_proto //! -//! Note that generated types such as [`substrait::proto::Plan`] and +//! Note that generated types such as [`substrait::proto::Plan`] and //! [`substrait::proto::Rel`] can be serialized / deserialized to bytes, JSON and //! other formats using [prost] and the rest of the Rust protobuf ecosystem. //! +//! # Security +//! +//! Substrait plans are treated as trusted input. The application must validate +//! untrusted inputs as this crate does not validate that a plan is safe to +//! execute. See the [DataFusion Security Model] for more details. +//! +//! [DataFusion Security Model]: https://github.com/apache/datafusion/blob/main/SECURITY.md#serialized-plans +//! //! # Example: Serializing [`LogicalPlan`]s //! ``` //! # use datafusion::prelude::*;