From 6f8fd283eb129c9add52528bbfe4d298208a571a Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Wed, 30 Sep 2026 15:57:35 -0400 Subject: [PATCH 01/10] Add SECURITY.md following ASF guidelines Closes #25916 Adds a security policy modeled on arrow-rs's SECURITY.md (https://github.com/apache/arrow-rs/blob/main/SECURITY.md), describing the security model and pointing reporters to the ASF security reporting process (https://www.apache.org/security/#reporting-a-vulnerability). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- SECURITY.md | 84 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000000..063e370b85184 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,84 @@ + + +# Security Policy + +This document outlines the security model for Apache DataFusion and how to +report vulnerabilities. + +## Security Model + +DataFusion is a query engine that executes SQL and DataFrame queries, which +may include reading data from untrusted sources (e.g., files, network +connections, or user supplied queries). DataFusion is expected to reject +invalid or malformed input with an error, and to safely execute queries +without compromising the security of the host system. + +Unexpected behavior (e.g., panics, crashes, excessive resource consumption, or +infinite loops) triggered by malformed or adversarial input is generally +considered a **bug**, not a security vulnerability, unless it is +**exploitable** and could allow an attacker to + +* Execute arbitrary code (Remote Code Execution); +* Exfiltrate sensitive information from process memory (Information Disclosure); + +If that exploitation path is unclear, the issue should likely be reported as a +bug. + +## Rust Safety, Soundness, and Undefined Behavior + +Rust has a very [specific definition of unsafe]. When unsafe behavior results +from using safe code, the code is unsound and can lead to undefined behavior +(UB), which may be exploitable. + +However, not all soundness issues are exploitable. In general, issues that +result in undefined behavior using safe APIs are considered bugs unless they +meet the exploitability bar defined above. + +We therefore avoid classifying all unsoundness bugs as security +vulnerabilities (e.g. filing [RUSTSEC] and/or [CVE] advisories), which helps +avoid unnecessary downstream churn and keeps our focus on the most critical +issues. + +[specific definition of unsafe]: https://doc.rust-lang.org/book/ch20-01-unsafe-rust.html +[rustsec]: https://rustsec.org/ +[cve]: https://cve.mitre.org/ + +## Reporting a Bug + +We treat all bugs seriously and welcome help fixing them. If you find a bug +that does not meet the criteria for a security vulnerability, please report it +in the public issue tracker. + +## Reporting a Vulnerability + +For security vulnerabilities, please follow the responsible disclosure process +below so we can investigate and fix the issue before it is exploited in the +wild. + +**Do not file a public issue.** Follow the [ASF security reporting process] by +emailing [security@apache.org](mailto:security@apache.org). + +Include in your report: + +- A clear description and minimal reproducer. +- Affected crates and versions. +- Potential impact. + +[asf security reporting process]: https://www.apache.org/security/#reporting-a-vulnerability From 0a7c1050c4937c7a63f28d4ae93c72f1ed580df3 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Wed, 30 Sep 2026 16:07:59 -0400 Subject: [PATCH 02/10] hone --- SECURITY.md | 41 +++++++++++++++++++++++++++++++++-------- 1 file changed, 33 insertions(+), 8 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 063e370b85184..dc4731939d2cc 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,15 +26,43 @@ report vulnerabilities. DataFusion is a query engine that executes SQL and DataFrame queries, which may include reading data from untrusted sources (e.g., files, network -connections, or user supplied queries). DataFusion is expected to reject -invalid or malformed input with an error, and to safely execute queries +connections, and user supplied queries). DataFusion is expected to reject +malformed input with an error. + +## Input Validation + +DataFusion is a low level library designed to be embedded in applications that +have their own security model. + +DataFusion will run the queries that are passed to it, and it is the +responsibility of the embedding application to ensure that the queries are safe +to execute (for example, verify any externally supplied queries or URLs). +DataFusion contains some APIs such as [`with_no_dml`] to help the application +validate input, but it does not guarantee that all input is safe to execute. +This is the responsibility of the embedding application. + +Given a valid DataFusion DataFrame or SQL query, DataFusion is expected to execute it +correctly without memory safety issues. + +Example validation steps that an embedding application may take include: +* Validate that external URLs are safe to read from (e.g., not a local file or a sensitive system file). +* Validate that the SQL query does not contain any DML statements (e.g., `INSERT`, `UPDATE`, `DELETE`) if the application does not want to allow them. +* Validate Arrow data using the [arrow validation APIs] + + +It is the responsibility of the embedding application to validate +user input + +and to safely execute queries without compromising the security of the host system. +## Denial of Service (DoS) and Resource Exhaustion Unexpected behavior (e.g., panics, crashes, excessive resource consumption, or infinite loops) triggered by malformed or adversarial input is generally considered a **bug**, not a security vulnerability, unless it is **exploitable** and could allow an attacker to + * Execute arbitrary code (Remote Code Execution); * Exfiltrate sensitive information from process memory (Information Disclosure); @@ -68,12 +96,9 @@ in the public issue tracker. ## Reporting a Vulnerability -For security vulnerabilities, please follow the responsible disclosure process -below so we can investigate and fix the issue before it is exploited in the -wild. - -**Do not file a public issue.** Follow the [ASF security reporting process] by -emailing [security@apache.org](mailto:security@apache.org). +For security vulnerabilities **do not file a public issue.** Follow the [ASF +security reporting process] by emailing +[security@apache.org](mailto:security@apache.org). Include in your report: From 0e20e715691f45e47d3065b9be68a02110898f09 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Wed, 30 Sep 2026 16:18:35 -0400 Subject: [PATCH 03/10] Adapy from duckdb --- SECURITY.md | 92 +++++++++++++++++++++++++++++++++++------------------ 1 file changed, 61 insertions(+), 31 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index dc4731939d2cc..63f845f1198b0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -24,37 +24,65 @@ report vulnerabilities. ## Security Model -DataFusion is a query engine that executes SQL and DataFrame queries, which -may include reading data from untrusted sources (e.g., files, network -connections, and user supplied queries). DataFusion is expected to reject -malformed input with an error. - -## Input Validation - -DataFusion is a low level library designed to be embedded in applications that -have their own security model. - -DataFusion will run the queries that are passed to it, and it is the -responsibility of the embedding application to ensure that the queries are safe -to execute (for example, verify any externally supplied queries or URLs). -DataFusion contains some APIs such as [`with_no_dml`] to help the application -validate input, but it does not guarantee that all input is safe to execute. -This is the responsibility of the embedding application. - -Given a valid DataFusion DataFrame or SQL query, DataFusion is expected to execute it -correctly without memory safety issues. - -Example validation steps that an embedding application may take include: -* Validate that external URLs are safe to read from (e.g., not a local file or a sensitive system file). -* Validate that the SQL query does not contain any DML statements (e.g., `INSERT`, `UPDATE`, `DELETE`) if the application does not want to allow them. -* Validate Arrow data using the [arrow validation APIs] - - -It is the responsibility of the embedding application to validate -user input - -and to safely execute queries -without compromising the security of the host system. +DataFusion is a low level library, designed to be embedded in applications +that have their own security model, and it has no internal privilege +boundary: anything that can be expressed as a valid query, a valid data +file, or a call to a public API is assumed to be intentional and is not, by +itself, a vulnerability. The embedding application controls what queries are +run, what data is read, and what extension code is loaded, and that is the +security boundary. + +### SQL and DataFrame Queries + +SQL and DataFrame queries are executable code, comparable to a query +language like Bash or Python: a query can read files, open network +connections (e.g. via an `ObjectStore` or a custom `TableProvider`), and +consume significant CPU, memory, or disk. Executing an untrusted SQL or +DataFrame query is therefore unsafe by design, and a query that does any of +the above is not, on its own, a vulnerability. + +DataFusion will run whatever valid query it is given, and it is the +responsibility of the embedding application to decide which queries are safe +to run (for example, by validating externally supplied SQL text or URLs +before passing them to DataFusion) and to sandbox execution of untrusted +queries at the OS level if needed. DataFusion provides some APIs to help +applications restrict what a query can do, such as +[`SQLOptions::with_allow_dml`] to reject DML statements (e.g. `INSERT`, +`UPDATE`, `DELETE`) and DDL, but it does not guarantee that all input is safe +to execute; that remains the responsibility of the embedding application. + +Given a valid DataFusion SQL or DataFrame query over well-formed input, +DataFusion is expected to execute it correctly without memory safety issues. + +### Data Files + +Format readers (e.g. Parquet, CSV, JSON, Avro, and Arrow IPC) assume a +well-formed file written by a trusted writer. Crashes, panics, excessive +resource consumption, or other unexpected behavior triggered by a malformed +or corrupted file are generally treated as **bugs**, not vulnerabilities, +unless they are exploitable as described below. Applications that cannot +guarantee a file's provenance should not treat reading it as safe, and can +use APIs such as the [arrow validation APIs] to validate a file's structure +before trusting it. + +Data *values* inside an otherwise well-formed file are a separate, in-scope +case: column values are frequently attacker controlled (e.g. user input, +scraped text, or log lines written into a file by a trusted pipeline). +Memory corruption, code execution, or other unsafe behavior caused by the +*values* in a file, rather than by its structure, is a vulnerability and is +prioritized as such. + +### Extensions and Other Uses of Public APIs + +DataFusion exposes many public APIs for extending its behavior, such as +custom `ScalarUDF`/`AggregateUDF`/`WindowUDF` implementations, `TableProvider` +and `ExecutionPlan` implementations, physical expressions, and APIs for +constructing Arrow arrays directly. Code that uses these APIs is trusted to +conform to their documented contracts (for example, that any `ArrayRef` +passed to or returned from an operator is a valid Arrow array). A crash, +memory safety issue, or other unexpected behavior that only occurs because +custom extension code violates such a contract (e.g., constructing an +invalid or corrupt Arrow array) is not considered a DataFusion vulnerability. ## Denial of Service (DoS) and Resource Exhaustion Unexpected behavior (e.g., panics, crashes, excessive resource consumption, or @@ -87,6 +115,8 @@ issues. [specific definition of unsafe]: https://doc.rust-lang.org/book/ch20-01-unsafe-rust.html [rustsec]: https://rustsec.org/ [cve]: https://cve.mitre.org/ +[`sqloptions::with_allow_dml`]: https://docs.rs/datafusion/latest/datafusion/execution/context/struct.SQLOptions.html#method.with_allow_dml +[arrow validation apis]: https://docs.rs/arrow/latest/arrow/array/struct.ArrayData.html#method.validate_full ## Reporting a Bug From c56fa3c5cbb8cef8fd88c446e9c5cd5cf53b3390 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Wed, 30 Sep 2026 16:33:51 -0400 Subject: [PATCH 04/10] rewrite --- SECURITY.md | 130 +++++++++++++++++++++------------------------------- 1 file changed, 52 insertions(+), 78 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 63f845f1198b0..f2cb17a5a6b71 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -24,99 +24,73 @@ report vulnerabilities. ## Security Model -DataFusion is a low level library, designed to be embedded in applications -that have their own security model, and it has no internal privilege -boundary: anything that can be expressed as a valid query, a valid data -file, or a call to a public API is assumed to be intentional and is not, by -itself, a vulnerability. The embedding application controls what queries are -run, what data is read, and what extension code is loaded, and that is the -security boundary. +DataFusion is a low level library, designed to be embedded in applications that +have their own security model. This document describes the security model of +DataFusion itself. -### SQL and DataFrame Queries +### Memory Safety -SQL and DataFrame queries are executable code, comparable to a query -language like Bash or Python: a query can read files, open network -connections (e.g. via an `ObjectStore` or a custom `TableProvider`), and -consume significant CPU, memory, or disk. Executing an untrusted SQL or -DataFrame query is therefore unsafe by design, and a query that does any of -the above is not, on its own, a vulnerability. - -DataFusion will run whatever valid query it is given, and it is the -responsibility of the embedding application to decide which queries are safe -to run (for example, by validating externally supplied SQL text or URLs -before passing them to DataFusion) and to sandbox execution of untrusted -queries at the OS level if needed. DataFusion provides some APIs to help -applications restrict what a query can do, such as -[`SQLOptions::with_allow_dml`] to reject DML statements (e.g. `INSERT`, -`UPDATE`, `DELETE`) and DDL, but it does not guarantee that all input is safe -to execute; that remains the responsibility of the embedding application. - -Given a valid DataFusion SQL or DataFrame query over well-formed input, -DataFusion is expected to execute it correctly without memory safety issues. +Given a valid SQL or DataFrame query over well-formed input files, DataFusion +is expected to execute it correctly without memory safety issues. Most of +DataFusion is written using `safe` Rust, which helps provide memory safety +guarantees, but some parts of DataFusion use `unsafe` Rust for performance +reasons. In general crashes (segfaults, panics, etc.) are treated as **bugs**, +not vulnerabilities, unless they are **exploitable** and could allow an attacker +to: -### Data Files +* Execute arbitrary code (Remote Code Execution); +* Exfiltrate sensitive information from process memory (Information Disclosure); -Format readers (e.g. Parquet, CSV, JSON, Avro, and Arrow IPC) assume a -well-formed file written by a trusted writer. Crashes, panics, excessive -resource consumption, or other unexpected behavior triggered by a malformed -or corrupted file are generally treated as **bugs**, not vulnerabilities, -unless they are exploitable as described below. Applications that cannot -guarantee a file's provenance should not treat reading it as safe, and can -use APIs such as the [arrow validation APIs] to validate a file's structure -before trusting it. - -Data *values* inside an otherwise well-formed file are a separate, in-scope -case: column values are frequently attacker controlled (e.g. user input, -scraped text, or log lines written into a file by a trusted pipeline). -Memory corruption, code execution, or other unsafe behavior caused by the -*values* in a file, rather than by its structure, is a vulnerability and is -prioritized as such. +If that exploitation path is unclear, the issue should likely be reported as a +bug. -### Extensions and Other Uses of Public APIs +### SQL and DataFrame Queries -DataFusion exposes many public APIs for extending its behavior, such as -custom `ScalarUDF`/`AggregateUDF`/`WindowUDF` implementations, `TableProvider` -and `ExecutionPlan` implementations, physical expressions, and APIs for -constructing Arrow arrays directly. Code that uses these APIs is trusted to -conform to their documented contracts (for example, that any `ArrayRef` -passed to or returned from an operator is a valid Arrow array). A crash, -memory safety issue, or other unexpected behavior that only occurs because -custom extension code violates such a contract (e.g., constructing an -invalid or corrupt Arrow array) is not considered a DataFusion vulnerability. +SQL and DataFrame queries are executable code, comparable to a query language +like Bash or Python: a query can read files, open network connections (e.g via +`CREATE EXTERNAL TABLE` ), and consume arbitrary amounts of CPU, memory, or +disk. Executing a query that does any of the above is not, on its own, a +vulnerability. -## Denial of Service (DoS) and Resource Exhaustion -Unexpected behavior (e.g., panics, crashes, excessive resource consumption, or -infinite loops) triggered by malformed or adversarial input is generally -considered a **bug**, not a security vulnerability, unless it is -**exploitable** and could allow an attacker to +It is the responsibility of the embedding application to decide and validate +that a query is safe to run (for example, by validating externally supplied +SQL text or URLs before passing them to DataFusion) and to sandbox execution of +untrusted queries at the OS / container level if needed. +DataFusion provides some APIs to help applications restrict what a query can do, +such as [`SQLOptions::with_allow_dml`] , but it does not guarantee that all +input is safe to execute; that remains the responsibility of the embedding +application. -* Execute arbitrary code (Remote Code Execution); -* Exfiltrate sensitive information from process memory (Information Disclosure); +### Data Files -If that exploitation path is unclear, the issue should likely be reported as a -bug. +Format readers (e.g. Parquet, CSV, JSON, Avro, and Arrow IPC) assume a +well-formed file written by a trusted writer. Crashes, panics, excessive +resource consumption, or other unexpected behavior triggered by a malformed or +corrupted file are generally treated as **bugs**, not vulnerabilities, unless +they are exploitable as described above. Applications can use APIs such as the +[arrow validation APIs] to validate a file's structure. + +Similarly, a file that is well-formed but contains unexpected or adversarial +data should also be handled properly, but is generally considered a **bug** +(though a more serious one), not a vulnerability, unless it is exploitable as +described above. -## Rust Safety, Soundness, and Undefined Behavior -Rust has a very [specific definition of unsafe]. When unsafe behavior results -from using safe code, the code is unsound and can lead to undefined behavior -(UB), which may be exploitable. +### Extensions and Other Uses of Public APIs -However, not all soundness issues are exploitable. In general, issues that -result in undefined behavior using safe APIs are considered bugs unless they -meet the exploitability bar defined above. +DataFusion exposes many public APIs for extending its behavior, such as user +defined function implementations, `TableProvider`s, and `ExecutionPlan`. Code +that uses these APIs is trusted (for example, that any `ArrayRef` passed to +or returned from an operator is a valid Arrow array). A crash, memory safety +issue, or other unexpected behavior that only occurs because custom extension +code violates such a contract is not considered a DataFusion vulnerability. -We therefore avoid classifying all unsoundness bugs as security -vulnerabilities (e.g. filing [RUSTSEC] and/or [CVE] advisories), which helps -avoid unnecessary downstream churn and keeps our focus on the most critical -issues. +## Denial of Service (DoS) and Resource Exhaustion -[specific definition of unsafe]: https://doc.rust-lang.org/book/ch20-01-unsafe-rust.html -[rustsec]: https://rustsec.org/ -[cve]: https://cve.mitre.org/ -[`sqloptions::with_allow_dml`]: https://docs.rs/datafusion/latest/datafusion/execution/context/struct.SQLOptions.html#method.with_allow_dml -[arrow validation apis]: https://docs.rs/arrow/latest/arrow/array/struct.ArrayData.html#method.validate_full +Unexpected behavior (e.g., panics, crashes, excessive resource consumption, or +infinite loops) triggered by malformed or adversarial input is generally +considered a **bug**, not a security vulnerability. ## Reporting a Bug From 83d141a633d62038f3195cc09567d0ca169219c1 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Wed, 30 Sep 2026 16:35:44 -0400 Subject: [PATCH 05/10] rewrite --- SECURITY.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f2cb17a5a6b71..4e4b040467c6b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -76,6 +76,12 @@ data should also be handled properly, but is generally considered a **bug** (though a more serious one), not a vulnerability, unless it is exploitable as described above. +### Serialized Plans + +Serialized plans such as `Substrait` and the `datafusion-proto` format (TODO LINK) are +considered trusted input. If these plans are received from untrusted sources, it +is the responsibility of the embedding application to validate them before +passing them to DataFusion for execution. ### Extensions and Other Uses of Public APIs @@ -89,8 +95,9 @@ code violates such a contract is not considered a DataFusion vulnerability. ## Denial of Service (DoS) and Resource Exhaustion Unexpected behavior (e.g., panics, crashes, excessive resource consumption, or -infinite loops) triggered by malformed or adversarial input is generally -considered a **bug**, not a security vulnerability. +infinite loops) triggered by malformed or adversarial input that may cause a +denial of service is generally considered a **bug**, not a security +vulnerability. ## Reporting a Bug From b51092cd2e423bddebf39fbab55c8e147afd0373 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Wed, 30 Sep 2026 16:45:09 -0400 Subject: [PATCH 06/10] trim --- SECURITY.md | 92 ++++++++++++++++++++--------------------------------- 1 file changed, 35 insertions(+), 57 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 4e4b040467c6b..40a8b180c44d3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -24,80 +24,54 @@ report vulnerabilities. ## Security Model -DataFusion is a low level library, designed to be embedded in applications that -have their own security model. This document describes the security model of -DataFusion itself. +DataFusion is a low level library, designed to be embedded in applications +that have their own security model. This section describes DataFusion's own +model: what counts as a bug versus a vulnerability. -### Memory Safety +In general, crashes, panics, hangs, and excessive resource consumption +(memory, CPU, or disk) are treated as **bugs**, not vulnerabilities, unless +they are **exploitable** and could let an attacker: -Given a valid SQL or DataFrame query over well-formed input files, DataFusion -is expected to execute it correctly without memory safety issues. Most of -DataFusion is written using `safe` Rust, which helps provide memory safety -guarantees, but some parts of DataFusion use `unsafe` Rust for performance -reasons. In general crashes (segfaults, panics, etc.) are treated as **bugs**, -not vulnerabilities, unless they are **exploitable** and could allow an attacker -to: +* Execute arbitrary code (Remote Code Execution), or +* Exfiltrate sensitive information from process memory (Information Disclosure). -* Execute arbitrary code (Remote Code Execution); -* Exfiltrate sensitive information from process memory (Information Disclosure); - -If that exploitation path is unclear, the issue should likely be reported as a -bug. +If the exploitation path is unclear, please report the issue as a bug rather +than a vulnerability. The sections below describe what DataFusion treats as +trusted input in a few specific areas. ### SQL and DataFrame Queries -SQL and DataFrame queries are executable code, comparable to a query language -like Bash or Python: a query can read files, open network connections (e.g via -`CREATE EXTERNAL TABLE` ), and consume arbitrary amounts of CPU, memory, or -disk. Executing a query that does any of the above is not, on its own, a -vulnerability. - -It is the responsibility of the embedding application to decide and validate -that a query is safe to run (for example, by validating externally supplied -SQL text or URLs before passing them to DataFusion) and to sandbox execution of -untrusted queries at the OS / container level if needed. +SQL and DataFrame queries are executable code, comparable to a scripting +language: a query can legitimately read files, open network connections +(e.g. via `CREATE EXTERNAL TABLE`), and consume significant CPU, memory, or +disk. Running such a query is not, on its own, a vulnerability. -DataFusion provides some APIs to help applications restrict what a query can do, -such as [`SQLOptions::with_allow_dml`] , but it does not guarantee that all -input is safe to execute; that remains the responsibility of the embedding -application. +It is the embedding application's responsibility to decide whether a query is +safe to run (e.g. validating externally supplied SQL text or URLs) and to +sandbox untrusted queries at the OS/container level if needed. APIs such as +[`SQLOptions::with_allow_dml`] can help restrict what a query is allowed to +do, but do not guarantee that all input is safe to execute. ### Data Files Format readers (e.g. Parquet, CSV, JSON, Avro, and Arrow IPC) assume a -well-formed file written by a trusted writer. Crashes, panics, excessive -resource consumption, or other unexpected behavior triggered by a malformed or -corrupted file are generally treated as **bugs**, not vulnerabilities, unless -they are exploitable as described above. Applications can use APIs such as the -[arrow validation APIs] to validate a file's structure. - -Similarly, a file that is well-formed but contains unexpected or adversarial -data should also be handled properly, but is generally considered a **bug** -(though a more serious one), not a vulnerability, unless it is exploitable as -described above. +well-formed file from a trusted writer; use the [arrow validation APIs] to +validate an untrusted file's structure. Issues due to malformed files, and +well-formed files that contain unexpected or adversarial *data*, are bugs rather +than vulnerabilities, as explained above. ### Serialized Plans -Serialized plans such as `Substrait` and the `datafusion-proto` format (TODO LINK) are -considered trusted input. If these plans are received from untrusted sources, it -is the responsibility of the embedding application to validate them before -passing them to DataFusion for execution. +Serialized plans, such as [Substrait] and [`datafusion-proto`], are treated +as trusted input. If received from an untrusted source, they should be +validated before being passed to DataFusion for execution. ### Extensions and Other Uses of Public APIs -DataFusion exposes many public APIs for extending its behavior, such as user -defined function implementations, `TableProvider`s, and `ExecutionPlan`. Code -that uses these APIs is trusted (for example, that any `ArrayRef` passed to -or returned from an operator is a valid Arrow array). A crash, memory safety -issue, or other unexpected behavior that only occurs because custom extension -code violates such a contract is not considered a DataFusion vulnerability. - -## Denial of Service (DoS) and Resource Exhaustion - -Unexpected behavior (e.g., panics, crashes, excessive resource consumption, or -infinite loops) triggered by malformed or adversarial input that may cause a -denial of service is generally considered a **bug**, not a security -vulnerability. +Code that uses DataFusion's public extension APIs (e.g. user defined functions, +`TableProvider`, `ExecutionPlan`) is trusted to uphold their contracts (for +example, that any `ArrayRef` is a valid Arrow array). Issues arising from +violating the API contracts are not considered a DataFusion vulnerability. ## Reporting a Bug @@ -117,4 +91,8 @@ Include in your report: - Affected crates and versions. - Potential impact. +[`sqloptions::with_allow_dml`]: https://docs.rs/datafusion/latest/datafusion/execution/context/struct.SQLOptions.html#method.with_allow_dml +[arrow validation apis]: https://docs.rs/arrow/latest/arrow/array/struct.ArrayData.html#method.validate_full +[substrait]: https://docs.rs/datafusion-substrait/latest/datafusion_substrait/ +[`datafusion-proto`]: https://docs.rs/datafusion-proto/latest/datafusion_proto/ [asf security reporting process]: https://www.apache.org/security/#reporting-a-vulnerability From d8543473c956f0df21189df3dbbf06622386dc00 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Wed, 30 Sep 2026 16:47:31 -0400 Subject: [PATCH 07/10] notes in libs --- datafusion/proto/src/lib.rs | 11 +++++++++++ datafusion/substrait/src/lib.rs | 8 ++++++++ 2 files changed, 19 insertions(+) diff --git a/datafusion/proto/src/lib.rs b/datafusion/proto/src/lib.rs index 71feae506dc6f..4f9f513383831 100644 --- a/datafusion/proto/src/lib.rs +++ b/datafusion/proto/src/lib.rs @@ -59,6 +59,17 @@ //! [datafusion-substrait]: https://docs.rs/datafusion-substrait/latest/datafusion_substrait //! [substrait.io]: https://substrait.io //! +//! # Security +//! +//! Serialized plans are treated as trusted input: this crate does not +//! validate that a plan is well-formed or safe to execute before converting +//! it into a DataFusion [`LogicalPlan`] or [`ExecutionPlan`]. If your +//! application accepts serialized plans from an untrusted source, validate +//! them before passing them to this crate. See the [DataFusion Security +//! Model] for more details. +//! +//! [DataFusion Security Model]: https://github.com/apache/datafusion/blob/main/SECURITY.md#serialized-plans +//! //! # Example: Serializing [`Expr`]s //! ``` //! # use datafusion_common::Result; diff --git a/datafusion/substrait/src/lib.rs b/datafusion/substrait/src/lib.rs index 0819fd3a592f9..595cf748b2693 100644 --- a/datafusion/substrait/src/lib.rs +++ b/datafusion/substrait/src/lib.rs @@ -57,6 +57,14 @@ //! [`substrait::proto::Rel`] can be serialized / deserialized to bytes, JSON and //! other formats using [prost] and the rest of the Rust protobuf ecosystem. //! +//! # Security +//! +//! Substrait plans are treated as trusted input. The application must validate +//! untrusted inputs as this crate does not validate that a plan is safe to +//! execute. See the [DataFusion Security Model] for more details. +//! +//! [DataFusion Security Model]: https://github.com/apache/datafusion/blob/main/SECURITY.md#serialized-plans +//! //! # Example: Serializing [`LogicalPlan`]s //! ``` //! # use datafusion::prelude::*; From 79aed46a268ee9270985cf31798c9b80aa17dda4 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Wed, 30 Sep 2026 16:52:18 -0400 Subject: [PATCH 08/10] cleanup --- datafusion/proto/src/lib.rs | 11 ++++------- datafusion/substrait/src/lib.rs | 6 +++--- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/datafusion/proto/src/lib.rs b/datafusion/proto/src/lib.rs index 4f9f513383831..f1cafd56c8fc6 100644 --- a/datafusion/proto/src/lib.rs +++ b/datafusion/proto/src/lib.rs @@ -61,12 +61,9 @@ //! //! # Security //! -//! Serialized plans are treated as trusted input: this crate does not -//! validate that a plan is well-formed or safe to execute before converting -//! it into a DataFusion [`LogicalPlan`] or [`ExecutionPlan`]. If your -//! application accepts serialized plans from an untrusted source, validate -//! them before passing them to this crate. See the [DataFusion Security -//! Model] for more details. +//! Serialized plans are treated as trusted input. The application must validate +//! untrusted inputs as this crate does not validate that a plan is safe to +//! execute. See the [DataFusion Security Model] for more details. //! //! [DataFusion Security Model]: https://github.com/apache/datafusion/blob/main/SECURITY.md#serialized-plans //! @@ -76,7 +73,7 @@ //! # use datafusion_expr::{col, lit, Expr}; //! # use datafusion_proto::bytes::Serializeable; //! # fn main() -> Result<()>{ -//! // Create a new `Expr` a < 32 +//! // Create a new `Expr` a < 5 //! let expr = col("a").lt(lit(5i32)); //! //! // Convert it to bytes (for sending over the network, etc.) diff --git a/datafusion/substrait/src/lib.rs b/datafusion/substrait/src/lib.rs index 595cf748b2693..9958959177ebd 100644 --- a/datafusion/substrait/src/lib.rs +++ b/datafusion/substrait/src/lib.rs @@ -48,12 +48,12 @@ //! # See Also //! //! Substrait does not (yet) support the full range of plans and expressions -//! that DataFusion offers. See the [datafusion-proto] crate for a DataFusion -//! specific format that does support of the full range. +//! that DataFusion offers. See the [datafusion-proto] crate for a DataFusion +//! specific format that does support the full range. //! //! [datafusion-proto]: https://docs.rs/datafusion-proto/latest/datafusion_proto //! -//! Note that generated types such as [`substrait::proto::Plan`] and +//! Note that generated types such as [`substrait::proto::Plan`] and //! [`substrait::proto::Rel`] can be serialized / deserialized to bytes, JSON and //! other formats using [prost] and the rest of the Rust protobuf ecosystem. //! From 5f6b5cd94df8df6f044371a89c142ab5c7c9fae8 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Thu, 1 Oct 2026 09:07:47 -0400 Subject: [PATCH 09/10] Update SECURITY.md Co-authored-by: Martin Grigorov --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 40a8b180c44d3..7727ed9b113ce 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -77,7 +77,7 @@ violating the API contracts are not considered a DataFusion vulnerability. We treat all bugs seriously and welcome help fixing them. If you find a bug that does not meet the criteria for a security vulnerability, please report it -in the public issue tracker. +in the [public issue tracker](https://github.com/apache/datafusion/issues/). ## Reporting a Vulnerability From 4598b306cc2c6713a93bcec8cb2a0b8784128906 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Mon, 5 Oct 2026 17:44:48 -0400 Subject: [PATCH 10/10] add note about datafusion-cli --- SECURITY.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 7727ed9b113ce..09c0a5f2ce163 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -22,6 +22,9 @@ This document outlines the security model for Apache DataFusion and how to report vulnerabilities. +This model also applies to the [datafusion-cli] command line tool, which is +a thin wrapper around the DataFusion library. + ## Security Model DataFusion is a low level library, designed to be embedded in applications @@ -91,6 +94,7 @@ Include in your report: - Affected crates and versions. - Potential impact. +[datafusion-cli]: https://datafusion.apache.org/user-guide/cli/index.html [`sqloptions::with_allow_dml`]: https://docs.rs/datafusion/latest/datafusion/execution/context/struct.SQLOptions.html#method.with_allow_dml [arrow validation apis]: https://docs.rs/arrow/latest/arrow/array/struct.ArrayData.html#method.validate_full [substrait]: https://docs.rs/datafusion-substrait/latest/datafusion_substrait/