Repository navigation
fix(security): P1 audit fixes - Oracle identifier quoting, env credential gates, /health and OTel hardening - #2107
Merged
Merged
Conversation
) Share the #1977 env-name prefixes and an explicit destination allowlist in the loader. Non-REST targets and findings_sink copy an env credential only after both checks pass.
…ector (Refs #2086) Derive the credential destination from an explicit per-type key so SharePoint (site_url), Snowflake (account or <account>.snowflakecomputing.com), WebDAV, NFS, and the host-based engines can satisfy allowed_hosts. HubSpot and the default Power BI token host stay on their existing vendor allowlists. allowed_hosts is read from the same YAML the config author writes, same limit as #1977. Against that author only the env-name prefix is an independent control; the host list is a brake, not a second authority.
FastAPI 0.142.x exports OTLP from the environment unless auto_configure is off. Keep product export behind DATA_BOAR_OTEL_ENABLED. The version bump to 0.143.0 stays on the dependency PR.
…2077) Probes still skip the API key and now receive only {"status":"ok"}. License, trust, transport, and integrity stay on GET /status. No separate not-ready 503 existed on this handler, so that path was left unchanged.
Probes still use the status code. License and transport readers now use GET /status, including the nogil image check and the operator docs.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Security epic, PR A of 2. Fixes the three P1 findings from the
security-auditrun 1 and the Slack triage (#2094, #2086, #2087) plus three confirmed P2 findings (#2088, #2089, #2077). One commit per subject, each written test-first (red before the fix) and SSH-signed.[A-Z][A-Z0-9_$#]*catalog names stay unquoted; anything else is quoted with"doubled, so a scanned object's name can no longer splice SQL.pass_from_envand the other env credential keys: non-REST targets andfindings_sinknow require the security(MEDIUM): REST connector base_url/token_url has no host allowlist — Bearer/client_secret exfil to public host #1977 env-name prefix (DATA_BOAR_,REST_API_,API_) and an explicitallowed_hostsentry for every place the secret is sent. Destination keys are an explicit per-type table (SharePointsite_url, Snowflakeaccountor<account>.snowflakecomputing.com, NFSserver, Dataverseorg_url+token_url, ...). Unknown types fail closed.${VAR}interpolation uses the same prefixes;public_base_url(display text, appended to the webhook body) no longer expands env at all.fastapi>=0.143.0(native OTel auto-config is opt-in from 0.143.0; 0.142.x exported OTLP from the environment) plus an explicittelemetry={"auto_configure": False}./healthreturns only{"status": "ok"}. License, trust, transport and integrity stay on the authenticatedGET /status; consumers (nogil image check, dashboard help text, docs en and pt-BR) were moved to/status.Residual risk, stated plainly:
allowed_hostsis read from the same YAML the config author writes (same limit as #1977). Against that author only the env-name prefix is an independent control. An operator-controlled allowlist is tracked in #2103 and is out of scope here.Not in this PR: #2078 and the
needs-validationfindings (#2090 to #2100) go in PR B. #2098 (workflow gate), #2080 and #2101 are operator-owned and untouched.Type of change
Breaking changes and migration (also in CHANGELOG)
pass_from_env,password_from_env,user_from_env,auth.token_from_env,auth.client_secret_from_env,client_secret_from_env) on a non-REST target orfindings_sinknow needs a prefixed name andallowed_hosts; otherwise config load fails. Shipped samples and docs were migrated.notifications.public_base_url: ${VAR}now raises at load instead of expanding./healthno longer carries license, trust, transport or integrity; read them fromGET /status.Issue linking (required)
The closing keywords are deliberately outside a code block: GitHub ignores them inside fences.
Closes #2094
Closes #2086
Closes #2087
Closes #2088
Closes #2089
Closes #2077
Closes #NNNNor documentsNo issue closed:above🧱 Checklist de Integridade
uv run pytesteuv run ruff check .sem erros (via./scripts/check-all.sh, exit 0: 3319 passed, 83 skipped, 2 xfailed; pre-commit, Bandit, Zizmor e Gitleaks verdes).README.pt_BR.mdsem alteração necessária; USAGE, SECURITY, CHANGELOG e docs de operação atualizados em en e pt-BR.