[DERBY-7161] Document the need for client-side applications to vet user-supplied connection directives

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 10.18.0.0
• Component/s: Documentation, Network Client
• Assignee: Unassigned
• Reporter: Richard N. Hillegas
• Created: 21/Mar/24 17:36
• Updated: 26/Apr/24 00:58

Description

Somewhere, we should document the fact that client-side applications should not use user-supplied URLs or Properties objects to connect to remote databases. Those URLs and Properties objects may contain instructions for tracing network traffic. If the client-side application runs from a more privileged account than the user, then this could let the user pollute parts of the directory system to which the user does not normally have write-access. Client-side applications should vet all user-supplied directives before establishing connections.

A related MySQL problem is described by [1].

[1] https://github.com/apache/security-site/compare/main...raboof:security-site:mysql