[CASSANDRA-18526] TupleType getString and fromString are not safe with string types

• Type: Bug
• Status: Open
• Priority: Normal
• Resolution: Unresolved
• Fix Version/s: 5.x
• Component/s: CQL/Interpreter
• Bug Category: Correctness - Unrecoverable Corruption / Loss
• Severity: Normal
• Complexity: Low Hanging Fruit
• Discovered By: Fuzz Test
• Platform: All
• Assignee: Raymond Welgosh
• Reporter: David Capwell

Authors

Raymond Welgosh

• Created: 12/May/23 23:13
• Updated: 12/Nov/24 20:06

Description

In adding property tests for our type system in CASSANDRA-18504, I found that tuples have issues with strings as its escaping doesn’t work in all cases… below is a simple example where it fails

package org.apache.cassandra.db.marshal;

import java.nio.ByteBuffer;
import java.util.Arrays;
import java.util.List;
import java.util.UUID;

import org.junit.Test;

import org.apache.cassandra.cql3.FieldIdentifier;
import org.apache.cassandra.utils.ByteBufferUtil;

import static org.assertj.core.api.Assertions.assertThat;

public class UserTypeTest
{
    @Test
    public void test()
    {
        // tuple parsing checks for : and looks to see if a \\ is before it (escaped :), so when the string ends with this escape... we fail to parse
        String str = "thiswillbreakthings\\";
        UUID uuid = UUIDType.instance.compose(UUIDType.instance.fromString("00000000-0000-4800-9100-000000000000"));

        List<FieldIdentifier> fieldNames = Arrays.asList(new FieldIdentifier(ByteBufferUtil.bytes("a")),
                                                         new FieldIdentifier(ByteBufferUtil.bytes("b")));
        List<AbstractType<?>> fieldTypes = Arrays.asList(UTF8Type.instance, UUIDType.instance);
        UserType type = new UserType("--dummy--", UTF8Type.instance.decompose("name"), fieldNames, fieldTypes, false);
        ByteBuffer original = TupleType.buildValue(UTF8Type.instance.decompose(str), UUIDType.instance.decompose(uuid));
        String source = type.getString(original);
        ByteBuffer bb = type.fromString(source);
        ByteBuffer[] split = type.split(ByteBufferAccessor.instance, bb);
        assertThat(split).hasSize(2);
        assertThat(split[1]).isEqualTo(uuid);
    }
}

Issue Links

• links to: GitHub Pull Request #3647