[DERBY-6648] Application code should not be able to call ContextService.getContextOrNull()

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.11.1.1
• Fix Version/s: 10.12.1.1
• Component/s: Services
• Labels: derby_backport_reject_10_11
• Urgency: Normal
• Issue & fix info: Release Note Needed
• Bug behavior facts: Security
• Assignee: Richard N. Hillegas
• Reporter: Richard N. Hillegas
• Created: 03/Jul/14 18:55
• Updated: 09/Sep/16 09:53
• Resolved: 02/Oct/14 13:32

Description

By calling ContextService.getContextOrNull() (and its relatives), application code can get its hands on all sorts of internal Derby contexts, factories, and managers. This allows application code to bypass SQL authorization checks and perform sensitive or data-corrupting actions.

For instance, right now an application can use this method to get its hands on the language connection context. From the lcc, the application can get its hands on the data dictionary and the execution transaction. Armed with those objects, the application can bypass authorization checks and create schema objects, users, and permissions.

Only Derby code should be able to call this powerful method.

Issue Links

• is related to: DERBY-6630 Applications can use JCECipherFactory to elevate their privileges to those granted to Derby
• is related to: DERBY-6631 FileMonitor can be used to elevate an application's privileges
• is related to: DERBY-6632 Applications may be able to use StorageFactoryService to delete Derby databases and overwrite service.properties.
• is related to: DERBY-6641 Application code may be able to use the public LogToFile class to interfere with Derby's operation.
• is related to: DERBY-6717 Policies with multiple SystemPermissions are not handled well
• is related to: DERBY-6744 Update the documentation of security policy files to include the new usederbyinternals SystemPermission
• is related to: DERBY-6751 Prevent user code from getting the LanguageConnectionContext from an EmbedConnection
• relates to: DERBY-6616 User procedures can call system procedures, circumventing SQL authorization.
• relates to: DERBY-6741 User code can get the ContextManager from an EmbedConnection