Defense-in-depth screen for a caller-supplied WHERE-body / ORDER-BY-body fragment before it is
interpolated into a driver SELECT (see BaseSqlExternalDataSourceDriver.buildSelectSql).
The clause contract is the same as MJ RunView's ExtraFilter/OrderBy — a trusted dialect
fragment the provider screens (ValidateUserProvidedSQLClause). But the engine is the security
boundary for the drivers, so it must NOT rely on a specific caller having screened: any consumer
(a different provider, a direct caller, a test harness) reaches the raw interpolation otherwise.
This re-screens at the boundary. Fail-closed; throws when the fragment:
contains a comment marker (--, /* */) — can truncate the rest of the generated query, or
contains a statement separator (;), or
does not parse as a single read-only statement once wrapped (break-out / smuggled write/DDL).
Note: this blocks statement-stacking, comment truncation, and smuggled writes/DDL — it does NOT
attempt to block every read-side resource-abuse function (e.g. pg_sleep, UTL_HTTP); the data
source connects under its own (ideally least-privilege, read-only) credential for that surface.
Defense-in-depth screen for a caller-supplied WHERE-body / ORDER-BY-body fragment before it is interpolated into a driver SELECT (see
BaseSqlExternalDataSourceDriver.buildSelectSql).The clause contract is the same as MJ RunView's
ExtraFilter/OrderBy— a trusted dialect fragment the provider screens (ValidateUserProvidedSQLClause). But the engine is the security boundary for the drivers, so it must NOT rely on a specific caller having screened: any consumer (a different provider, a direct caller, a test harness) reaches the raw interpolation otherwise. This re-screens at the boundary. Fail-closed; throws when the fragment:--,/* */) — can truncate the rest of the generated query, or;), orNote: this blocks statement-stacking, comment truncation, and smuggled writes/DDL — it does NOT attempt to block every read-side resource-abuse function (e.g.
pg_sleep,UTL_HTTP); the data source connects under its own (ideally least-privilege, read-only) credential for that surface.