Details
Description
toCommentSafeString method replaces "\u" with "\ \u" to avoid codegen breaking.
But if the even number of "\" is put before "u", like "\ \u", in the string literal in the query, codegen can break.
Following code causes compilation error.
val df = Seq(...).toDF
df.select("'\\\\\\\\u002A/'").show
The reason of the compilation error is because "\\\\\\\\u002A/" is translated into "*/" (the end of comment).
Due to this unsafety, arbitrary code can be injected like as follows.
val df = Seq(...).toDF // Inject "System.exit(1)" df.select("'\\\\\\\\u002A/{System.exit(1);}/*'").show
Attachments
Issue Links
- is related to
-
SPARK-11352 codegen.GeneratePredicate fails due to unquoted comment
- Resolved
-
SPARK-12138 Escape \u in the generated comments.
- Resolved
- links to