Arawoof06 opened a new issue, #1357:
URL: https://github.com/apache/arrow-java/issues/1357
In the Flight SQL JDBC driver,
`ArrowFlightConnectionConfigImpl.ArrowFlightConnectionProperty.getBoolean`
compares the property value with:
```java
return valueFromProperties.equals("1") || valueFromProperties.equals("true");
```
Only the exact lowercase `true` (or `1`) is treated as true. Values coming
from the JDBC URL or `Properties` are not normalized, so a perfectly reasonable
value such as `useEncryption=TRUE` or `useEncryption=True` is parsed as `false`.
`useEncryption` defaults to `true` and feeds
`ArrowFlightSqlClientHandler.Builder.withEncryption(...)`. When it is parsed as
`false`, the driver connects to the server over plaintext gRPC and performs the
authentication handshake (username/password, bearer token, or OAuth
credentials) over the unencrypted channel. A user who believes they enabled TLS
gets a cleartext connection and credential exposure instead.
Most JDBC drivers parse boolean options case-insensitively, so this is
surprising and security-relevant. `getBoolean` should accept `true`
case-insensitively (still honoring `1`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
