Re: CQL injection attacks?

2011-07-03 Thread dnallsopp
Quoting Eric Evans : > On Sat, 2011-07-02 at 19:17 +0100, dnalls...@taz.qinetiq.com wrote: > > Just to illustrate; the typical injection pattern is: > > select * from users where KEY='jsmith'; DROP COLUMNFAMILY 'users'; > > No, each CQL query must contain exactly one statement, so this sort of > a

Re: CQL injection attacks?

2011-07-02 Thread dnallsopp
Quoting Stephen Connolly : All, As Stephen said, regardless of the transfer protocol, if the content is parsed, then there is the potential for attacks. Just to illustrate; the typical injection pattern is: String user = getUserName() String cql = "select * from users where KEY='"+user+"';" exe

Re: faster ByteBuffer comparison

2011-07-02 Thread dnallsopp
Quoting Yang : I'd guess that getLong() is not faster because get() probably already benefits from processor cache etc. There are two concrete subclasses of ByteBuffer that implement get() - HeapByteBuffer and DirectByteBuffer (for mapped memory). It might be possible to optimise the comparison

Re: InvalidRequestException when inserting - why?

2011-07-01 Thread dnallsopp
Quoting Jonathan Ellis On Fri, Jul 1, 2011 at 7:12 AM, wrote: > > I assume there's something wrong with the data (the column has > validation_class: > > UTF8Type, so is it because I'm inserting non-UTF8 bytes?) but the exception > > doesn't explain. > > That would do it, but it looks like you've

InvalidRequestException when inserting - why?

2011-07-01 Thread dnallsopp
When attempting to insert a column. I get the following exception: InvalidRequestException(why="[Keyspace][ColumnFamily][9cc58234708d] = [6a53ac0452f67acd71b35463d475762b7f69cc0ea7f9e0cb0ca24f0e45170d48dafae04bf7b966fa75c7fb2bad0eace0ff23b265e8b0e35c7b0bbc2a516bb75b2007eb35ab1308b8c646428e0491840

CQL injection attacks?

2011-06-29 Thread dnallsopp
Someone asked a while ago whether Cassandra was vulnerable to injection attacks: http://stackoverflow.com/questions/5998838/nosql-injection-php-phpcassa-cassandra With Thrift, the answer was 'no'. With CQL, presumably the situation is different, at least until prepared statements are possible (

Cannot set column value to zero

2011-06-29 Thread dnallsopp
I had a strange problem recently where I was unable to set the value of a column to '0' (it always returned '1') but setting it to other values worked fine: [default@Test] set Urls['rowkey']['status']='1'; Value inserted. [default@Test] get Urls['rowkey']; => (column=status, value=1, timestamp=130

Priority queue in a single row - performance falls over time

2011-05-25 Thread dnallsopp
Hi all, I'm trying to implement a priority queue for holding a large number (millions) of items that need to be processed in time order. My solution works - but gets slower and slower until performance is unacceptable - even with a small number of items. Each item essentially needs to be popped