Revert "Feat: A SQL function obfuscateQuery"#100711
Merged
Algunenano merged 1 commit intomasterfrom Mar 25, 2026
Merged
Conversation
1 task
Contributor
|
Workflow [PR], commit [b65f2d2] AI ReviewSummaryThis PR fully reverts ClickHouse Rules
Final Verdict
|
Algunenano
commented
Mar 25, 2026
Member
Author
Algunenano
left a comment
There was a problem hiding this comment.
Need a green CI. Merging
Algunenano
added a commit
to Algunenano/ClickHouse
that referenced
this pull request
Mar 25, 2026
Add section 10 to the C++ risk checklist: "Trust boundary expansion —
looking beyond the diff". This checklist triggers when a PR wraps existing
internal code for a wider audience (e.g. CLI tool → SQL function, library
→ server endpoint).
The core workflow: read the callee implementation, compare what existing
callers pass vs. what the PR passes (catching degraded integration bugs
like no-op callbacks), grep for dangerous patterns in the callee, and —
critically — trace every suspicious finding with a concrete minimal input,
writing out variable values at each iteration.
The key insight, earned through many iterations of AI-assisted reviewing
and refining the prompt: the primary failure mode is finding a suspicious
pattern and then reasoning abstractly ("technically safe because of memory
layout / padding / practical likelihood") instead of doing a 5-line
concrete trace that would immediately prove or disprove the bug. The
checklist explicitly calls out this anti-pattern.
Motivated by ClickHouse#100711 where
`obfuscateIdentifier` reads a relative offset before the buffer start on
boundary inputs — a pre-existing bug that becomes exploitable when exposed
as a SQL function via `obfuscateQuery`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Merged
1 task
Desel72
pushed a commit
to Desel72/ClickHouse
that referenced
this pull request
Mar 30, 2026
Add section 10 to the C++ risk checklist: "Trust boundary expansion —
looking beyond the diff". This checklist triggers when a PR wraps existing
internal code for a wider audience (e.g. CLI tool → SQL function, library
→ server endpoint).
The core workflow: read the callee implementation, compare what existing
callers pass vs. what the PR passes (catching degraded integration bugs
like no-op callbacks), grep for dangerous patterns in the callee, and —
critically — trace every suspicious finding with a concrete minimal input,
writing out variable values at each iteration.
The key insight, earned through many iterations of AI-assisted reviewing
and refining the prompt: the primary failure mode is finding a suspicious
pattern and then reasoning abstractly ("technically safe because of memory
layout / padding / practical likelihood") instead of doing a 5-line
concrete trace that would immediately prove or disprove the bug. The
checklist explicitly calls out this anti-pattern.
Motivated by ClickHouse#100711 where
`obfuscateIdentifier` reads a relative offset before the buffer start on
boundary inputs — a pre-existing bug that becomes exploitable when exposed
as a SQL function via `obfuscateQuery`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts #98305
ASAN Crash: https://s3.amazonaws.com/clickhouse-test-reports/PRs/100683/14d36b8a2b692110d6a5f5eb898d4a37a3a612ca/unit_tests_asan_ubsan/job.log
Repro: