Fix SQL injection vulnerability in UC function execution by harupy · Pull Request #19381 · mlflow/mlflow

harupy · 2025-12-15T01:29:44Z

🛠 DevTools 🛠

Install mlflow from this PR

# mlflow
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/19381/merge
# mlflow-skinny
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/19381/merge#subdirectory=libs/skinny

For Databricks, use the following command:

%sh curl -LsSf https://raw.githubusercontent.com/mlflow/mlflow/HEAD/dev/install-skinny.sh | sh -s pull/19381/merge

Related Issues/PRs

Resolve #19365

What changes are proposed in this pull request?

Add _quote_identifier() function to properly quote Unity Catalog identifiers with backticks before SQL interpolation. This prevents SQL injection attacks via maliciously crafted function names.

The function:

Splits multi-part identifiers (e.g., catalog.schema.function) and quotes each part with backticks
Strips existing backticks before re-quoting
Rejects identifiers with embedded backticks (which are not valid in UC)

How is this PR tested?

New unit tests

Does this PR require documentation update?

No. You can skip the rest of this section.

Release Notes

Is this a user-facing change?

Yes. Give a description of this change to be included in the release notes for MLflow users.

Fixed a SQL injection vulnerability in Unity Catalog function execution where maliciously crafted function names could execute arbitrary SQL.

What component(s), interfaces, languages, and integrations does this PR affect?

Components

area/gateway: MLflow AI Gateway client APIs, server, and third-party integrations

How should the PR be classified in the release notes? Choose one:

rn/bug-fix - A user-facing bug fix worth mentioning in the release notes

Should this PR be included in the next patch release?

Yes (this PR will be cherry-picked and included in the next patch release)

🤖 Generated with Claude Code

github-actions · 2025-12-15T01:38:00Z

Documentation preview for fd49858 is available at:

https://pr-19381--mlflow-docs-preview.netlify.app/docs/latest/

More info

Ignore this comment if this PR does not change the documentation.
The preview is updated when a new commit is pushed to this PR.
This comment was created by this workflow run.
The documentation was built by this workflow run.

Copilot

Pull request overview

This PR addresses a critical SQL injection vulnerability in Unity Catalog function execution by introducing proper escaping of function names before SQL interpolation. The fix adds a new escape_uc_identifier() function that validates and escapes catalog.schema.function identifiers with backticks, preventing malicious function names from executing arbitrary SQL.

Key changes:

Introduces escape_uc_identifier() function to validate and escape 3-part Unity Catalog identifiers
Updates get_execute_function_sql_stmt() to escape function names before SQL interpolation
Implements backtick escaping with double-backtick escape sequences for embedded backticks

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

mlflow/gateway/uc_function_utils.py

harupy · 2025-12-15T01:57:51Z

mlflow/gateway/uc_function_utils.py

IMO, https://mlflow.org/docs/latest/genai/governance/unity-catalog/ no longer makes sense. We can just use MCP now.

mlflow/gateway/uc_function_utils.py

serena-ruan · 2025-12-15T09:47:27Z

Actually is this a real vulnerability? get_execute_function_sql_stmt accepts FunctionInfo.full_name, it should already be a valid function name. Users shouldn't be able to pass function name directly

harupy · 2025-12-15T10:02:26Z

@serena-ruan Even if the attack is not valid, the fix still makes sense. The current code seems vulnerable to SQL injection.

serena-ruan · 2025-12-15T10:16:05Z

mlflow/gateway/uc_function_utils.py


+# Valid Unity Catalog identifier pattern: must start with letter or underscore,
+# followed by letters, digits, or underscores
+_VALID_UC_IDENTIFIER = re.compile(r"^[a-zA-Z_][a-zA-Z0-9_]*$")


It's possible it includes backticks?

serena-ruan · 2025-12-15T10:17:28Z

@serena-ruan Even if the attack is not valid, the fix still makes sense. The current code seems vulnerable to SQL injection.

It's true, but SQL injection shouldn't happen in function name part but the parameters part? BTW UC function execution should handle any potential security issues

Add `escape_uc_identifier()` to properly escape Unity Catalog function names with backticks before SQL interpolation, preventing SQL injection attacks via maliciously crafted function names. Fixes mlflow#19365 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: harupy <17039389+harupy@users.noreply.github.com>

Add input validation for Unity Catalog function names in get_execute_function_sql_stmt() to prevent SQL injection attacks. Function names are now validated to ensure they follow the catalog.schema.function format with only safe identifier characters. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: harupy <17039389+harupy@users.noreply.github.com>

Replace validation-based approach with identifier quoting using backticks. This is more flexible while still preventing SQL injection. - Add _quote_identifier() to quote SQL identifiers with backticks - Strip existing backticks before re-quoting - Reject identifiers with embedded backticks - Quote function names and parameter names in SQL statements 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: harupy <17039389+harupy@users.noreply.github.com>

B-Step62

LGTM

serena-ruan

LGTM!

Signed-off-by: harupy <17039389+harupy@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings December 15, 2025 01:29

github-actions bot added v3.7.1 rn/bug-fix Mention under Bug Fixes in Changelogs. labels Dec 15, 2025

Copilot started reviewing on behalf of harupy December 15, 2025 01:30 View session

harupy added v3.8.0 team-review Trigger a team review request and removed v3.7.1 labels Dec 15, 2025

github-actions bot requested review from B-Step62, BenWilson2, TomeHirata, WeichenXu123, daniellok-db, kevin-lyn, serena-ruan and xq-yin December 15, 2025 01:31

Copilot AI reviewed Dec 15, 2025

View reviewed changes

mlflow/gateway/uc_function_utils.py Outdated Show resolved Hide resolved

mlflow/gateway/uc_function_utils.py Outdated Show resolved Hide resolved

mlflow/gateway/uc_function_utils.py Show resolved Hide resolved

harupy commented Dec 15, 2025

View reviewed changes

serena-ruan reviewed Dec 15, 2025

View reviewed changes

mlflow/gateway/uc_function_utils.py Outdated Show resolved Hide resolved

github-actions bot assigned serena-ruan Dec 15, 2025

harupy requested a review from serena-ruan December 15, 2025 08:57

harupy force-pushed the fix-sql-injection-uc-function-utils branch from 03c54f3 to 628fb93 Compare December 15, 2025 09:07

serena-ruan reviewed Dec 15, 2025

View reviewed changes

harupy and others added 3 commits December 18, 2025 18:55

harupy force-pushed the fix-sql-injection-uc-function-utils branch from b808920 to fd49858 Compare December 18, 2025 10:17

harupy requested a review from serena-ruan December 18, 2025 10:19

B-Step62 approved these changes Dec 18, 2025

View reviewed changes

serena-ruan approved these changes Dec 18, 2025

View reviewed changes

github-actions bot assigned B-Step62 Dec 18, 2025

harupy added this pull request to the merge queue Dec 19, 2025

Merged via the queue into mlflow:master with commit 3ce5cf5 Dec 19, 2025
54 of 57 checks passed

harupy deleted the fix-sql-injection-uc-function-utils branch December 19, 2025 00:32

WeichenXu123 pushed a commit to WeichenXu123/mlflow that referenced this pull request Dec 19, 2025

Fix SQL injection vulnerability in UC function execution (mlflow#19381)

400b78b

Signed-off-by: harupy <17039389+harupy@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>

WeichenXu123 pushed a commit that referenced this pull request Dec 19, 2025

Fix SQL injection vulnerability in UC function execution (#19381)

2e65155

Signed-off-by: harupy <17039389+harupy@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix SQL injection vulnerability in UC function execution#19381

Fix SQL injection vulnerability in UC function execution#19381
harupy merged 3 commits intomlflow:masterfrom
harupy:fix-sql-injection-uc-function-utils

harupy commented Dec 15, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 15, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harupy Dec 15, 2025 •

edited

Loading

Uh oh!

Uh oh!

serena-ruan commented Dec 15, 2025 •

edited

Loading

Uh oh!

harupy commented Dec 15, 2025

Uh oh!

serena-ruan Dec 15, 2025

Uh oh!

serena-ruan commented Dec 15, 2025

Uh oh!

B-Step62 left a comment

Uh oh!

serena-ruan left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

harupy commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Install mlflow from this PR

Related Issues/PRs

What changes are proposed in this pull request?

How is this PR tested?

Does this PR require documentation update?

Release Notes

Is this a user-facing change?

What component(s), interfaces, languages, and integrations does this PR affect?

How should the PR be classified in the release notes? Choose one:

Should this PR be included in the next patch release?

Uh oh!

github-actions bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harupy Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

serena-ruan commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

harupy commented Dec 15, 2025

Uh oh!

serena-ruan Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

serena-ruan commented Dec 15, 2025

Uh oh!

B-Step62 left a comment

Choose a reason for hiding this comment

Uh oh!

serena-ruan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

harupy commented Dec 15, 2025 •

edited

Loading

github-actions bot commented Dec 15, 2025 •

edited

Loading

harupy Dec 15, 2025 •

edited

Loading

serena-ruan commented Dec 15, 2025 •

edited

Loading