[BUG-SEC-3] Shell injection via unsanitized passwords in subprocess calls (clickhouse_loader.py, mysql_dumper.py)

[minguyen9988]

Summary

Both clickhouse_loader.py and mysql_dumper.py construct shell commands using Popen(shell=True) with database passwords interpolated directly into the command string without escaping. A password containing shell metacharacters (e.g., semicolons, quotes, pipe characters) can execute arbitrary shell commands.

Affected Code

clickhouse_loader.py

File: sink-connector/python/db_load/clickhouse_loader.py

password_option = f"--password '{password}'"
# ...
cmd = f"clickhouse-client {password_option} --query ..."
process = Popen(cmd, shell=True, ...)

Two occurrences of this pattern. The single quotes around {password} provide no protection — a password containing ' breaks out of the quoting.

mysql_dumper.py

File: sink-connector/python/db_dump/mysql_dumper.py

mysql_password_clause = f""" --password "{mysql_password}" """
# ...
cmd = f"mysqldump {mysql_password_clause} ..."
process = Popen(cmd, shell=True, ...)

Double quotes around {mysql_password} — a password containing double-quotes or other shell-interpreted characters breaks out.

Attack Vector

If a ClickHouse or MySQL password contains shell metacharacters, the password value breaks out of its quoting context and the remainder is interpreted as a separate shell command. The password is typically set in a YAML config file or environment variable. In shared environments or automated deployments, an attacker who can influence the password value can execute arbitrary commands on the host running the Python tools.

Fix

Use shlex.quote() to properly escape the password for shell use:

import shlex
password_option = f"--password {shlex.quote(password)}"

Or better yet, avoid shell=True entirely and pass arguments as a list:

cmd = ["clickhouse-client", "--password", password, "--query", query]
process = Popen(cmd, shell=False, ...)

The same fix applies to config_file_option in clickhouse_loader.py, which has the same vulnerability.

Impact

• Severity: CRITICAL (Command Injection — CWE-78)
• Type: OS Command Injection via shell metacharacters
• Affected versions: All versions with the Python db_load/db_dump tools

[minguyen9988]

Status at develop head e123450c8: fixed in the paths this issue names, unfixed duplicate remains.

sink-connector/python/db_load/clickhouse_loader.py now imports shlex (line 3) and uses it at lines 421/424 and 498/501, e.g. password_option= f"--password {shlex.quote(password)}". sink-connector/python/db_dump/mysql_dumper.py:159 likewise uses mysql_password_clause = f" --password {shlex.quote(mysql_password)} ".

Still vulnerable: ch_sink_tools/db_load/clickhouse_loader.py:421 and :466 still build password_option= f"--password {password}" inside single quotes, and ch_sink_tools/db_dump/mysql_dumper.py:124 still uses the double-quoted form. Both are fed to Popen(..., shell=True). That tree is the one packaged by pyproject.toml:52. Leaving open for the duplicate.