Secure query processing
A distributed database keeps an abstract syntax tree (AST) and an included user code from interacting with a query engine coordinator during the performance of query execution processes. The query engine coordinator is separated into a frontend and backend, where a compiler on the frontend generates an AST and serializes it to be sent to the backend. The backend is implemented in a security environment separate from the front end. The backend deserializes the AST, sanitizes it, and generates a query plan based on the sanitized AST.
1. A system, comprising:
one or more computing devices comprising at least one processor and at least one memory that stores computer-executable instructions that, in response to execution by the at least one processor, cause the system to at least:
receive a query at a query coordinator;
generate, by a frontend of the query coordinator, a first abstract syntax tree (AST) based, at least in part, on the query;
serialize, by the frontend of the query coordinator, data that represents the first AST;
generate, by a backend of the query coordinator, a second AST based, at least in part, on the serialized data;
evaluate, by a sanitizer of the backend of the query coordinator, the second AST for a security risk by at least enforcing one or more security rules;
generate, by the backend of the query coordinator, a third AST that is a modified version of the second AST in which the security risk is mitigated; and
cause a query plan based, at least in part, on the third AST to be executed by a query engine executor sandboxed from the frontend and the backend of the query coordinator.
2. The system of claim 1 , wherein the frontend of the query coordinator is in a security domain separate from the backend of the query coordinator.
3. The system of claim 1 , wherein an object header is generated to comprise the serialized data that represents the first AST and indicates that a node of the first AST has been at least one of previously serialized, is a stateful object, or is a new object.
4. The system of claim 1 , wherein:
the query coordinator comprises two instances of shared state information;
the first AST is based, at least in part, on one instance of the two instances; and
the second AST is based, at least in part, on another instance of the two instances.
5. The system of claim 1 , wherein the second AST is based, at least in part, on a previously serialized AST when an identifier representing the first AST is matched to an identifier stored in memory.
6. A computer-implemented method of processing a query of a database, comprising:
receiving a query at a query coordinator;
generating, by a frontend of the query coordinator, a first abstract syntax tree (AST) based, at least in part, on the query;
serialize, by the frontend of the query coordinator, the first AST;
transmitting the serialized first AST to a backend of the query coordinator;
generating, by the backend of the query coordinator, a second AST based at least on the serialized first AST;
evaluate, by a sanitizer of the backend of the query coordinator, the second AST for a security risk by at least enforcing one or more security rules; and
cause a query plan based at least on the second AST to be executed by a query engine executor sandboxed from the frontend and the backend of the query coordinator.
7. The computer-implemented method of claim 6 , wherein the frontend of the query coordinator is in a security domain separate from the backend of the query coordinator.
8. The computer-implemented method of claim 6 , wherein serializing the first AST comprises generating an identifier for at least one node of the first AST.
9. The computer-implemented method of claim 6 , wherein serializing the first AST includes shared state information as an input.
10. The computer-implemented method of claim 6 , wherein generating the second AST is based on shared state information of a backend of the query coordinator that is identical to shared state information of a frontend of the query coordinator.
11. The computer-implemented method of claim 6 , wherein:
generating the second AST is based on retrieving at least one of its nodes stored in memory.
12. The computer-implemented method of claim 6 , wherein:
generating the second AST is based, at least in part, on determining that a node of the first AST has previously been serialized.
13. The computer-implemented method of claim 6 , wherein a third AST is generated based, at least in part, on identifying and mitigating the security risk identified in the second AST.
14. A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
generate a first abstract syntax tree (AST) based, at least in part, on a user program;
serialize data that represents the first AST;
send the serialized data from a frontend of a query coordinator to a backend of a query coordinator, wherein the backend of the query coordinator:
is in a security domain separate from the frontend of the query coordinator,
generates a second AST based at least on the first AST,
evaluates, by using a sanitizer of the backend of the query coordinator, the second AST for a security risk by at least enforcing one or more security rules, and
generates a query plan based, at least in part, on the second AST; and
cause the query plan to be executed by a query engine sandboxed from the frontend and the backend of the query coordinator.
15. The non-transitory computer-readable storage medium of claim 14 , comprising further instructions that, as a result of being executed by the one or more processors, cause the computer system to:
identify the security risk in the second AST; and
generate a third AST that is a modified version of the second AST in which the security risk is mitigated.
16. The non-transitory computer-readable storage medium of claim 14 , wherein the first AST is generated in the frontend of the query coordinator in the security domain separate from the backend of the query coordinator.
17. The non-transitory computer-readable storage medium of claim 14 , wherein:
the query coordinator comprises two instances of identical shared state information.
18. The non-transitory computer-readable storage medium of claim 14 , wherein the query plan is based, at least in part, on a third AST that is a modified version of the second AST.
19. The non-transitory computer-readable storage medium of claim 14 storing thereon further executable instructions that, as a result of being executed by the one or more processors of the computer system, cause the computer system to at least:
serialize the first AST based, at least in part, on a search in a cache for an indicator of at least one node of the first AST.
20. The non-transitory computer-readable storage medium of claim 14 , wherein the serialized data comprises a serialized function.