Add a guardrail for misprepared statements

patch by Rishabh Saraswat; reviewed by Stefan Miklosovic, Brad Schoening for CASSANDRA-21139

Author: AshenScribe

CHANGES.txt

@@ -1,4 +1,5 @@
 7.0
+ * Add a guardrail for misprepared statements (CASSANDRA-21139)
 Merged from 6.0:
  * Ensure schema created before 2.1 without tableId in folder name can be loaded in SnapshotLoader (CASSANDRA-21246)
  * Differentiate between legitimate cases where the first entry is the same as the last entry and empty bounds in SSTableCursorWriter#addIndexBlock() (CASSANDRA-21255)

conf/cassandra.yaml

@@ -2565,6 +2565,13 @@ drop_compact_storage_enabled: false
 # This would also apply to system keyspaces.
 # maximum_replication_factor_warn_threshold: -1
 # maximum_replication_factor_fail_threshold: -1
+#
+# Guardrail to warn or fail when a statement is prepared without bind markers (parameters).
+# This prevents the Prepared Statement Cache from being flooded with unique entries caused
+# by hardcoded literals. When warned is true, logs a warning on the usage of misprepared statements.
+# When enabled is true, rejects misprepared statements with an error.
+# prepared_statements_require_parameters_warned: true
+# prepared_statements_require_parameters_enabled: false
 
 #role_name_policy:
 #  # Implementation class of a validator. When not in form of FQCN, the

conf/cassandra_latest.yaml

@@ -2343,6 +2343,13 @@ drop_compact_storage_enabled: false
 # This would also apply to system keyspaces.
 # maximum_replication_factor_warn_threshold: -1
 # maximum_replication_factor_fail_threshold: -1
+#
+# Guardrail to warn or fail when a statement is prepared without bind markers (parameters).
+# This prevents the Prepared Statement Cache from being flooded with unique entries caused
+# by hardcoded literals. When warned is true, logs a warning on the usage of misprepared statements.
+# When enabled is true, rejects misprepared statements with an error.
+# prepared_statements_require_parameters_warned: true
+# prepared_statements_require_parameters_enabled: false
 
 #role_name_policy:
 #  # Implementation class of a validator. When not in form of FQCN, the

src/java/org/apache/cassandra/config/Config.java

@@ -938,6 +938,8 @@ public static void setClientMode(boolean clientMode)
     public volatile boolean user_timestamps_enabled = true;
     public volatile boolean alter_table_enabled = true;
     public volatile boolean group_by_enabled = true;
+    public volatile boolean prepared_statements_require_parameters_warned = true;
+    public volatile boolean prepared_statements_require_parameters_enabled = false;
     public volatile boolean bulk_load_enabled = true;
     public volatile boolean drop_truncate_table_enabled = true;
     public volatile boolean drop_keyspace_enabled = true;

src/java/org/apache/cassandra/config/GuardrailsOptions.java

@@ -1403,6 +1403,36 @@ public void setMinimumClientDriverVersionsDisallowed(Map<String, String> version
                                   x -> config.minimum_client_driver_versions_disallowed = x);
     }
 
+    @Override
+    public boolean getPreparedStatementsRequireParametersWarned()
+    {
+        return config.prepared_statements_require_parameters_warned;
+    }
+
+    @Override
+    public boolean getPreparedStatementsRequireParametersEnabled()
+    {
+        return config.prepared_statements_require_parameters_enabled;
+    }
+
+    @Override
+    public void setPreparedStatementsRequireParametersWarned(boolean warned)
+    {
+        updatePropertyWithLogging("prepared_statements_require_parameters_warned",
+                                  warned,
+                                  () -> config.prepared_statements_require_parameters_warned,
+                                  x -> config.prepared_statements_require_parameters_warned = x);
+    }
+
+    @Override
+    public void setPreparedStatementsRequireParametersEnabled(boolean enabled)
+    {
+        updatePropertyWithLogging("prepared_statements_require_parameters_enabled",
+                                  enabled,
+                                  () -> config.prepared_statements_require_parameters_enabled,
+                                  x -> config.prepared_statements_require_parameters_enabled = x);
+    }
+
     private static <T> void updatePropertyWithLogging(String propertyName, T newValue, Supplier<T> getter, Consumer<T> setter)
     {
         T oldValue = getter.get();

src/java/org/apache/cassandra/cql3/CQLStatement.java

@@ -73,6 +73,18 @@ default Iterable<Function> getFunctions()
      */
     void validate(ClientState state);
 
+    /**
+     * Performs validation specific to the preparation phase of a CQL statement.
+     * <p>
+     * Unlike {@link #validate(ClientState)}, which is invoked during normal execution,
+     * this method is explicitly triggered only when a statement is being prepared by a client.
+     * By default, this is a no-op. Subclasses can override this to enforce preparation-specific
+     * rules or guardrails (e.g., ensuring prepared statements contain bind markers).
+     *
+     * @param state the current client state
+     */
+    default void validatePrepare(ClientState state) {}
+
     /**
      * Execute the statement and return the resulting result or null if there is no result.
      *

src/java/org/apache/cassandra/cql3/QueryProcessor.java

@@ -494,6 +494,7 @@ public static Prepared parseAndPrepare(String query, ClientState clientState, bo
         // Note: if 2 threads prepare the same query, we'll live so don't bother synchronizing
         CQLStatement statement = raw.prepare(clientState);
         statement.validate(clientState);
+        statement.validatePrepare(clientState);
 
         // Set CQL string for AlterSchemaStatement as this is used to serialize the transformation
         // in the cluster metadata log

src/java/org/apache/cassandra/cql3/statements/BatchStatement.java

@@ -338,6 +338,15 @@ public void validate(ClientState state) throws InvalidRequestException
             statement.validate(state);
     }
 
+    @Override
+    public void validatePrepare(ClientState state)
+    {
+        for (ModificationStatement statement : statements)
+        {
+            statement.validatePrepare(state);
+        }
+    }
+
     @Override
     public List<ModificationStatement> getStatements()
     {

src/java/org/apache/cassandra/cql3/statements/ModificationStatement.java

@@ -414,6 +414,12 @@ public void validate(ClientState state) throws InvalidRequestException
             Guardrails.userTimestampsEnabled.ensureEnabled(state);
     }
 
+    @Override
+    public void validatePrepare(ClientState state)
+    {
+        Guardrails.preparedStatementsRequireParameters.guard(this, restrictions, state, metadata.keyspace, metadata.getTableName());
+    }
+
     public void validateDiskUsage(QueryOptions options, ClientState state)
     {
 

src/java/org/apache/cassandra/cql3/statements/SelectStatement.java

@@ -344,6 +344,12 @@ public void validate(ClientState state) throws InvalidRequestException
             Guardrails.allowFilteringEnabled.ensureEnabled(state);
     }
 
+    @Override
+    public void validatePrepare(ClientState state)
+    {
+        Guardrails.preparedStatementsRequireParameters.guard(this, restrictions, state, table.keyspace, table.getTableName());
+    }
+
     @Override
     public ResultMessage.Rows execute(QueryState state, QueryOptions options, Dispatcher.RequestTime requestTime)
     {