orneryd / NornicDB / 36363936437

87%

Build Type

push

github

Committed by orneryd

Commit Message

fix(security): reject bare transaction commands on shared executors

The lane-3 shared-executor transaction finding was only half closed in
0a3da5e4: the one-statement script form (BEGIN ... COMMIT/ROLLBACK) runs
on a private clone, but a bare BEGIN still opened a transaction on the
shared cached executor through parseTransactionStatement for any context
not marked as a client statement. The embedded API (DB.Cypher /
DB.ExecuteCypher) runs on the shared base executor with an unmarked
context, so one caller's BEGIN made every concurrent auto-commit
statement and subsequent one-statement script run inside that caller's
transaction.

Cached per-database executors are now marked shared (SetSharedExecutor):
the embedded base executor, the HTTP executor cache and the Bolt
autocommit executor cache reject bare BEGIN/COMMIT/ROLLBACK with the same
Neo.ClientError.Statement.SyntaxError a client statement gets, and never
hold a transaction. Protocol transaction owners (HTTP/Bolt sessions) run
on their own per-session executors, which keep the pattern; embedded
callers wanting explicit transactions create their own session executor.

Regression coverage:
- pkg/cypher: bare commands rejected on shared executors (unmarked and
  transaction-owner contexts), scripts still isolated, concurrent
  scripts+autocommit race with zero lost writes, non-shared session
  executors keep BEGIN/COMMIT, client-statement rejection unchanged.
- pkg/nornicdb: DB.Cypher/ExecuteCypher reject bare commands on the
  shared executor; concurrent callers stay isolated.
- pkg/server: the cached executor rejects bare commands and leaves no
  transaction; session executors keep explicit transactions; scripts work.

Benchmarks (M2 Max, BenchmarkStatementRouting simple_match_limit):
autocommit 17.4-18.0 us/op, 11246 B, 161 allocs (recorded band
16.4-17.6 us/op, 160-163 allocs); explicit tx 11.16-11.20 us/op, 5679 B,
88 allocs (band 10.4-11.1 us/op, 87-90 allocs). Allocation-identical,
within noise.

Coverage Stats

18 of 18 new or added lines in 5 files covered. (100.0%)

23 existing lines in 8 files now uncovered.

175148 of 201373 relevant lines covered (86.98%)

1.02 hits per line