{"owner":"apache","repo":"calcite","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md"],"skills":{"AGENTS.md":"# Agent guidance\n\nThis file is read by automated agents (security scanners, code analyzers,\nAI assistants) operating on this repository. It points them at the\nhuman-authored references they should consult before producing output.\n\n## Security\n\nSecurity model: [SECURITY.md](./SECURITY.md), which links to the project's\nthreat model at\n[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md).\n\nCalcite is an embedded SQL framework, not a server. It opens no socket and\nhas no authentication or authorization of its own; the host application\nowns transport, identity, and schema scoping. Read the threat model before\nreporting anything — it is explicit about what it does and does not treat\nas a vulnerability.\n\nTwo rules carry most of the triage weight:\n\n- **Surprising vs unsurprising class loading.** A class named through a\n  Calcite SPI position — `schemaFactory`, `parserFactory`, `typeSystem`,\n  `metaTableFactory`, `metaColumnFactory`, `tableFactory`, function\n  classes, `dataSource`, `jdbcDriver`, `model` — is loaded only through\n  that SPI, gated by `Class.forName(name, false, loader)` plus an\n  `isAssignableFrom` check. A class that does not implement the SPI for\n  its position is never instantiated by name. SQL may name SPI classes,\n  but only SPI implementations run, and only through their SPI.\n- **Pushed-down SQL.** The SQL Calcite generates and sends to a backend\n  the operator configured is *not* a vulnerability — the query author can\n  already reach that endpoint through the visible schemas. A pushdown bug\n  that reads *beyond* the configured schemas is P4 and *is* one.\n\nExplicitly not vulnerabilities (see the model's \"Not a vulnerability\"\nsection): the os-adapter running OS commands, the file/CSV/JSON adapters\nreading paths they were configured with, anything requiring a changed\nsystem property or classpath, a third-party driver's behaviour past the\nconnection boundary, and cross-tenant reads that follow from the embedder\nexposing several principals' schemas on one connection.\n\nThe model also lists what belongs to the host rather than the library —\ntransport and identity, schema scoping, adapter selection, the classpath,\nand whatever a `model` points at — under \"Downstream responsibilities\".\n"},"files":{"AGENTS.md":"# Agent guidance\n\nThis file is read by automated agents (security scanners, code analyzers,\nAI assistants) operating on this repository. It points them at the\nhuman-authored references they should consult before producing output.\n\n## Security\n\nSecurity model: [SECURITY.md](./SECURITY.md), which links to the project's\nthreat model at\n[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md).\n\nCalcite is an embedded SQL framework, not a server. It opens no socket and\nhas no authentication or authorization of its own; the host application\nowns transport, identity, and schema scoping. Read the threat model before\nreporting anything — it is explicit about what it does and does not treat\nas a vulnerability.\n\nTwo rules carry most of the triage weight:\n\n- **Surprising vs unsurprising class loading.** A class named through a\n  Calcite SPI position — `schemaFactory`, `parserFactory`, `typeSystem`,\n  `metaTableFactory`, `metaColumnFactory`, `tableFactory`, function\n  classes, `dataSource`, `jdbcDriver`, `model` — is loaded only through\n  that SPI, gated by `Class.forName(name, false, loader)` plus an\n  `isAssignableFrom` check. A class that does not implement the SPI for\n  its position is never instantiated by name. SQL may name SPI classes,\n  but only SPI implementations run, and only through their SPI.\n- **Pushed-down SQL.** The SQL Calcite generates and sends to a backend\n  the operator configured is *not* a vulnerability — the query author can\n  already reach that endpoint through the visible schemas. A pushdown bug\n  that reads *beyond* the configured schemas is P4 and *is* one.\n\nExplicitly not vulnerabilities (see the model's \"Not a vulnerability\"\nsection): the os-adapter running OS commands, the file/CSV/JSON adapters\nreading paths they were configured with, anything requiring a changed\nsystem property or classpath, a third-party driver's behaviour past the\nconnection boundary, and cross-tenant reads that follow from the embedder\nexposing several principals' schemas on one connection.\n\nThe model also lists what belongs to the host rather than the library —\ntransport and identity, schema scoping, adapter selection, the classpath,\nand whatever a `model` points at — under \"Downstream responsibilities\".\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","title":"AGENTS.md","content":"# Agent guidance\n\nThis file is read by automated agents (security scanners, code analyzers,\nAI assistants) operating on this repository. It points them at the\nhuman-authored references they should consult before producing output.\n\n## Security\n\nSecurity model: [SECURITY.md](./SECURITY.md), which links to the project's\nthreat model at\n[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md).\n\nCalcite is an embedded SQL framework, not a server. It opens no socket and\nhas no authentication or authorization of its own; the host application\nowns transport, identity, and schema scoping. Read the threat model before\nreporting anything — it is explicit about what it does and does not treat\nas a vulnerability.\n\nTwo rules carry most of the triage weight:\n\n- **Surprising vs unsurprising class loading.** A class named through a\n  Calcite SPI position — `schemaFactory`, `parserFactory`, `typeSystem`,\n  `metaTableFactory`, `metaColumnFactory`, `tableFactory`, function\n  classes, `dataSource`, `jdbcDriver`, `model` — is loaded only through\n  that SPI, gated by `Class.forName(name, false, loader)` plus an\n  `isAssignableFrom` check. A class that does not implement the SPI for\n  its position is never instantiated by name. SQL may name SPI classes,\n  but only SPI implementations run, and only through their SPI.\n- **Pushed-down SQL.** The SQL Calcite generates and sends to a backend\n  the operator configured is *not* a vulnerability — the query author can\n  already reach that endpoint through the visible schemas. A pushdown bug\n  that reads *beyond* the configured schemas is P4 and *is* one.\n\nExplicitly not vulnerabilities (see the model's \"Not a vulnerability\"\nsection): the os-adapter running OS commands, the file/CSV/JSON adapters\nreading paths they were configured with, anything requiring a changed\nsystem property or classpath, a third-party driver's behaviour past the\nconnection boundary, and cross-tenant reads that follow from the embedder\nexposing several principals' schemas on one connection.\n\nThe model also lists what belongs to the host rather than the library —\ntransport and identity, schema scoping, adapter selection, the classpath,\nand whatever a `model` points at — under \"Downstream responsibilities\".\n","category":"root","tokens":564}]}