Mitigate KQL injection in TopicToTableMapping configuration values

[Copilot]

Pull Request Description

TopicToTableMapping.validate() only checked for null/empty on db, table, mapping, and format fields. These values are interpolated directly into KQL commands via String.formatted() in KustoSinkTask, enabling injection of arbitrary management commands through KQL metacharacters (;, |, ').

// Before: attacker sets table = "TestTable; .show databases | project DatabaseName"
// This gets interpolated into:
FETCH_TABLE_COMMAND.formatted(table)  // → "TestTable; .show databases | project DatabaseName | count"

Changes:

• Add allowlist regex validation in TopicToTableMapping.validate() for all fields interpolated into KQL:
  • db, table, mapping: ^[a-zA-Z0-9_.\-]+$
  • format: ^[a-zA-Z0-9]+$
• Add 8 test cases covering semicolon, pipe, and single-quote injection vectors plus valid identifier acceptance

---

Future Release Comment

Breaking Changes:

• db, table, and mapping values in kusto.tables.topics.mapping now reject names containing characters outside [a-zA-Z0-9_.-]. format is restricted to [a-zA-Z0-9]. Configurations using spaces or other special characters in entity names will fail validation at startup.

Features:

• None

Fixes:

• Input validation on kusto.tables.topics.mapping fields to prevent KQL command injection (CWE-943)

[Copilot]

Pull request overview

Strengthens configuration validation to prevent KQL management-command injection by allowlisting safe characters in TopicToTableMapping fields that are interpolated into KQL, and adds unit tests to cover common metacharacter injection vectors.

Changes:

• Add allowlist regex validation for db, table, mapping, and format in TopicToTableMapping.validate().
• Add new unit tests asserting invalid characters (e.g., ;, |, ') are rejected and valid identifiers are accepted.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/main/java/com/microsoft/azure/kusto/kafka/connect/sink/TopicToTableMapping.java	Introduces regex allowlist validation for Kusto identifiers and ingestion format to mitigate KQL injection.
src/test/java/com/microsoft/azure/kusto/kafka/connect/sink/KustoSinkConnectorConfigTest.java	Adds tests for rejection of injection-like inputs and acceptance of valid identifiers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

validate() currently only validates format if it is non-null/non-empty. If the config omits format, this passes validation but later code paths call format.equalsIgnoreCase(...) (e.g., in table-access validation), which can throw a NullPointerException. Consider making format required here (throw ConfigException when missing/blank) or ensuring downstream callers handle null safely; add a test for missing/blank format to lock this in.

Suggested change

	validateKustoIdentifier("db", db);
	validateKustoIdentifier("table", table);
	if (mapping != null && !mapping.isEmpty()) {
	validateKustoIdentifier("mapping", mapping);
	}
	if (format != null && !format.isEmpty()) {
	if (!VALID_FORMAT_PATTERN.matcher(format).matches()) {
	throw new ConfigException(
	String.format("'format' contains invalid characters: '%s'. Only alphanumeric characters are allowed.", format));
	}
	if (null == format || format.isEmpty()) {
	throw new ConfigException("'format' must be provided for each mapping");
	}
	validateKustoIdentifier("db", db);
	validateKustoIdentifier("table", table);
	if (mapping != null && !mapping.isEmpty()) {
	validateKustoIdentifier("mapping", mapping);
	}
	if (!VALID_FORMAT_PATTERN.matcher(format).matches()) {
	throw new ConfigException(
	String.format("'format' contains invalid characters: '%s'. Only alphanumeric characters are allowed.", format));

[Copilot]

validateKustoIdentifier(...) assumes value is non-null and will throw a NullPointerException if called with null. Since this helper is new and likely to be reused, it would be more robust to explicitly check for null/blank and throw a ConfigException with a clear message (or fold the required/optional logic into the helper).

[Copilot]

PR description mentions adding 8 test cases for injection vectors, but this diff adds 7 new tests (5 rejection + 2 acceptance). Either add the missing test case or update the PR description/release notes to match what’s actually covered.