rules-cassandra

RISK: String concatenation in session.execute() enables CQL injection. FIX: Use prepared statements — session.prepare("SELECT ... WHERE id=?").bind(id) — so driver parameter binding handles escaping.

RISK: String concatenation into SimpleStatement is a CQL injection vector — an attacker who controls the concatenated value can add arbitrary CQL clauses to read/modify/drop data. FIX: Use prepared statements with bound parameters: session.prepare("SELECT ... WHERE id=?").bind(id).

Style: CQL keywords found in lowercase. Convention is to write CQL keywords (SELECT, FROM, WHERE, INSERT, etc.) in uppercase for readability and consistency.

RISK: TRUNCATE permanently deletes every row in the table/keyspace without a WHERE clause and cannot be rolled back. FIX: Use DELETE ... WHERE for targeted removal. If a full wipe is genuinely required, confirm backups exist and add an explicit human-approval gate in the deployment pipeline.

RISK: COMPACT STORAGE is deprecated since Cassandra 4.0 and removed in 5.0 — tables using it cannot be altered and are incompatible with several CQL features and drivers. FIX: Create new tables without COMPACT STORAGE; migrate existing ones with 'ALTER TABLE ... DROP COMPACT STORAGE' before upgrading.

RISK: Cassandra client credentials (username + password) hardcoded in Java source are committed to VCS and visible to anyone with repo access (CWE-798). FIX: Load credentials at runtime from environment variables, a secrets manager (Vault, AWS Secrets Manager), or a config file excluded from VCS.

RISK: AllowAllAuthenticator permits any client with any password to connect — effectively no authentication. FIX: Set authenticator: PasswordAuthenticator (or a custom LDAP/Kerberos authenticator) and create per-service credentials with minimum required privileges.

RISK: AllowAllAuthorizer grants every authenticated client full read/write/admin access to all keyspaces — there is no access control. FIX: Set authorizer: CassandraAuthorizer and assign roles with GRANT on only the keyspaces/tables each service needs.

RISK: Client-to-node encryption disabled — data, credentials, and CQL queries travel in plaintext on the network. FIX: Set 'client_encryption_options.enabled: true' and configure 'keystore'/'truststore' paths; enforce 'require_client_auth: true' for mTLS in sensitive environments.

RISK: internode_encryption: none means gossip traffic between Cassandra nodes (including replication writes) is unencrypted. In a multi-datacenter or cloud deployment an attacker on the same network segment can read and inject replication data. FIX: Set internode_encryption: all (or 'dc' for cross-DC only) and configure node keystore/truststore.

RISK: rpc_address: 0.0.0.0 binds Cassandra's native CQL port to all interfaces, exposing it to untrusted networks. FIX: Bind rpc_address to a specific internal IP; restrict port 9042 with firewall rules so only application servers can reach it.