AWS m2: Add bulk read query validation error codes (BA-B2005 to BA-B2014)
Summary
Adds new error codes for write-behind persistence and bulk read operations, including validation that bulk read queries must be a single SELECT statement with allowed columns and must not contain DDL/DML keywords (INSERT, UPDATE, DELETE, DROP, etc.). Also reclassifies BA-B2000/BA-B2001 from Error to Warn with informational notes.
Security assessment
The new codes document input validation on bulk read queries: only single SELECT statements with restricted columns are allowed and DDL/DML keywords are rejected, which is a query-injection mitigation. It documents existing validation behavior rather than a specific disclosed vulnerability, so it is security-adjacent hardening.
Evidence
`BA-B2011` | Error | Bulk read query contains forbidden keyword: `%s`. DDL/DML keywords (INSERT, UPDATE, DELETE, DROP, etc.) are not allowed in bulk read queries. |
Diff
diff --git a/m2/latest/userguide/ba-runtime-error-codes-b.md b/m2/latest/userguide/ba-runtime-error-codes-b.md index a1d362858..92bd41686 100644 --- a//m2/latest/userguide/ba-runtime-error-codes-b.md +++ b//m2/latest/userguide/ba-runtime-error-codes-b.md @@ -20,2 +20,2 @@ Key | Severity | Text | Additional details -`BA-B2000` | Error | OutOfMemoryError while adding Index to cache. Index size may exceed serialization limits. Falling back to persistence. | -`BA-B2001` | Error | Could not add Index on cache. Persisting it. | +`BA-B2000` | Warn | Index with id `%s` exceeds cache `%s` memory limits. Bypassing cache and persisting directly to database. | Informational: this is a deliberate size-limit bypass (not an OutOfMemoryError). The index is persisted directly to the database; no action required. +`BA-B2001` | Warn | Could not add Index with id `%s` to cache `%s`. Bypassing cache and persisting directly to database. | Informational: the index is persisted directly to the database; no action required. @@ -24,0 +25,10 @@ Key | Severity | Text | Additional details +`BA-B2005` | Error | WriteBehind persistence thread interrupted. Check for unexpected thread interruption in the write-behind persistence layer. | +`BA-B2006` | Error | Error processing write-behind batch. Verify the persistence layer (database or Redis) is accessible and operational. | +`BA-B2007` | Error | Error while executing bulk read by filter query on dataset `%s`: `%s`. Verify the query syntax and that the persistence layer is accessible. | +`BA-B2008` | Error | Invalid bulk read query: `%s`. Only SELECT queries with `*` or `id, record` columns targeting the correct dataset are allowed. | +`BA-B2009` | Error | Bulk read query is null. Provide a non-null SELECT query for bulk read operations. | +`BA-B2010` | Error | Bulk read query contains multiple statements: `%s`. Only a single SELECT statement is allowed; remove semicolons and additional statements. | +`BA-B2011` | Error | Bulk read query contains forbidden keyword: `%s`. DDL/DML keywords (INSERT, UPDATE, DELETE, DROP, etc.) are not allowed in bulk read queries. | +`BA-B2012` | Error | Error while reading records by ids from cache for dataset `%s`: `%s`. Verify the cache (Redis/Ehcache) is accessible and operational. | +`BA-B2013` | Error | Dataset `%s` is not a Large KSDS. Verify the listcat JSON has `isLargeKSDS` set to true and the dataset was created with Large KSDS metadata. | +`BA-B2014` | Error | Error building indexes for dataset `%s`. Check database connectivity and disk space. Retry the loading operation. |