문자열 기반 식별자·메타데이터·외부 provider 특성은 신뢰하지 말고 명시적으로 전파·검증하라

ClickHouse, rustfs, XLA/ROCm 관련 PR들에서 문자열 aggregate 이름, SQL identifier, object-store version header, GPU capability table, build overlay dependency 같은 메타데이터가 실제 의미를 정확히 담지 않아 보안·최적화·호환성 문제가 생겼다. 외부 시스템이 제공하는 값은 escaping, capability matrix, determinism propagat

Summary#

Problem#

arrayReduce('groupArraySample(1)', ...)가 내부 aggregate의 비결정성을 전파하지 않아 optimizer가 잘못된 pushdown/common subexpression 처리를 할 수 있었다. PostgreSQL integration은 identifier escaping이 부족해 SQL injection 가능성이 있었고, Cloudflare R2는 version id처럼 보이는 header를 주지만 routable version을 지원하지 않아 exact GET/DELETE routing에 사용하면 안 됐다. ROCm bandwidth는 정적 table/legacy formula에 의존하면 새 보드에서 부정확하고, LLVM overlay dependency는 Bzlmod와 WORKSPACE 양쪽에 등록되어야 했다.

Solution#

문자열로 지정된 함수나 identifier는 실행 대상의 속성에 따라 determinism과 escaping 규칙을 명시적으로 적용한다. S3 호환 provider는 응답 header만 보지 말고 실제 versioning capability를 provider matrix로 모델링하며, 가능하면 firmware/API에서 capability를 직접 조회하고 fallback table은 보조 수단으로 둔다. build dependency는 지원하는 모든 빌드 시스템 경로에 동일하게 선언해 query/build가 모두 해결되게 한다.

Failure Modes#

비결정적 함수를 deterministic으로 표시해 optimizer가 쿼리 의미를 바꿈
identifier를 값 literal처럼 취급하거나 escaping하지 않아 SQL injection 발생
외부 provider가 반환한 token을 실제 지원 기능으로 오인해 삭제/조회 라우팅 실패
하드코딩된 hardware table이 새 장비를 누락하거나 잘못된 성능값을 사용
Bzlmod와 WORKSPACE 중 한쪽만 갱신해 일부 빌드 환경에서 dependency resolution 실패

Sources#

https://github.com/tensorflow/tensorflow/pull/127549
https://github.com/tensorflow/tensorflow/pull/127458
https://github.com/tensorflow/tensorflow/pull/127449
https://github.com/tensorflow/tensorflow/pull/127550
https://github.com/tensorflow/tensorflow/pull/127623
https://github.com/tensorflow/tensorflow/pull/127622
https://github.com/tensorflow/tensorflow/pull/127621
https://github.com/tensorflow/tensorflow/pull/127617
https://github.com/tensorflow/tensorflow/pull/127459
https://github.com/tensorflow/tensorflow/pull/127561
https://github.com/tensorflow/tensorflow/pull/127494
https://github.com/tensorflow/tensorflow/pull/127533
https://github.com/huggingface/transformers/pull/48907
https://github.com/huggingface/transformers/pull/48926
https://github.com/huggingface/transformers/pull/48923
https://github.com/huggingface/transformers/pull/33737
https://github.com/huggingface/transformers/pull/33736
https://github.com/huggingface/transformers/pull/47992
https://github.com/huggingface/transformers/pull/35778
https://github.com/huggingface/transformers/pull/35321
https://github.com/huggingface/transformers/pull/48593
https://github.com/ClickHouse/ClickHouse/pull/117981
https://github.com/ClickHouse/ClickHouse/pull/118971
https://github.com/ClickHouse/ClickHouse/pull/113909
https://github.com/ClickHouse/ClickHouse/pull/100347
https://github.com/ClickHouse/ClickHouse/pull/116136
https://github.com/ClickHouse/ClickHouse/pull/120768
https://github.com/ClickHouse/ClickHouse/pull/119892
https://github.com/ClickHouse/ClickHouse/pull/119103
https://github.com/ClickHouse/ClickHouse/pull/116208
https://github.com/ClickHouse/ClickHouse/pull/114628
https://github.com/ClickHouse/ClickHouse/pull/120770
https://github.com/ClickHouse/ClickHouse/pull/120769
https://github.com/ClickHouse/ClickHouse/pull/118523
https://github.com/ClickHouse/ClickHouse/pull/116122
https://github.com/rustfs/rustfs/pull/8008
https://github.com/rustfs/rustfs/pull/8004
https://github.com/rustfs/rustfs/pull/8001
https://github.com/rustfs/rustfs/pull/8000
https://github.com/rustfs/rustfs/pull/7994
https://github.com/rustfs/rustfs/pull/7996
https://github.com/rustfs/rustfs/pull/7993
https://github.com/rustfs/rustfs/pull/7991
https://github.com/rustfs/rustfs/pull/7990
https://github.com/rustfs/rustfs/pull/7981
https://github.com/rustfs/rustfs/pull/7986
https://github.com/rustfs/rustfs/pull/7982
https://github.com/rustfs/rustfs/pull/7987
mined_at: 2026-09-18T12:42:45Z

Sagwan Revalidation 2026-09-18T13:20:25Z#

verdict: ok
note: 최근 채굴된 일반 원칙으로 주장·권장안이 현재 practice와 부합함