fix(Security): Apply patch update 0.9.2 to main (#6907)

* Restrict Kafka client params that execute commands or load libraries

Kafka source configs can be submitted through the REST API, so they should not be able to make librdkafka run shell commands or load native libraries. Kerberos ticket refresh is now opt-in through the operator-set `QW_KAFKA_KINIT_CMD` environment variable.

* Bump tantivy to e1acb3e

* Bump version to 0.9.2

* Add security note to REST API docs

* Treat an empty QW_KAFKA_KINIT_CMD as unset

An empty or whitespace-only value now behaves like an unset variable and keeps Kerberos ticket refresh disabled.

Author: dayaffe

CHANGELOG.md

@@ -23,6 +23,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 --->
 
+# [0.9.2]
+
+### Security
+
+- Restrict Kafka client params that execute commands or load libraries (GHSA-g85h-2988-4cv8).
+- Reject oversized columnar dictionaries during merges (Tantivy GHSA-7pph-m7rw-cqhv).
+
 # [0.9.1]
 
 ### Security

docs/configuration/source-config.md

@@ -103,6 +103,8 @@ A tutorial is available [here](/docs/ingest-data/kafka.md).
 
 The Kafka source consumes a `topic` using the client library [librdkafka](https://github.com/edenhill/librdkafka) and forwards the key-value pairs carried by the parameter `client_params` to the underlying librdkafka consumer. Common `client_params` options are bootstrap servers (`bootstrap.servers`), or security protocol (`security.protocol`). Please, refer to [Kafka](https://kafka.apache.org/documentation/#consumerconfigs) and [librdkafka](https://github.com/edenhill/librdkafka/blob/master/CONFIGURATION.md) documentation pages for more advanced options.
 
+For security reasons, `client_params` cannot set `sasl.kerberos.kinit.cmd`, `sasl.kerberos.min.time.before.relogin`, `plugin.library.paths`, `ssl.engine.location`, or `ssl.providers`. By default, librdkafka does not run `kinit` to acquire or refresh Kerberos tickets. To enable it, set the `QW_KAFKA_KINIT_CMD` environment variable to the `kinit` command on every node that creates or runs Kafka sources. The command cannot contain `%{...}` placeholders, so `sasl.kerberos.keytab` and `sasl.kerberos.principal` must be written into the command directly.
+
 | Property | Description | Default value |
 | --- | --- | --- |
 | `topic` | Name of the topic to consume. | required |

docs/ingest-data/kafka.md

@@ -224,6 +224,8 @@ params:
     sasl.password: your_sasl_password
 ```
 
+For Kerberos (`sasl.mechanisms: GSSAPI`), `client_params` cannot set the `kinit` command. Either refresh tickets outside Quickwit, or set the `QW_KAFKA_KINIT_CMD` environment variable on every node that creates or runs Kafka sources, for example `QW_KAFKA_KINIT_CMD="kinit -k -t /path/to/quickwit.keytab quickwit@EXAMPLE.COM"`. See the [source configuration](../configuration/source-config.md) page for details.
+
 :::note
 
 If you get the following error:

docs/reference/rest-api.md

@@ -3,6 +3,12 @@ title: REST API
 sidebar_position: 10
 ---
 
+## Security
+
+:::warning
+Quickwit does not authenticate clients unless [mutual TLS](../configuration/node-config.md#tls-configuration) is enabled. Anyone who can reach the REST or gRPC API has full access to the cluster. Keep Quickwit on a trusted network or behind an authenticated proxy, and do not expose it directly to the public internet.
+:::
+
 ## API version
 
 All the API endpoints start with the `api/v1/` prefix. `v1` indicates that we are currently using version 1 of the API.