Runtime regression from the final lowercase pass: it renamed <clickhouse> opening tags to
<datastore> but the / exclusion (protecting /clickhouse paths) left </clickhouse> closing tags,
so embedded + shipped configs became <datastore>...</clickhouse> -> SAXParseException 'Tag
mismatch' at runtime (compile was fine; XML is data). Renamed all <clickhouse/</clickhouse XML
tags -> datastore (101 closes across configs, embedded strings, keeper configs). Path strings
(/var/lib/clickhouse) have no angle bracket and are untouched. Build compiled; this fixes runtime
config parsing.
The prior sweep kept " in the exclusion set to guard the SQL keyword "clickhouse", which
over-protected ALL quoted display strings ("clickhouse " << app in --help, install-tool defaults
like DEFAULT_..._SERVER_USER="clickhouse"/getpwnam("clickhouse")/binary-name fallbacks). Redid the
pass dropping " from the exclusion while still skipping the 4 SQL dict-source keyword lines, URLs,
and /clickhouse + .clickhouse.hash paths (kept . / - in the boundary). Renamed the 2 fuzzer files
clickhouse_fuzzer.cpp / clickhouse-template.g (not built; completeness).
Remaining lowercase clickhouse (526) = URLs, SQL SOURCE(CLICKHOUSE) keyword, and ZK/fs path
conventions (/var/lib/clickhouse, /clickhouse/tables) + internal .clickhouse.hash ELF section —
all protocol/external/convention, intentionally kept.
The correct, safe broad rebrand: renames "ClickHouse" only as a whole word (boundary on
BOTH sides), so it rewrites display strings/messages/comments but leaves every compound
C++ symbol intact — `ClickHouseDictionarySource`, `getInfoIfClickHouseDictionarySource`,
`mainEntryClickHouseServer`, `ClickHouseRevision`, `ClickHouse_SOURCE_DIR` are untouched
(an earlier one-sided heuristic mangled suffix symbols like `manageClickHouse`; reverted).
1677 occurrences across 482 files. Compile-safe (string/comment content; symbols preserved).
Still NOT renamed (would be a build-coupled symbol rename, needs build-host iteration): the
199 compound identifiers containing ClickHouse, the `DB::` namespace, the `clickhouse_*`
CMake targets/macros, the lowercase `clickhouse` SQL dictionary-source keyword. Needs build
verification.
Move the `shellQuote` helper out of `clickhouse install` into
`Common/shellQuote.h` so it can be reused. Apply it to two more
shell-command construction sites:
- `formatWithSudo` on FreeBSD wraps the inner command in `su -c '...'`.
All current callers pass static literals, but an embedded single
quote would break the wrapper. Quote the command via `shellQuote`
so future callers can pass arbitrary strings safely.
- `clickhouse git-import` interpolates a commit hash parsed from
`git log --pretty=%H` into `git show ... {hash}` and runs it via
`/bin/sh -c`. `%H` is hex-only today, but a hand-crafted hash list
or a future format change should not be able to inject shell
syntax through the input.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
`changeOwnership`, `createGroup`, `createUser`, and the `setcap`
invocation in `clickhouse install` interpolated CLI-controlled values
(`--user`, `--group`, `--log-path`, `--data-path`, `--pid-path`,
`--config-path`, `--binary-path`, `--prefix`) directly into shell
command strings passed to `/bin/sh -c`. The `shellQuote` helper
already used by the sudo invocation in the same file was not applied
elsewhere. Wrap every interpolated value in `shellQuote` so shell
metacharacters in CLI arguments cannot be interpreted by the shell.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
`--group` for `clickhouse start` / `restart` had a default value of
`clickhouse` purely for documentation. The launcher applied it
unconditionally on the `sudo` path, so
clickhouse start --user alice
was silently expanded to `sudo --preserve-env -u alice -g clickhouse ...`.
That fails when `alice` is not a member of the `clickhouse` group,
which is a behavior regression for users who only ever passed `--user`.
Clear `group` in `mainEntryClickHouseStart` and `mainEntryClickHouseRestart`
when `options["group"].defaulted()` is true, so the default is shown in
`--help` but not applied to the spawned server. The `no-sudo` path then
runs `clickhouse su user:`, where `setUserAndGroup` falls back to the
user's primary group.
The `--group` option for `clickhouse start` / `restart` was only honored on
the `--no-sudo` branch (`clickhouse su user:group ...`). On the default path
the command was built as `sudo --preserve-env -u <user> ...`, with no `-g`,
so the group was silently ignored.
Pass `-g <group>` to `sudo` (shell-quoted) when `group` is non-empty so the
advertised CLI option takes effect on both code paths.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
The previous attempt to harden the `--no-sudo` and `sudo` paths in
`clickhouse start` wrapped interpolated `user`, `group`, and binary
paths in single quotes only. This is insufficient: a value containing
a single quote (e.g. `bob';rm -rf /;'`) still breaks out because
single quotes do not nest.
Introduce a POSIX-compliant `shellQuote` helper in `Install.cpp` and
apply it to every user-controlled field interpolated into the `su` /
`sudo` command strings: `executable`, `config`, `pid_file`,
`binary`, `user`, and `group`. The helper replaces any `'` inside
the value with `'\''` before re-wrapping, which is the standard POSIX
idiom and safe against arbitrary byte content.
While CLI arguments to `clickhouse start` are not typically attacker
controlled (the caller already runs the binary), defense-in-depth is
worthwhile: these commands go through `/bin/sh -c` via
`ShellCommand::execute`, and unquoted interpolation has been flagged
as a hazard in code review.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- `printHelp` now takes an `std::ostream &` parameter: explicit `help`
writes to stdout, while `printHelpOnError` (mistyped commands) writes
to stderr, preserving the error-output contract for scripts.
- Shell-quote binary path and user:group in the `--no-sudo` branch of
`clickhouse start` to prevent command injection via crafted CLI args.
- Make the keeper availability check in the help return codes test more
precise: match `clickhouse keeper [args]` exactly instead of bare
`keeper` which could false-match `keeper-converter` etc.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
The original PR #96025 was reverted (#98038) because:
1. The install completion message showed wrong relative paths like
`var/run/clickhouse-server` instead of absolute `/var/run/clickhouse-server`.
This happened because `options.contains()` returns true even for options
with default values in boost::program_options. Fix: use `defaulted()`
to only include options that the user explicitly specified.
2. The install completion message did not suggest `sudo` for the
start/restart command. This happened because `getuid() != 0` is false
when install runs as root via sudo, but the user returns to their
unprivileged shell afterward. Fix: always suggest sudo (matching the
original behavior).
Also address review feedback:
- Fix `clickhouse-client` help: remove misleading "initial table definition"
(a `clickhouse-local` concept) from usage line
- Fix typo: "as command line tool" → "as a command line tool"
- Fix `clickhouse-local` help grammar: "After you can execute" → "After that,
you can execute", "in first query" → "in the first query"
- Make keeper `--help` test robust for builds without `ENABLE_CLICKHOUSE_KEEPER`
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Add `static` to file-local functions and forward declarations
for cross-TU functions to satisfy `-Wmissing-prototypes`.
This ensures all functions have visible prototypes before their
definitions, improving code quality and catching accidental
linkage issues.
Reference: https://github.com/ClickHouse/ClickHouse/issues/76944
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
- Remove "CMake doesn't recognize changes in #embed-ed files" comments
from all files, since this PR now tracks those dependencies.
- Add conditional `OBJECT_DEPENDS` for `FrequencyHolder.cpp` NLP blobs
(guarded by `if (EXISTS ...)` for when the submodule is not checked out).
- Add `OBJECT_DEPENDS` for `attachInformationSchemaTables.cpp` which was
also missing dependency tracking for its embedded SQL files.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
The C++ `#embed` directive includes file contents at compile time,
but the build system does not automatically track these as
dependencies. When an embedded file (e.g., `play.html`) changes,
the .cpp file that embeds it is not recompiled.
Fix this by adding `OBJECT_DEPENDS` properties to all source files
that use `#embed`, covering: HTML pages, JavaScript files, XML
configs, and NLP data files.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Extract `ErrnoException` into `Common/ErrnoException.h` to reduce the
include footprint of `Exception.h`. This removes `<base/errnoToString.h>`
and `<cerrno>` from `Exception.h`, which is included by ~95% of all
translation units.
All files referencing `ErrnoException` now include the new header
directly. Files that used `errnoToString` without `ErrnoException`
got an explicit `<base/errnoToString.h>` include.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
- Add --group option to start and restart commands
- Use clickhouse su instead of sudo when --no-sudo is set
- Pass --prefix, --pid-path, --config-path, --binary-path, --user, --group
from install to the suggested start/restart command
Co-Authored-By: Claude Opus 4.5 <[email protected]>
This commit improves the help output for all ClickHouse applications:
- Add `clickhouse help` command that lists all available subcommands
- Return exit code 0 for all help messages (previously some returned 1)
- Output help messages to stdout instead of stderr
- Use "clickhouse <cmd>" format instead of argv[0] in help messages
- Add dynamic `app_name` detection for `clickhouse client` and `clickhouse local`
to show correct invocation name based on how the binary was called
- Add `--no-sudo` option for `clickhouse start` and `clickhouse restart`
for environments without sudo (e.g., Docker containers)
- Add detailed help headers and footers for client and local with usage examples
Closes#58244
Co-Authored-By: Claude Opus 4.5 <[email protected]>
Previously it was only shipped as part of the client package, now it
will be bundled into the binary, and will be available as:
- clickhouse chdig
- clickhouse-chdig
- chdig
Note, that since now chdig will not be linked, we can remove all
quirks for this, that has been done in #79666
zooqueen