Commit 1f9b1e19 authored by monty@tik.mysql.fi's avatar monty@tik.mysql.fi
Browse files

Made LOAD DATA LOCAL INFILE more secure

parent 1efcc3e3

BitKeeper/etc/logging_ok

+1 −0
Original line number Diff line number Diff line
@@ -9,3 +9,4 @@ miguel@light.local 
monty@donna.mysql.fi

monty@bitch.mysql.fi

mwagner@cash.mwagner.org

monty@tik.mysql.fi

Docs/manual.texi

+6 −0
Original line number Diff line number Diff line
@@ -46892,6 +46892,12 @@ not yet 100% confident in this code. 
@item

Fixed unlikely caching bug when doing a join without keys. In this case

the last used field for a table always returned @code{NULL}.

@item

Added options to make @code{LOAD DATA LOCAL INFILE} more secure.

@item

MySQL binary release 3.23.48 for Linux contained a new glibc library, which

has serious problems under high load and RedHat 7.2.  The 3.23.49 binary

release doesn't have this problem.

@end itemize















@node News-3.23.48, News-3.23.47, News-3.23.49, News-3.23.x

























acconfig.h



+3
−0






























Original line number
Diff line number
Diff line








@@ -21,6 +21,9 @@













/* Version of .frm files */















#undef DOT_FRM_VERSION





























/* If LOAD DATA LOCAL INFILE should be enabled by default */













#undef ENABLED_LOCAL_INFILE





























/* READLINE: */















#undef FIONREAD_IN_SYS_IOCTL

















































client/client_priv.h



+1
−1






























Original line number
Diff line number
Diff line








@@ -30,4 +30,4 @@ enum options { OPT_CHARSETS_DIR=256, OPT_DEFAULT_CHARSET,













	       OPT_LOW_PRIORITY, OPT_AUTO_REPAIR, OPT_COMPRESS,















	       OPT_DROP, OPT_LOCKS, OPT_KEYWORDS, OPT_DELAYED, OPT_OPTIMIZE,















	       OPT_FTB, OPT_LTB, OPT_ENC, OPT_O_ENC, OPT_ESC, OPT_TABLES,













	       OPT_MASTER_DATA, OPT_AUTOCOMMIT};












	       OPT_MASTER_DATA, OPT_AUTOCOMMIT, OPT_LOCAL_INFILE};
























client/mysql.cc



+10
−3






























Original line number
Diff line number
Diff line








@@ -34,7 +34,7 @@













#include "my_readline.h"















#include <signal.h>





























const char *VER="11.15";













const char *VER="11.16";































/* Don't try to make a nice table if the data is too big */















#define MAX_COLUMN_LENGTH	     1024










@@ -113,10 +113,10 @@ static MYSQL mysql;			/* The connection */













static bool info_flag=0,ignore_errors=0,wait_flag=0,quick=0,















	    connected=0,opt_raw_data=0,unbuffered=0,output_tables=0,















	    no_rehash=0,skip_updates=0,safe_updates=0,one_database=0,













	    opt_compress=0,













	    opt_compress=0, using_opt_local_infile=0,















	    vertical=0,skip_line_numbers=0,skip_column_names=0,opt_html=0,















	    opt_nopager=1, opt_outfile=0, no_named_cmds=1;













static uint verbose=0,opt_silent=0,opt_mysql_port=0;













static uint verbose=0,opt_silent=0,opt_mysql_port=0, opt_local_infile=0;















static my_string opt_mysql_unix_port=0;















static int connect_flag=CLIENT_INTERACTIVE;















static char *current_host,*current_db,*current_user=0,*opt_password=0,










@@ -394,6 +394,7 @@ static struct option long_options[] =













  {"html",	    no_argument,	   0, 'H'},















  {"host",	    required_argument,	   0, 'h'},















  {"ignore-spaces", no_argument,	   0, 'i'},













  {"local-infile",  optional_argument,	   0, OPT_LOCAL_INFILE},















  {"no-auto-rehash",no_argument,	   0, 'A'},















  {"no-named-commands", no_argument,       0, 'g'},















  {"no-tee",        no_argument,           0, OPT_NOTEE},










@@ -693,6 +694,10 @@ static int get_options(int argc, char **argv)













    case 'C':















      opt_compress=1;















      break;













    case OPT_LOCAL_INFILE:













      using_opt_local_infile=1;













      opt_local_infile= test(!optarg || atoi(optarg)>0);













      break;















    case 'L':















      skip_line_numbers=1;















      break;










@@ -2105,6 +2110,8 @@ sql_real_connect(char *host,char *database,char *user,char *password,













  }















  if (opt_compress)















    mysql_options(&mysql,MYSQL_OPT_COMPRESS,NullS);













  if (using_opt_local_infile)













    mysql_options(&mysql,MYSQL_OPT_LOCAL_INFILE, (char*) &opt_local_infile);















#ifdef HAVE_OPENSSL















  if (opt_use_ssl)















    mysql_ssl_set(&mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca,