Commit c4ae01e6 authored by unknown's avatar unknown
Browse files

Bug#18628 mysql-test-run: security problem(part1) 

 - Implement --secure-file-priv=<dir> option that limits
  "load_file", "LOAD DATA" and "SELECT .. INTO OUTFILE" to work 
  with files in specified dir.
 - Use above option for mysqld in mysql-test-run.pl 


mysql-test/mysql-test-run.pl:
  Add usage of --secure-file-priv=vardir when starting mysqld
mysql-test/r/loaddata.result:
  Update test result after adding test to check that secure-file-priv
  works for "load data" and "load_file"
mysql-test/r/outfile.result:
  Update result
mysql-test/r/query_cache.result:
  Can't load from outside of vardir anymore
mysql-test/r/type_blob.result:
  Can't load from outside of vardir anymore
mysql-test/t/loaddata.test:
  Update test result after adding test to check that secure-file-priv 
  works for "load data" and "load_file"
mysql-test/t/outfile.test:
  Update test result after adding test to check that secure-file-priv
  works for "SELECT .. INTO OUTFILE"
mysql-test/t/query_cache.test:
  Can't load from outside of vardir anymore
mysql-test/t/type_blob.test:
  Can't load from outside of vardir anymore
sql/item_strfunc.cc:
  Check that the path "load_file" uses for the file is within 
  what's specified with --secure-file-priv
sql/mysql_priv.h:
  Add secure_file_priv
sql/mysqld.cc:
  Add "--secure_file_priv"
sql/set_var.cc:
  Add variable "secure_file_priv" to "show variables"
sql/sql_class.cc:
  Check that the path "load_file" uses for the file is within 
  what's specified with --secure-file-priv
sql/sql_class.h:
  Fix spelling error
sql/sql_load.cc:
  Check that the path "load_file" uses for the file is within 
  what's specified with --secure-file-priv
sql/share/errmsg.txt:
  Fix swedish error message for ER_OPTION_PREVENTS_STATMENT wich was hardcoded
  to --skip-grant-tables
parent e04d0010

mysql-test/mysql-test-run.pl

+6 −0
Original line number Diff line number Diff line
@@ -3581,6 +3581,12 @@ sub mysqld_arguments ($$$$$) { 
  mtr_add_arg($args, "%s--basedir=%s", $prefix, $path_my_basedir);

  mtr_add_arg($args, "%s--character-sets-dir=%s", $prefix, $path_charsetsdir);



  if ( $mysql_version_id >= 50036)

  {

    # Prevent the started mysqld to access files outside of vardir

    mtr_add_arg($args, "%s--secure-file-priv=%s", $prefix, $opt_vardir);

  }



  if ( $mysql_version_id >= 50000 )

  {

    mtr_add_arg($args, "%s--log-bin-trust-function-creators", $prefix);

mysql-test/r/loaddata.result

+16 −0
Original line number Diff line number Diff line
@@ -139,4 +139,20 @@ select * from t1; 
a	b	c

10	NULL	Ten

15	NULL	Fifteen

show variables like "secure_file_pri%";

Variable_name	Value

secure_file_priv	MYSQLTEST_VARDIR/

select @@secure_file_priv;

@@secure_file_priv

MYSQLTEST_VARDIR/

set @@secure_file_priv= 0;

ERROR HY000: Variable 'secure_file_priv' is a read only variable

truncate table t1;

load data infile 'MYSQL_TEST_DIR/Makefile' into table t1;

ERROR HY000: The MySQL server is running with the --secure-file-priv option so it cannot execute this statement

select * from t1;

a	b	c

select load_file("MYSQL_TEST_DIR/Makefile");

load_file("MYSQL_TEST_DIR/Makefile")

NULL

drop table t1, t2;

mysql-test/r/outfile.result

+223 B (1.35 KiB)

File changed.

No diff preview for this file type.

View original file
View changed file

mysql-test/r/query_cache.result

+1 −1
Original line number Diff line number Diff line
@@ -622,7 +622,7 @@ word 
show status like "Qcache_queries_in_cache";

Variable_name	Value

Qcache_queries_in_cache	1

load data infile 'TEST_DIR/std_data/words.dat' into table t1;

load data infile 'MYSQLTEST_VARDIR/std_data_ln/words.dat' into table t1;

show status like "Qcache_queries_in_cache";

Variable_name	Value

Qcache_queries_in_cache	0

mysql-test/r/type_blob.result

+12 −12
Original line number Diff line number Diff line
@@ -507,25 +507,25 @@ Warnings: 
Warning	1101	BLOB/TEXT column 'imagem' can't have a default value

insert into t1 (id) values (1);

select

charset(load_file('../../std_data/words.dat')),

collation(load_file('../../std_data/words.dat')),

coercibility(load_file('../../std_data/words.dat'));

charset(load_file('../../std_data/words.dat'))	collation(load_file('../../std_data/words.dat'))	coercibility(load_file('../../std_data/words.dat'))

charset(load_file('../std_data_ln/words.dat')),

collation(load_file('../std_data_ln/words.dat')),

coercibility(load_file('../std_data_ln/words.dat'));

charset(load_file('../std_data_ln/words.dat'))	collation(load_file('../std_data_ln/words.dat'))	coercibility(load_file('../std_data_ln/words.dat'))

binary	binary	4

explain extended select

charset(load_file('../../std_data/words.dat')),

collation(load_file('../../std_data/words.dat')),

coercibility(load_file('../../std_data/words.dat'));

charset(load_file('MYSQLTEST_VARDIR/std_data_ln/words.dat')),

collation(load_file('MYSQLTEST_VARDIR/std_data_ln/words.dat')),

coercibility(load_file('MYSQLTEST_VARDIR/std_data_ln/words.dat'));

id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra

1	SIMPLE	NULL	NULL	NULL	NULL	NULL	NULL	NULL	No tables used

Warnings:

Note	1003	select charset(load_file(_latin1'../../std_data/words.dat')) AS `charset(load_file('../../std_data/words.dat'))`,collation(load_file(_latin1'../../std_data/words.dat')) AS `collation(load_file('../../std_data/words.dat'))`,coercibility(load_file(_latin1'../../std_data/words.dat')) AS `coercibility(load_file('../../std_data/words.dat'))`

update t1 set imagem=load_file('../../std_data/words.dat') where id=1;

Note	1003	select charset(load_file(_latin1'MYSQLTEST_VARDIR/std_data_ln/words.dat')) AS `charset(load_file('MYSQLTEST_VARDIR/std_data_ln/words.dat'))`,collation(load_file(_latin1'MYSQLTEST_VARDIR/std_data_ln/words.dat')) AS `collation(load_file('MYSQLTEST_VARDIR/std_data_ln/words.dat'))`,coercibility(load_file(_latin1'MYSQLTEST_VARDIR/std_data_ln/words.dat')) AS `coercibility(load_file('MYSQLTEST_VARDIR/std_data_ln/words.dat'))`

update t1 set imagem=load_file('MYSQLTEST_VARDIR/std_data_ln/words.dat') where id=1;

select if(imagem is null, "ERROR", "OK"),length(imagem) from t1 where id = 1;

if(imagem is null, "ERROR", "OK")	length(imagem)

OK	581

drop table t1;

create table t1 select load_file('../../std_data/words.dat') l;

create table t1 select load_file('MYSQLTEST_VARDIR/std_data_ln/words.dat') l;

show full fields from t1;

Field	Type	Collation	Null	Key	Default	Extra	Privileges	Comment

l	longblob	NULL	YES		NULL		#