diff options
| author | Shishir Jaiswal <shishir.j.jaiswal@oracle.com> | 2017-04-17 12:04:14 +0530 |
|---|---|---|
| committer | Shishir Jaiswal <shishir.j.jaiswal@oracle.com> | 2017-04-17 12:04:14 +0530 |
| commit | 788fb5bf678e2854fd2936cf6ac8d8f46f7c90c4 (patch) | |
| tree | 77e8bd6f5361358d1bd184b9ab2350c8fef8b35d /mysql-test | |
| parent | 2cc44da122fa34a551407f214acecaa6df921535 (diff) | |
| download | mariadb-git-788fb5bf678e2854fd2936cf6ac8d8f46f7c90c4.tar.gz | |
Bug#25043674 - MYSQLACCESS SCRIPT LOADS AND EXECUTES CODE
FROM THE CURRENT DIRECTORY
DESCRIPTION
===========
When 'mysqlaccess' tool is run, it reads (and executes) the
content of its configuration file 'mysqlaccess.conf' from
the current directory. This is not a recommended behaviour
as someone with ill intentions can insert malicious
instructions into this file which could be executed
whenever this tool is run.
ANALYSIS
========
The configuration file is presently looked for, in the
following folders (in given order):
1. Current directory
2. SYSCONFDIR //This gets expanded
3. /etc/
Owing to the reasons mentioned above, we should not permit
the file to be in the current directory. Since the other
two folders are assumed to be accessible only to authorized
people, the config file is safe to be read from there.
FIX
===
Modified the script so that it looks for the config file
now in the following two folders (in the given order):
1. SYSCONFDIR
2. /etc/
If it's absent from above locations but present in current
directory, an error is thrown asking the user to move the
file to one of the above locations and retry.
NOTE
====
The location paths and their precedence are not documented
for this tool. It needs to be noted as part of the
associated documentation.
Diffstat (limited to 'mysql-test')
| -rwxr-xr-x | mysql-test/mysql-test-run.pl | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl index 86d37a56835..2ca5c83e3f4 100755 --- a/mysql-test/mysql-test-run.pl +++ b/mysql-test/mysql-test-run.pl @@ -1,7 +1,7 @@ #!/usr/bin/perl # -*- cperl -*- -# Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved. +# Copyright (c) 2004, 2017, Oracle and/or its affiliates. All rights reserved. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -2455,6 +2455,17 @@ sub environment_setup { "$basedir/myisam/myisampack")); # ---------------------------------------------------- + # mysqlaccess + # ---------------------------------------------------- + my $mysqlaccess= + mtr_pl_maybe_exists("$bindir/scripts/mysqlaccess") || + mtr_pl_maybe_exists("$path_client_bindir/mysqlaccess"); + if ($mysqlaccess) + { + $ENV{'MYSQLACCESS'}= $mysqlaccess; + } + + # ---------------------------------------------------- # mysqlhotcopy # ---------------------------------------------------- my $mysqlhotcopy= |