From 59d7516005af28dce97c3f4251e2d7da2e31d203 Mon Sep 17 00:00:00 2001 From: Georgi Kodinov Date: Thu, 28 Apr 2011 12:22:41 +0300 Subject: Bug #11764517: 57359: POSSIBLE TO CIRCUMVENT SECURE_FILE_PRIV USING '..' ON WINDOWS Backport of the fix to 5.0 (to be null-merged to 5.1). Moved the test into the main test suite. Made mysql-test-run.pl to not use symlinks for sdtdata as the symlinks are now properly recognized by secure_file_priv. Made sure the paths in load_file(), LOAD DATA and SELECT .. INTO OUTFILE that are checked against secure_file_priv in a correct way similarly to 5.1 by the extended is_secure_file_path() backport before the comparison. Added an extensive test with all the variants of upper/lower case, slash/backslash and case sensitivity. Added few comments to the code. --- sql/sql_load.cc | 48 ++++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 24 deletions(-) (limited to 'sql/sql_load.cc') diff --git a/sql/sql_load.cc b/sql/sql_load.cc index 83af6d477db..9cead8c0ff1 100644 --- a/sql/sql_load.cc +++ b/sql/sql_load.cc @@ -287,36 +287,36 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list, { (void) fn_format(name, ex->file_name, mysql_real_data_home, "", MY_RELATIVE_PATH | MY_UNPACK_FILENAME); + } + + if (!is_secure_file_path(name)) + { + /* Read only allowed from within dir specified by secure_file_priv */ + my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0), "--secure-file-priv"); + DBUG_RETURN(TRUE); + } + #if !defined(__WIN__) && !defined(OS2) && ! defined(__NETWARE__) - MY_STAT stat_info; - if (!my_stat(name,&stat_info,MYF(MY_WME))) - DBUG_RETURN(TRUE); + MY_STAT stat_info; + if (!my_stat(name, &stat_info, MYF(MY_WME))) + DBUG_RETURN(TRUE); - // if we are not in slave thread, the file must be: - if (!thd->slave_thread && - !((stat_info.st_mode & S_IROTH) == S_IROTH && // readable by others + // if we are not in slave thread, the file must be: + if (!thd->slave_thread && + !((stat_info.st_mode & S_IROTH) == S_IROTH && // readable by others #ifndef __EMX__ - (stat_info.st_mode & S_IFLNK) != S_IFLNK && // and not a symlink + (stat_info.st_mode & S_IFLNK) != S_IFLNK && // and not a symlink #endif - ((stat_info.st_mode & S_IFREG) == S_IFREG || - (stat_info.st_mode & S_IFIFO) == S_IFIFO))) - { - my_error(ER_TEXTFILE_NOT_READABLE, MYF(0), name); - DBUG_RETURN(TRUE); - } - if ((stat_info.st_mode & S_IFIFO) == S_IFIFO) - is_fifo = 1; + ((stat_info.st_mode & S_IFREG) == S_IFREG || // and a regular file + (stat_info.st_mode & S_IFIFO) == S_IFIFO))) // or FIFO + { + my_error(ER_TEXTFILE_NOT_READABLE, MYF(0), name); + DBUG_RETURN(TRUE); + } + if ((stat_info.st_mode & S_IFIFO) == S_IFIFO) + is_fifo= 1; #endif - if (opt_secure_file_priv && - strncmp(opt_secure_file_priv, name, strlen(opt_secure_file_priv))) - { - /* Read only allowed from within dir specified by secure_file_priv */ - my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0), "--secure-file-priv"); - DBUG_RETURN(TRUE); - } - - } if ((file=my_open(name,O_RDONLY,MYF(MY_WME))) < 0) DBUG_RETURN(TRUE); } -- cgit v1.2.1 From 44135d4725dd3ad6d331c60b0bab1618472b8ae4 Mon Sep 17 00:00:00 2001 From: Kent Boortz Date: Thu, 30 Jun 2011 17:31:31 +0200 Subject: Updated/added copyright headers --- sql/sql_load.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'sql/sql_load.cc') diff --git a/sql/sql_load.cc b/sql/sql_load.cc index 83af6d477db..2ee94e68141 100644 --- a/sql/sql_load.cc +++ b/sql/sql_load.cc @@ -1,4 +1,5 @@ -/* Copyright (C) 2000-2006 MySQL AB +/* Copyright (c) 2000-2008 MySQL AB, 2009 Sun Microsystems, Inc. + Use is subject to license terms. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -11,7 +12,7 @@ You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ + Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ /* Copy data from a textfile to table */ -- cgit v1.2.1 From 47575bd0e05d49955a4d7f46409cc6316fed8d7c Mon Sep 17 00:00:00 2001 From: Michael Widenius Date: Wed, 30 Nov 2011 00:34:05 +0200 Subject: Fixed compiler warnings dbug/tests.c: Added __attribute__((unused)) to get rid of compiler warning server-tools/instance-manager/guardian.cc: Added __attribute__((unused)) to get rid of compiler warning sql/filesort.cc: Added __attribute__((unused)) to get rid of compiler warning sql/slave.cc: Added __attribute__((unused)) to get rid of compiler warning sql/sql_load.cc: Added __attribute__((unused)) to get rid of compiler warning sql/sql_table.cc: Added __attribute__((unused)) to get rid of compiler warning storage/maria/ma_blockrec.c: Added __attribute__((unused)) to get rid of compiler warning storage/maria/ma_check.c: Added missing cast storage/maria/ma_loghandler.c: Added __attribute__((unused)) to get rid of compiler warning storage/maria/ma_recovery.c: Added __attribute__((unused)) to get rid of compiler warning storage/pbxt/src/cache_xt.cc: Added __attribute__((unused)) to get rid of compiler warning storage/xtradb/fil/fil0fil.c: Removed not used variable storage/xtradb/handler/ha_innodb.cc: Use unused variable vio/viosocket.c: Remove usage of not used variable vio/viosslfactories.c: Added cast --- sql/sql_load.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sql/sql_load.cc') diff --git a/sql/sql_load.cc b/sql/sql_load.cc index 23105d84a9d..42e4489cb07 100644 --- a/sql/sql_load.cc +++ b/sql/sql_load.cc @@ -140,7 +140,7 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list, */ char *tdb= thd->db ? thd->db : db; // Result is never null ulong skip_lines= ex->skip_lines; - bool transactional_table; + bool transactional_table __attribute__((unused)); DBUG_ENTER("mysql_load"); /* -- cgit v1.2.1