Uploaded image for project: 'MariaDB Connector/J'
  1. MariaDB Connector/J
  2. CONJ-1329

LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered

    XMLWordPrintable

Details

    Description

      from https://github.com/mariadb-corporation/mariadb-connector-j/pull/232

      ClientMessage.validateLocalFileName verifies that a server's "LOAD DATA LOCAL INFILE" request matches the file the client's query actually intended.

      When file name is not in query, but provided as parameter, when the bound parameter can't be rendered to a literal, the method falls through to:

      return true;   // authorizes whatever file the server asked for
      

      That's fail-open: an unverifiable request is authorized, so the server can make the client read and send any local file.

      Fix
      Fail closed: return false when the parameter value can't be rendered to compare against the requested file, so an unverifiable request is refused. Legitimate LOAD DATA LOCAL INFILE ? binding a String filename still renders and passes the exact-match check.

      Attachments

        Activity

          People

            diego dupin Diego Dupin
            diego dupin Diego Dupin
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.