Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
None
-
None
Description
from https://github.com/mariadb-corporation/mariadb-connector-j/pull/232
ClientMessage.validateLocalFileName verifies that a server's "LOAD DATA LOCAL INFILE" request matches the file the client's query actually intended.
When file name is not in query, but provided as parameter, when the bound parameter can't be rendered to a literal, the method falls through to:
return true; // authorizes whatever file the server asked for |
That's fail-open: an unverifiable request is authorized, so the server can make the client read and send any local file.
Fix
Fail closed: return false when the parameter value can't be rendered to compare against the requested file, so an unverifiable request is refused. Legitimate LOAD DATA LOCAL INFILE ? binding a String filename still renders and passes the exact-match check.