LOAD DATA LOCAL INFILE file check can be satisfied by text inside quoted identifiers, allowing a malicious server to read client files

When the server answers a command with a LOCAL INFILE request (0xFB packet), the connector verifies that the requested file corresponds to a LOAD DATA LOCAL INFILE '<file>' in the command it sent. That check was a regex search over the whole SQL text, so it also matched when the text appeared inside a backtick-quoted identifier, a string literal or a comment.

Several driver paths re-use identifiers returned by the server in a following query: DatabaseMetaData.getImportedKeys() / getExportedKeys() (database and table names from SHOW DATABASES, SHOW TABLES and SHOW CREATE TABLE output) and updatable result sets (schema and table names from column definitions). A malicious server, or an on-path attacker when TLS is not used, can return an identifier such as LOAD DATA LOCAL INFILE '/etc/passwd', then answer the resulting SHOW CREATE TABLE \...`query with a LOCAL INFILE request for that file.
The check passes and the connector sends the file content to the server. This requiresallowLocalInfile` (enabled by default). It bypasses the hardening done in CONJ-1318, CONJ-1322, CONJ-1323 and CONJ-1329.