Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-5338

XML parser accepts malformed data

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 5.1.67, 5.3.12, 5.5.34, 10.0.6
    • None
    • None
    • None

    Description

      The XML parser does not return errors when a closing tag does not
      patch its opening tag.
      The bug can be repeated with the ExtractValue() function:

      mysql> select extractvalue('<a><b>xxx</c></a>','/a/b');
      		 
      +------------------------------------------+
      		 
      | extractvalue('<a><b>xxx</c></a>','/a/b') |
      		 
      +------------------------------------------+
      		 
      | xxx                                      |
      		 
      +------------------------------------------+
      		 
      1 row in set (0.00 sec)

      Notice <b>...</c>.

      The bug can also be repeated by using a malformed
      the character set and collation definition file Index.xml.

      <charsets>   
        <charset name="utf8">
      		 
          <collation name="utf8_5624_5_bad" id="369" shift-after-method="expand">
      		 
            <rules>
      		 
            <reset>a-a4</reset><p>xxx04</a>
      		 
            <reset>a-aa5</reset><p>xxx05</a>
      		 
            <reset>a-aaa6</reset><p>xxx06</a>
      		 
            <reset>a-aaaa7</reset><p>xxx07</a>
      		 
            <reset>a-aaaaa8</reset><p>xxx08</a>
      		 
            <reset>a-aaaaaa9</reset><p>xxx09</a>
      		 
            <reset>a-aaaaaa10</reset><p>xxx10</a>
      		 
            </rules>
      		 
          </collation>
      		 
          <collation name="utf8_maxuserid_ci" id="2047" version="4.0.0">
      		 
            <rules>   
              <reset>a</reset>
      		 
              <s>b</s>
      		 
            </rules>
      		 
          </collation>
      		 
        </charset>
      		 
      </charsets>

      Notice <p>..</a>. The file is read without any errors,
      and the collation utf8_maxuserid_ci (which is following the
      one with the bad definition) is available in the server.

      Attachments

        Activity

          Ascending order - Click to sort in descending order
          bar Alexander Barkov created issue -
          bar Alexander Barkov made changes -
          Field Original Value New Value
          Description The XML parser does not return errors when a closing tag does not
          patch its opening tag.
          The bug can be repeated both with the ExtractValue() function:

          {code}
          mysql> select extractvalue('<a><b>xxx</c></a>','/a/b');
          +------------------------------------------+
          | extractvalue('<a><b>xxx</c></a>','/a/b') |
          +------------------------------------------+
          | xxx |
          +------------------------------------------+
          1 row in set (0.00 sec)
          {code}
          Notice <b>...</c>.

          The bug can also be repeated by using a malformed
          the character set and collation definition file Index.xml.
          {code}
          <charsets>
            <charset name="utf8">
              <collation name="utf8_5624_5_bad" id="369" shift-after-method="expand">
                <rules>
                <reset>a-a4</reset><p>xxx04</a>
                <reset>a-aa5</reset><p>xxx05</a>
                <reset>a-aaa6</reset><p>xxx06</a>
                <reset>a-aaaa7</reset><p>xxx07</a>
                <reset>a-aaaaa8</reset><p>xxx08</a>
                <reset>a-aaaaaa9</reset><p>xxx09</a>
                <reset>a-aaaaaa10</reset><p>xxx10</a>
                </rules>
              </collation>
              <collation name="utf8_maxuserid_ci" id="2047" version="4.0.0">
                <rules>
                  <reset>a</reset>
                  <s>b</s>
                </rules>
              </collation>
            </charset>
          </charsets>
          {code}
          Notice <p>..</a>. The file is read without any errors,
          and the collation utf8_maxuserid_ci (which is following the
          one with the bad definition) is available in the server.

          		 The XML parser does not return errors when a closing tag does not
          patch its opening tag.
          The bug can be repeated with the ExtractValue() function:

          {code}
          mysql> select extractvalue('<a><b>xxx</c></a>','/a/b');
          +------------------------------------------+
          | extractvalue('<a><b>xxx</c></a>','/a/b') |
          +------------------------------------------+
          | xxx |
          +------------------------------------------+
          1 row in set (0.00 sec)
          {code}
          Notice <b>...</c>.

          The bug can also be repeated by using a malformed
          the character set and collation definition file Index.xml.
          {code}
          <charsets>
            <charset name="utf8">
              <collation name="utf8_5624_5_bad" id="369" shift-after-method="expand">
                <rules>
                <reset>a-a4</reset><p>xxx04</a>
                <reset>a-aa5</reset><p>xxx05</a>
                <reset>a-aaa6</reset><p>xxx06</a>
                <reset>a-aaaa7</reset><p>xxx07</a>
                <reset>a-aaaaa8</reset><p>xxx08</a>
                <reset>a-aaaaaa9</reset><p>xxx09</a>
                <reset>a-aaaaaa10</reset><p>xxx10</a>
                </rules>
              </collation>
              <collation name="utf8_maxuserid_ci" id="2047" version="4.0.0">
                <rules>
                  <reset>a</reset>
                  <s>b</s>
                </rules>
              </collation>
            </charset>
          </charsets>
          {code}
          Notice <p>..</a>. The file is read without any errors,
          and the collation utf8_maxuserid_ci (which is following the
          one with the bad definition) is available in the server.
          bar Alexander Barkov added a comment -

          Pushed into 5.3 and 5.5

          bar Alexander Barkov added a comment - Pushed into 5.3 and 5.5
          bar Alexander Barkov made changes -
          Resolution Fixed [ 1 ]
          Status Open [ 1 ] Closed [ 6 ]
          serg Sergei Golubchik made changes -
          Workflow defaullt [ 30208 ] MariaDB v2 [ 42407 ]
          ratzpo Rasmus Johansson (Inactive) made changes -
          Workflow MariaDB v2 [ 42407 ] MariaDB v3 [ 62113 ]
          serg Sergei Golubchik made changes -
          Workflow MariaDB v3 [ 62113 ] MariaDB v4 [ 147258 ]

          People

            bar Alexander Barkov
            bar Alexander Barkov
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.