Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

*: don't use DSN to avoid some security problems #38342

Merged
merged 6 commits into from
Oct 19, 2022
Merged

*: don't use DSN to avoid some security problems #38342

merged 6 commits into from
Oct 19, 2022

Conversation

lance6716
Copy link
Contributor

@lance6716 lance6716 commented Oct 9, 2022 •
edited
Loading

Signed-off-by: lance6716 lance6716@gmail.com

What problem does this PR solve?

Issue Number: close #38541

--- copied from #37489 ---

Problem Summary:

TiDB uses Go MySQL Driver for connecting to MySQL servers. The Data Source Name (DSN) strings for describing database connections is not neutralized so they can escape and add new parameters to use as data source name.

What is changed and how it works?

Check List

Tests

  • Unit test
  • Integration test
  • Manual test (add detailed scripts or steps below)
  • No code

Side effects

  • Performance regression: Consumes more CPU
  • Performance regression: Consumes more Memory
  • Breaking backward compatibility

Documentation

  • Affects user behaviors
  • Contains syntax changes
  • Contains variable changes
  • Contains experimental features
  • Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

Fix the issue of arbitrary file read via data source name injection (CVE-2022-3023).

@lance6716
*: don't use DSN to avoid some security problems
85844cd 
Signed-off-by: lance6716 <lance6716@gmail.com>
@ti-chi-bot
Copy link
Member

ti-chi-bot commented Oct 9, 2022 •
edited
Loading

[REVIEW NOTIFICATION]

This pull request has been approved by:

  • kennytm
  • lichunzhu

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

@ti-chi-bot ti-chi-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 9, 2022
@lance6716
fix CI
4b68a4d 
Signed-off-by: lance6716 <lance6716@gmail.com>
@lance6716
fix CI
e72b168 
Signed-off-by: lance6716 <lance6716@gmail.com>
@ti-chi-bot ti-chi-bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 9, 2022
@lance6716
Copy link
Contributor Author

@dwisiswant0 ptal. I didn't change some binaries that are only used in tests.

@lance6716
fix UT
f1fb540 
Signed-off-by: lance6716 <lance6716@gmail.com>
@lance6716
Copy link
Contributor Author

/cc @kennytm

not sure if you have interest in this problem

@lance6716
Copy link
Contributor Author

PTAL @dwisiswant0

@dwisiswant0
Copy link

LGTM, @lance6716. I can confirm it can't be reproduced anymore.

[mysql] 2022/10/12 15:43:04 packets.go:37: unexpected EOF
[2022/10/12 15:43:04.800 +07:00] [FATAL] [main.go:85] ["local file '/etc/passwd' is not registered"] [stack="main.main\n\t/tmp/tidb/cmd/importer/main.go:85\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:250"]

@ti-chi-bot ti-chi-bot added the status/LGT1 Indicates that a PR has LGTM 1. label Oct 12, 2022
@3pointer 3pointer added affects-5.4 This bug affects 5.4.x versions. affects-6.1 labels Oct 12, 2022
@lance6716
Copy link
Contributor Author

/cc @lichunzhu

ptal

lichunzhu
lichunzhu approved these changes Oct 18, 2022
View reviewed changes
Copy link
Contributor

@lichunzhu lichunzhu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ti-chi-bot ti-chi-bot added status/LGT2 Indicates that a PR has LGTM 2. and removed status/LGT1 Indicates that a PR has LGTM 1. labels Oct 18, 2022
@lance6716
Copy link
Contributor Author

/merge

@ti-chi-bot
Copy link
Member

This pull request has been accepted and is ready to merge.

Commit hash: f1fb540

@ti-chi-bot ti-chi-bot added the status/can-merge Indicates a PR has been approved by a committer. label Oct 18, 2022
niubell
niubell approved these changes Oct 18, 2022
View reviewed changes
Copy link
Contributor

@niubell niubell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@lance6716
Copy link
Contributor Author

/run-mysql-test
/run-check_dev_2

@ti-chi-bot ti-chi-bot merged commit d037637 into pingcap:master Oct 19, 2022
@sre-bot
Copy link
Contributor

sre-bot commented Oct 19, 2022

TiDB MergeCI notify

🔴 Bad News! [2] CI still failing after this pr merged.
These failed integration tests don't seem to be introduced by the current PR.

CI Name Result Duration Compare with Parent commit
idc-jenkins-ci-tidb/integration-ddl-test 🔴 failed 1, success 5, total 6 28 min Existing failure
idc-jenkins-ci-tidb/integration-common-test 🔴 failed 2, success 15, total 17 10 min Existing failure
idc-jenkins-ci/integration-cdc-test 🟢 all 38 tests passed 22 min Existing passed
idc-jenkins-ci-tidb/common-test 🟢 all 11 tests passed 8 min 44 sec Existing passed
idc-jenkins-ci-tidb/tics-test 🟢 all 1 tests passed 5 min 41 sec Existing passed
idc-jenkins-ci-tidb/sqllogic-test-2 🟢 all 28 tests passed 4 min 35 sec Existing passed
idc-jenkins-ci-tidb/sqllogic-test-1 🟢 all 26 tests passed 4 min 20 sec Existing passed
idc-jenkins-ci-tidb/mybatis-test 🟢 all 1 tests passed 3 min 0 sec Existing passed
idc-jenkins-ci-tidb/integration-compatibility-test 🟢 all 1 tests passed 2 min 34 sec Existing passed
idc-jenkins-ci-tidb/plugin-test 🟢 build success, plugin test success 4min Existing passed

@lance6716
Copy link
Contributor Author

/run-cherry-picker

@lance6716 lance6716 added needs-cherry-pick-release-5.4 Should cherry pick this PR to release-5.4 branch. needs-cherry-pick-release-6.1 Should cherry pick this PR to release-6.1 branch. labels Oct 19, 2022
@lance6716
Copy link
Contributor Author

/run-cherry-picker

@ti-chi-bot ti-chi-bot mentioned this pull request Oct 19, 2022
Open
12 tasks
@ti-chi-bot
Copy link
Member

In response to a cherrypick label: new pull request created: #38542.

ti-chi-bot pushed a commit to ti-chi-bot/tidb that referenced this pull request Oct 19, 2022
@lance6716 @ti-chi-bot
This is an automated cherry-pick of pingcap#38342
6d175df 
Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>
@ti-chi-bot ti-chi-bot mentioned this pull request Oct 19, 2022
Merged
12 tasks
@ti-chi-bot
Copy link
Member

In response to a cherrypick label: new pull request created: #38543.

ti-chi-bot pushed a commit to ti-chi-bot/tidb that referenced this pull request Oct 19, 2022
@lance6716 @ti-chi-bot
This is an automated cherry-pick of pingcap#38342
b1afbfd 
Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>
ti-chi-bot added a commit that referenced this pull request Nov 2, 2022
@ti-chi-bot
*: don't use DSN to avoid some security problems (#38342) (#38543)
dcc5cf7 
close #38541
@dwisiswant0
Copy link

Since it's already rolled out. Can you please give an update on 120f1346-e958-49d0-b66c-0f889a469540? Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kennytm kennytm kennytm approved these changes

@niubell niubell niubell approved these changes

@lichunzhu lichunzhu lichunzhu approved these changes

Assignees
No one assigned
Labels
affects-5.4 This bug affects 5.4.x versions. affects-6.1 needs-cherry-pick-release-5.4 Should cherry pick this PR to release-5.4 branch. needs-cherry-pick-release-6.1 Should cherry pick this PR to release-6.1 branch. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. status/can-merge Indicates a PR has been approved by a committer. status/LGT2 Indicates that a PR has LGTM 2.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

should not use DSN to connect databases
8 participants
@lance6716 @ti-chi-bot @dwisiswant0 @sre-bot @kennytm @niubell @lichunzhu @3pointer