Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

*: don't use DSN to avoid some security problems (#38342) #38543

Merged
merged 3 commits into from
Nov 2, 2022
Merged

*: don't use DSN to avoid some security problems (#38342) #38543

merged 3 commits into from
Nov 2, 2022

Conversation

ti-chi-bot
Copy link
Member

This is an automated cherry-pick of #38342

Signed-off-by: lance6716 lance6716@gmail.com

What problem does this PR solve?

Issue Number: close #38541

--- copied from #37489 ---

Problem Summary:

TiDB uses Go MySQL Driver for connecting to MySQL servers. The Data Source Name (DSN) strings for describing database connections is not neutralized so they can escape and add new parameters to use as data source name.

What is changed and how it works?

Check List

Tests

  • Unit test
  • Integration test
  • Manual test (add detailed scripts or steps below)
  • No code

Side effects

  • Performance regression: Consumes more CPU
  • Performance regression: Consumes more Memory
  • Breaking backward compatibility

Documentation

  • Affects user behaviors
  • Contains syntax changes
  • Contains variable changes
  • Contains experimental features
  • Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

Fix the issue of arbitrary file read via data source name injection (CVE-2022-3023).

@lance6716 @ti-chi-bot
This is an automated cherry-pick of pingcap#38342
b1afbfd 
Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>
@ti-chi-bot ti-chi-bot mentioned this pull request Oct 19, 2022
Merged
12 tasks
@ti-chi-bot
Copy link
Member Author

ti-chi-bot commented Oct 19, 2022 •
edited
Loading

[REVIEW NOTIFICATION]

This pull request has been approved by:

  • D3Hunter
  • lichunzhu

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

@ti-chi-bot ti-chi-bot added affects-5.4 This bug affects 5.4.x versions. affects-6.1 release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. type/cherry-pick-for-release-6.1 This PR is cherry-picked to release-6.1 from a source PR. do-not-merge/cherry-pick-not-approved labels Oct 19, 2022
@lance6716
fix conflict
4e2849e 
Signed-off-by: lance6716 <lance6716@gmail.com>
@ti-chi-bot ti-chi-bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Oct 19, 2022
@lance6716
Copy link
Contributor

/cc @niubell @lichunzhu

lichunzhu
lichunzhu approved these changes Oct 19, 2022
View reviewed changes
Copy link
Contributor

@lichunzhu lichunzhu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ti-chi-bot ti-chi-bot added the status/LGT1 Indicates that a PR has LGTM 1. label Oct 19, 2022
@VelocityLight VelocityLight added cherry-pick-approved Cherry pick PR approved by release team. and removed do-not-merge/cherry-pick-not-approved labels Oct 25, 2022
@lance6716
Copy link
Contributor

/cc @buchuitoudegou @D3Hunter

@ti-chi-bot ti-chi-bot added status/LGT2 Indicates that a PR has LGTM 2. and removed status/LGT1 Indicates that a PR has LGTM 1. labels Nov 2, 2022
@lance6716
Copy link
Contributor

/merge

@ti-chi-bot
Copy link
Member Author

This pull request has been accepted and is ready to merge.

Commit hash: 4e2849e

@ti-chi-bot ti-chi-bot added the status/can-merge Indicates a PR has been approved by a committer. label Nov 2, 2022
@ti-chi-bot
Copy link
Member Author

@ti-chi-bot: Your PR was out of date, I have automatically updated it for you.

At the same time I will also trigger all tests for you:

/run-all-tests

If the CI test fails, you just re-trigger the test that failed and the bot will merge the PR for you after the CI passes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

@ti-chi-bot ti-chi-bot merged commit dcc5cf7 into pingcap:release-6.1 Nov 2, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lichunzhu lichunzhu lichunzhu approved these changes

@D3Hunter D3Hunter D3Hunter approved these changes

@niubell niubell Awaiting requested review from niubell

@buchuitoudegou buchuitoudegou Awaiting requested review from buchuitoudegou

Assignees

@lance6716 lance6716

Labels
affects-5.4 This bug affects 5.4.x versions. affects-6.1 cherry-pick-approved Cherry pick PR approved by release team. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. status/can-merge Indicates a PR has been approved by a committer. status/LGT2 Indicates that a PR has LGTM 2. type/cherry-pick-for-release-6.1 This PR is cherry-picked to release-6.1 from a source PR.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@ti-chi-bot @lance6716 @D3Hunter @lichunzhu @VelocityLight