mirror of
https://github.com/MariaDB/server.git
synced 2025-01-19 21:42:35 +01:00
2124538d9c
/*![:version:] Query Code */, where [:version:] is a sequence of 5 digits representing the mysql server version(e.g /*!50200 ... */), is a special comment that the query in it can be executed on those servers whose versions are larger than the version appearing in the comment. It leads to a security issue when slave's version is larger than master's. A malicious user can improve his privileges on slaves. Because slave SQL thread is running with SUPER privileges, so it can execute queries that he/she does not have privileges on master. This bug is fixed with the logic below: - To replace '!' with ' ' in the magic comments which are not applied on master. So they become common comments and will not be applied on slave. - Example: 'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/ will be binlogged as 'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/ mysql-test/suite/rpl/t/rpl_conditional_comments.test: Test the patch for this bug. sql/mysql_priv.h: Rename inBuf as rawBuf and remove the const limitation. sql/sql_lex.cc: To replace '!' with ' ' in the magic comments which are not applied on master. sql/sql_lex.h: Remove the const limitation on parameter buff, as it can be modified in the function since this patch. Add member function yyUnput for Lex_input_stream. It set a character back the query buff. sql/sql_parse.cc: Rename inBuf as rawBuf and remove the const limitation. sql/sql_partition.cc: Remove the const limitation on parameter part_buff, as it can be modified in the function since this patch. sql/sql_partition.h: Remove the const limitation on parameter part_buff, as it can be modified in the function since this patch. sql/table.h: Remove the const limitation on variable partition_info, as it can be modified since this patch.
74 lines
2.4 KiB
Text
74 lines
2.4 KiB
Text
###############################################################################
|
|
# After the patch for BUG#49124:
|
|
# - Use ' ' instead of '!' in the conditional comments which are not applied on
|
|
# master. So they become common comments and will not be applied on slave.
|
|
#
|
|
# - Example:
|
|
# 'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
|
|
# will be binlogged as
|
|
# 'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/'.
|
|
###############################################################################
|
|
source include/master-slave.inc;
|
|
source include/have_binlog_format_statement.inc;
|
|
|
|
CREATE TABLE t1(c1 INT);
|
|
source include/show_binlog_events.inc;
|
|
let $binlog_start= query_get_value(SHOW MASTER STATUS, Position, 1);
|
|
|
|
--echo
|
|
--echo # Case 1:
|
|
--echo # ------------------------------------------------------------------
|
|
--echo # In a statement, some CCs are applied while others are not. The CCs
|
|
--echo # which are not applied on master will be binlogged as common comments.
|
|
|
|
/*!99999 --- */INSERT /*!INTO*/ /*!10000 t1 */ VALUES(10) /*!99999 ,(11)*/;
|
|
|
|
source include/show_binlog_events.inc;
|
|
let $binlog_start= query_get_value(SHOW MASTER STATUS, Position, 1);
|
|
sync_slave_with_master;
|
|
let $diff_table_1=master:test.t1;
|
|
let $diff_table_2=slave:test.t1;
|
|
source include/diff_tables.inc;
|
|
|
|
--echo
|
|
--echo # Case 2:
|
|
--echo # -----------------------------------------------------------------
|
|
--echo # Verify whether it can be binlogged correctly when executing prepared
|
|
--echo # statement.
|
|
PREPARE stmt FROM 'INSERT INTO /*!99999 blabla*/ t1 VALUES(60) /*!99999 ,(61)*/';
|
|
EXECUTE stmt;
|
|
DROP TABLE t1;
|
|
CREATE TABLE t1(c1 INT);
|
|
EXECUTE stmt;
|
|
|
|
sync_slave_with_master;
|
|
let $diff_table_1=master:test.t1;
|
|
let $diff_table_2=slave:test.t1;
|
|
source include/diff_tables.inc;
|
|
|
|
--echo
|
|
SET @value=62;
|
|
PREPARE stmt FROM 'INSERT INTO /*!99999 blabla */ t1 VALUES(?) /*!99999 ,(63)*/';
|
|
EXECUTE stmt USING @value;
|
|
DROP TABLE t1;
|
|
CREATE TABLE t1(c1 INT);
|
|
EXECUTE stmt USING @value;
|
|
|
|
source include/show_binlog_events.inc;
|
|
let $binlog_start= query_get_value(SHOW MASTER STATUS, Position, 1);
|
|
|
|
sync_slave_with_master;
|
|
let $diff_table_1=master:test.t1;
|
|
let $diff_table_2=slave:test.t1;
|
|
source include/diff_tables.inc;
|
|
|
|
--echo
|
|
--echo # Case 3:
|
|
--echo # -----------------------------------------------------------------
|
|
--echo # Verify it can restore the '!', if the it is an uncomplete conditional
|
|
--echo # comments
|
|
--error 1064
|
|
SELECT c1 FROM /*!99999 t1 WHEREN;
|
|
|
|
DROP TABLE t1;
|
|
source include/master-slave-end.inc;
|