diff --git a/storage/connect/bsonudf.cpp b/storage/connect/bsonudf.cpp index 0d129b3ae5b..5c02c08436e 100644 --- a/storage/connect/bsonudf.cpp +++ b/storage/connect/bsonudf.cpp @@ -4701,7 +4701,11 @@ char *bfile_convert(UDF_INIT* initid, UDF_ARGS* args, char* result, fn = MakePSZ(g, args, 0); ofn = MakePSZ(g, args, 1); - if (!connect_can_access_file(fn) || !connect_can_access_file(ofn)) { + if (!fn || !ofn) { + PUSH_WARNING("Missing file name"); + *is_null = 1; + return NULL; + } else if (!connect_can_access_file(fn) || !connect_can_access_file(ofn)) { PUSH_WARNING("Access denied: FILE privilege or secure_file_priv violation"); *is_null = 1; return NULL; @@ -4758,7 +4762,7 @@ my_bool bfile_bjson_init(UDF_INIT* initid, UDF_ARGS* args, char* message) { char *bfile_bjson(UDF_INIT *initid, UDF_ARGS *args, char *result, unsigned long *res_length, uchar *is_null, uchar *error) { - char *buf, *str = NULL, fn[_MAX_PATH], ofn[_MAX_PATH]; + char *fn, *ofn, *buf, *str = NULL; bool loop; ssize_t len, newloc; size_t lrecl, binszp; @@ -4766,15 +4770,19 @@ char *bfile_bjson(UDF_INIT *initid, UDF_ARGS *args, char *result, PGLOBAL g = (PGLOBAL)initid->ptr; BDOC doc(g); - snprintf(fn, sizeof(fn), "%s", MakePSZ(g, args, 0)); - snprintf(ofn, sizeof(ofn), "%s", MakePSZ(g, args, 1)); + fn = MakePSZ(g, args, 0); + ofn = MakePSZ(g, args, 1); if (args->arg_count == 3) lrecl = (size_t)*(longlong*)args->args[2]; else lrecl = 1024; - if (!connect_can_access_file(fn) || !connect_can_access_file(ofn)) { + if (!fn || !ofn) { + PUSH_WARNING("Missing file name"); + *is_null = 1; + return NULL; + } else if (!connect_can_access_file(fn) || !connect_can_access_file(ofn)) { PUSH_WARNING("Access denied: FILE privilege or secure_file_priv violation"); *is_null = 1; return NULL; diff --git a/storage/connect/jsonudf.cpp b/storage/connect/jsonudf.cpp index f5966cbe3c0..435e365538b 100644 --- a/storage/connect/jsonudf.cpp +++ b/storage/connect/jsonudf.cpp @@ -5981,7 +5981,11 @@ char *jfile_convert(UDF_INIT* initid, UDF_ARGS* args, char* result, fn = MakePSZ(g, args, 0); ofn = MakePSZ(g, args, 1); - if (!connect_can_access_file(fn) || !connect_can_access_file(ofn)) { + if (!fn || !ofn) { + PUSH_WARNING("Missing file name"); + *is_null = 1; + return NULL; + } else if (!connect_can_access_file(fn) || !connect_can_access_file(ofn)) { PUSH_WARNING("Access denied: FILE privilege or secure_file_priv violation"); *is_null = 1; return NULL; @@ -6055,7 +6059,11 @@ char *jfile_bjson(UDF_INIT *initid, UDF_ARGS *args, char *result, else lrecl = 1024; - if (!connect_can_access_file(fn) || !connect_can_access_file(ofn)) { + if (!fn || !ofn) { + PUSH_WARNING("Missing file name"); + *is_null = 1; + return NULL; + } else if (!connect_can_access_file(fn) || !connect_can_access_file(ofn)) { PUSH_WARNING("Access denied: FILE privilege or secure_file_priv violation"); *is_null = 1; return NULL; diff --git a/storage/connect/mysql-test/connect/r/json_bson_file_priv.result b/storage/connect/mysql-test/connect/r/json_bson_file_priv.result index b03b421436f..42bf07b5ab7 100644 --- a/storage/connect/mysql-test/connect/r/json_bson_file_priv.result +++ b/storage/connect/mysql-test/connect/r/json_bson_file_priv.result @@ -136,6 +136,46 @@ ok 1 Warnings: Warning 1105 Missing file name +select jfile_bjson(NULL, 'out.json', 0) IS NULL AS ok; +ok +1 +Warnings: +Warning 1105 Missing file name +select jfile_bjson('bib0.json', NULL, 0) IS NULL AS ok; +ok +1 +Warnings: +Warning 1105 Missing file name +select jfile_convert(NULL, 'out.json', 1024) IS NULL AS ok; +ok +1 +Warnings: +Warning 1105 Missing file name +select jfile_convert('biblio.json', NULL, 1024) IS NULL AS ok; +ok +1 +Warnings: +Warning 1105 Missing file name +select bfile_bjson(NULL, 'out.json', 0) IS NULL AS ok; +ok +1 +Warnings: +Warning 1105 Missing file name +select bfile_bjson('bib0.json', NULL, 0) IS NULL AS ok; +ok +1 +Warnings: +Warning 1105 Missing file name +select bfile_convert(NULL, 'out.json', 1024) IS NULL AS ok; +ok +1 +Warnings: +Warning 1105 Missing file name +select bfile_convert('biblio.json', NULL, 1024) IS NULL AS ok; +ok +1 +Warnings: +Warning 1105 Missing file name # Privileged user: relative path resolving outside secure_file_priv select json_file('../../bib0.json') IS NULL AS denied; denied diff --git a/storage/connect/mysql-test/connect/t/json_bson_file_priv.test b/storage/connect/mysql-test/connect/t/json_bson_file_priv.test index e3f4d5469ef..a06c9e143c7 100644 --- a/storage/connect/mysql-test/connect/t/json_bson_file_priv.test +++ b/storage/connect/mysql-test/connect/t/json_bson_file_priv.test @@ -29,12 +29,16 @@ let $MYSQLD_DATADIR = `select @@datadir`; --replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR --eval select jfile_bjson('$MYSQL_TMP_DIR/bib0.json', '$MYSQL_TMP_DIR/out.json', 0) IS NOT NULL AS ok +--remove_file $MYSQL_TMP_DIR/out.json --replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR --eval select jfile_convert('$MYSQL_TMP_DIR/biblio.json', '$MYSQL_TMP_DIR/out.json', 1024) IS NOT NULL AS ok +--remove_file $MYSQL_TMP_DIR/out.json --replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR --eval select bfile_bjson('$MYSQL_TMP_DIR/bib0.json', '$MYSQL_TMP_DIR/out.json', 0) IS NOT NULL AS ok +--remove_file $MYSQL_TMP_DIR/out.json --replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR --eval select bfile_convert('$MYSQL_TMP_DIR/biblio.json', '$MYSQL_TMP_DIR/out.json', 1024) IS NOT NULL AS ok +--remove_file $MYSQL_TMP_DIR/out.json --echo # Privileged user: path outside secure_file_priv --replace_result $MYSQLD_DATADIR DATADIR @@ -75,6 +79,14 @@ select jfile_make('{"test":1}', NULL, 0) IS NULL AS ok; select bfile_make('{"test":1}', NULL, 0) IS NULL AS ok; select jbin_file(NULL) IS NULL AS ok; select bbin_file(NULL) IS NULL AS ok; +select jfile_bjson(NULL, 'out.json', 0) IS NULL AS ok; +select jfile_bjson('bib0.json', NULL, 0) IS NULL AS ok; +select jfile_convert(NULL, 'out.json', 1024) IS NULL AS ok; +select jfile_convert('biblio.json', NULL, 1024) IS NULL AS ok; +select bfile_bjson(NULL, 'out.json', 0) IS NULL AS ok; +select bfile_bjson('bib0.json', NULL, 0) IS NULL AS ok; +select bfile_convert(NULL, 'out.json', 1024) IS NULL AS ok; +select bfile_convert('biblio.json', NULL, 1024) IS NULL AS ok; --echo # Privileged user: relative path resolving outside secure_file_priv select json_file('../../bib0.json') IS NULL AS denied;