database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-27 18:02:13 +03:00
Code Activity

Fix for bug #53907: Table dump command can be abused to dump arbitrary tables.

Browse Source 
Problem: one with SELECT privilege on some table may dump other table
performing COM_TABLE_DUMP command due to missed check of the table name.

Fix: check the table name.
This commit is contained in:
Ramil Kalimullin
2010-05-25 17:56:23 +04:00
parent 27ac666fea
commit edfea7d590
2 changed files with 47 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
tests/mysql_client_test.c
View File

@ -16720,6 +16720,43 @@ static void test_bug53371()
}
static void test_bug53907()
{
int rc;
char buf[] = "\x4test\x14../client_test_db/t1";
myheader("test_bug53907");
rc= mysql_query(mysql, "DROP TABLE IF EXISTS t1");
myquery(rc);
rc= mysql_query(mysql, "DROP DATABASE IF EXISTS bug53907");
myquery(rc);
rc= mysql_query(mysql, "DROP USER 'testbug'@localhost");
rc= mysql_query(mysql, "CREATE TABLE t1 (a INT)");
myquery(rc);
rc= mysql_query(mysql, "CREATE DATABASE bug53907");
myquery(rc);
rc= mysql_query(mysql, "GRANT SELECT ON bug53907.* to 'testbug'@localhost");
myquery(rc);
rc= mysql_change_user(mysql, "testbug", NULL, "bug53907");
myquery(rc);
rc= simple_command(mysql, COM_TABLE_DUMP, buf, sizeof(buf), 0);
DIE_UNLESS(mysql_errno(mysql) == 1103); /* ER_WRONG_TABLE_NAME */
rc= mysql_change_user(mysql, opt_user, opt_password, current_db);
myquery(rc);
rc= mysql_query(mysql, "DROP TABLE t1");
myquery(rc);
rc= mysql_query(mysql, "DROP DATABASE bug53907");
myquery(rc);
rc= mysql_query(mysql, "DROP USER 'testbug'@localhost");
myquery(rc);
}
/*
Read and parse arguments and MySQL options from my.cnf
*/
@ -17024,6 +17061,7 @@ static struct my_tests_st my_tests[]= {
{ "test_bug20023", test_bug20023 },
{ "test_bug45010", test_bug45010 },
{ "test_bug53371", test_bug53371 },
{ "test_bug53907", test_bug53907 },
{ 0, 0 }
};