Issue:
wsrep_notify_status() interpolated members[i].name() (the peer's
wsrep_node_name) and members[i].incoming() verbatim into a command
string that is then executed via 'sh -c' by wsp::process. A peer
joining the cluster with shell metacharacters in its wsrep_node_name
or wsrep_node_incoming_address caused arbitrary commands to run on
every cluster member that had wsrep_notify_cmd configured.
MDEV-39413 introduced safe() for the same threat class in the SST
scripts but did not cover the C++ wsrep_notify path.
Solution:
Validate each substituted field against a narrow whitelist before
interpolating. Node name allows alnum and -_. ; node address
additionally allows :[]/ for host:port and [ipv6] forms. On bad
input the notification is skipped with an error log instead of
forwarding the unsafe value to sh -c.
This is regression caused by MDEV-28750 commit 1f349968.
In multi-table update table list could contain tables
that are not yet opened because update does not really
change them. This can happen e.g. when update changes
table that is referenced by foreign key by table that
is not part of multi-table update.
Fixed by first checking is wsrep write set size limited.
If it is not multi-table update can continue normally.
If write set size is limited then check has update
updated both transactional and non-transactional tables
and those tables that have not yet been opened can be
safely skipped as they are not updated.
Issue:
wsrep_sst_rsync.sh interpolated WSREP_SST_OPT_REMOTE_USER and
WSREP_SST_OPT_REMOTE_PSWD verbatim. Because both values originate from
the joiner side of the SST request, a newline in either could splice
an extra directive into the donor-written stunnel.conf (silently
downgrading peer-cert verification) or an extra line into the rsync
magic file. MDEV-39413 had introduced safe() for the same threat class
in wsrep_sst_mariabackup but did not extend it to the rsync script.
Solution:
Routing the rsync interpolations through safe() closes the gap, and
extending safe() to also reject tab and newline ensures multi-line
values cannot survive into a config-file heredoc.
GROUP_CONCAT is limited by group_concat_max_len,
but also, as a string function it must respect max_allowed_packet.
Let's introduce THD::gconcat_max_len() helper to simplify checks.
Also:
* make max group_concat_max_len value the same as max max_allowed_packet
* use the same MY_MIN((ulonglong) ..., UINT_MAX32) in
Item_func_json_objectagg as in Item_func_group_concat
* use overflow-safe type for lengths in Item_func_quote
(MAX_MAX_ALLOWED_PACKET is 1G so uint cannot overflow yet, but it's
a fragile assumption)
max_subnet estimate was off by one.
* only allow address with a known family
(trips an assert in addr_matches_subnet())
* adjust max_subnet estimate accordinly
Joiner mariadbd exits when SST is aborted; the exit code varies by
platform (clean 0 on some systems, signalled 134 / 1 on others).
pkill exit code can also vary by platform (clean 0 on some systems,
signalled 1 others).
Add verification of wsrep_sst_donor, wsrep_sst_method and
wsrep_sst_receive_address so that they contain only
supported characters. But allow NULL or empty value.
This issue is regression caused by MDEV-38019 Send ok packet
to client earlier.
BF aborts may be detected very late in command exectution,
somewhere near the end of do_command(). If the ok packet has
already been sent and BF abort is detected very late, this
could cause the protocol packets becoming out of sync.
This is a result of reverting order of releasing MDL and
sending ok packet to the client. If it happens in the
opposite order than before, there will remain some time
window where the select is complete and MDL locks still
held. DROP hits that time window, causing a BF abort,
and extra error packet gets injected into client-server
communication stream.
Fixed by not sending ok packet to client earlier
in wsrep case.
There is a repeatable test case that shows failure
if ok packet is sent client earlier by using
debug sync point. However, this fix skips sending ok
packet earlier causing also skipping the sync
point. Therefore, test case is not usable.
Test case galera_sr.mysql-wsrep-features#8 was failing
because of this regression but it is sporadic.
Co-Authored by : Teemu Ollakka <teemu.ollakka@mariadb.com>
Charset specified for XMLTYPE constructor.
Error returned if XML is in UTF16/UTF32 as we can't parse it yet.
XML check added so only well-formed allowed.
Calling itself will cause extensive memory usage that can kill
the machine when it runs out of memory (happend to me).
Fixed by having mtr.out-of-source checking that it is not calling itself.
In addition added a check for cmake to expand symlinks to make the
check if we are running mtr 'out of source' safer.
Author: Sergei Golubchik <serg@mariadb.org> (CMakeList.txt changes)
Field_xmltype::store has to do the my_error when it gets invalid XML,
just the warning with the -1 return results in the DBUG_ASSERT.
Also the UpdateXML function result reverted back to the STRING as
it can legally produce invalid XML, so we can't have columns built
from the UpdateXML to be XMLTYPE.
Validate the chunk_len in the binlog chunk reader, so we don't try to read
data outside of the page.
Signed-off-by: Kristian Nielsen <knielsen@knielsen-hq.org>
The binlog page size is currently fixed at 16k. Don't attempt to read
using a different page size found in the file header, the code doesn't
support it.
Signed-off-by: Kristian Nielsen <knielsen@knielsen-hq.org>
Don't attempt to rotate any old-style binlog files if trying to set
@@binlog_checksum. The @@binlog_checksum variable is unused with the
new binlog, and there are no old-style binlog files to rotate.
Signed-off-by: Kristian Nielsen <knielsen@knielsen-hq.org>
