1
0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Files
mariadb/debian
Hemant Dangi 6f78e802c1 MDEV-41230: shipped wsrep_notify.sh reparses credentials through eval
Issue: wsrep_notify.sh builds the mysql client invocation as text with
values wrapped in '...', then re-parses it via eval. A configured
password (or SSL path) containing a single quote breaks out of that
quoting, splitting into extra arguments; the unquoted SSL_PARAM splice
also let ssl_* values undergo pathname (glob) expansion before eval
ever ran.

Solution: escape embedded single quotes before interpolating USER,
PSWD, HOST and the ssl_* values into the eval'd string, and quote the
SSL_PARAM splice so it isn't glob/word-split before eval runs. Applied
identically to the std_data test copies, and added a galera regression
test reproducing the reported password-splitting.
2026-10-01 13:14:48 +03:00
..
2026-06-15 10:43:23 +02:00
2026-05-08 07:38:22 +02:00
2022-07-25 12:08:29 +03:00
2026-08-19 08:13:54 +02:00
…
2023-06-08 10:46:19 +03:00
2020-06-12 01:17:57 +02:00
2025-06-23 13:51:52 +03:00
2024-07-17 14:32:50 +10:00