1
0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Files
mariadb/sql
Hemant Dangi ed8404a73f MDEV-39721: wsrep_notify.cc: reject shell-unsafe characters in joiner-supplied member fields
Issue:
wsrep_notify_status() interpolated members[i].name() (the peer's
wsrep_node_name) and members[i].incoming() verbatim into a command
string that is then executed via 'sh -c' by wsp::process. A peer
joining the cluster with shell metacharacters in its wsrep_node_name
or wsrep_node_incoming_address caused arbitrary commands to run on
every cluster member that had wsrep_notify_cmd configured.
MDEV-39413 introduced safe() for the same threat class in the SST
scripts but did not cover the C++ wsrep_notify path.

Solution:
Validate each substituted field against a narrow whitelist before
interpolating. Node name allows alnum and -_. ; node address
additionally allows :[]/ for host:port and [ipv6] forms. On bad
input the notification is skipped with an error log instead of
forwarding the unsafe value to sh -c.
2026-05-22 20:13:20 +02:00
..
…
…
2024-08-12 09:32:30 +01:00
…
2024-11-29 12:37:46 +02:00
2024-01-17 13:35:05 +02:00
…
…
…
2023-01-27 13:54:14 +01:00
2024-06-24 13:09:47 +03:00
2024-11-29 12:37:46 +02:00
2024-11-29 12:37:46 +02:00
2024-10-29 14:20:03 +01:00
…
2025-01-29 11:17:38 +01:00
2025-04-15 01:49:48 +02:00
2023-12-17 11:20:43 +01:00
…
…
…
2025-02-27 04:02:33 +01:00
2023-02-10 12:02:11 +02:00
2024-11-29 12:37:46 +02:00
…
…
2024-11-29 12:37:46 +02:00
2024-11-29 12:37:46 +02:00
2023-11-08 15:57:05 +01:00
…
2024-06-26 09:16:54 +08:00
2024-06-24 13:09:47 +03:00
2026-04-23 15:53:26 +02:00
2024-06-24 13:09:47 +03:00
…
…
2024-11-29 12:37:46 +02:00
2024-06-24 13:09:47 +03:00
…
2024-11-29 12:37:46 +02:00
2024-05-30 14:27:07 +03:00
2023-02-10 13:03:01 +02:00
2024-06-24 13:09:47 +03:00
2024-01-17 13:35:05 +02:00
2022-10-02 22:14:21 +02:00
2024-06-24 13:09:47 +03:00
2024-11-29 12:37:46 +02:00
2023-02-10 12:02:11 +02:00
2022-10-25 14:25:42 +03:00
2023-12-17 11:20:43 +01:00
2024-11-29 12:37:46 +02:00
…
2024-06-24 13:09:47 +03:00
2024-11-29 12:37:46 +02:00
2024-11-29 12:37:46 +02:00
2023-08-01 15:08:52 +02:00
2023-02-10 12:02:11 +02:00
2024-11-29 12:37:46 +02:00
2024-05-08 20:06:00 +02:00
2025-01-29 11:17:38 +01:00
2024-11-29 12:37:46 +02:00
2024-11-29 12:37:46 +02:00
2024-12-04 18:22:31 +03:00
2023-05-02 10:09:27 +02:00
2024-11-23 08:14:22 -07:00
2026-01-26 23:15:34 +01:00
2025-01-20 09:57:37 +02:00
2023-11-08 15:57:05 +01:00
2024-11-29 12:37:46 +02:00
2024-11-29 12:37:46 +02:00
2024-12-05 09:20:36 +01:00
2024-06-24 13:09:47 +03:00
2025-01-29 11:17:38 +01:00
2025-01-20 09:57:37 +02:00
2024-11-29 12:37:46 +02:00
2024-11-29 12:37:46 +02:00
2024-11-29 12:37:46 +02:00
2024-01-17 13:35:05 +02:00
2023-02-10 12:02:11 +02:00
2025-04-26 10:41:52 +02:00
2024-11-23 08:14:22 -07:00
2024-11-29 12:37:46 +02:00
2024-01-11 12:59:22 +11:00
2024-01-10 18:01:46 +11:00
2024-06-24 13:09:47 +03:00
2024-11-29 12:37:46 +02:00
…
2026-03-17 18:57:42 +01:00
…
2025-01-09 10:15:53 +01:00
2024-08-20 09:11:34 +02:00
2024-07-16 15:54:22 +08:00
2024-07-16 15:54:22 +08:00
2024-02-12 11:38:13 +02:00
2024-12-17 11:06:09 +11:00
2024-11-29 12:37:46 +02:00
…
2024-06-24 13:09:47 +03:00
2025-04-26 10:41:52 +02:00
2023-05-23 12:25:39 +03:00
2024-11-29 12:37:46 +02:00
2025-01-20 09:57:37 +02:00
2024-06-05 14:06:16 +10:00
2024-04-15 18:54:30 +02:00
2025-01-20 09:57:37 +02:00
2024-07-03 12:45:30 +02:00
2023-08-04 07:52:54 +02:00
2023-12-17 11:20:43 +01:00
2025-04-21 10:43:17 +02:00
2023-12-02 01:02:50 +01:00
2024-12-17 11:06:09 +11:00
2024-11-29 12:37:46 +02:00
2024-03-27 15:00:56 +02:00
2025-04-15 01:49:48 +02:00
2024-10-29 14:20:03 +01:00
2025-02-02 12:55:16 +01:00
2025-01-20 09:57:37 +02:00
2025-03-26 17:09:57 +02:00
2023-09-25 13:06:57 +10:00
2024-01-17 13:35:05 +02:00
2023-08-01 15:08:52 +02:00
2024-11-23 08:14:22 -07:00
2024-11-23 08:14:23 -07:00
2025-04-21 10:43:17 +02:00
2022-10-25 14:25:42 +03:00
2025-01-07 16:46:43 +01:00
…
2025-03-26 17:09:57 +02:00
2024-11-29 12:37:46 +02:00
2024-01-10 18:01:46 +11:00
2024-11-05 21:32:48 +01:00
2024-06-24 13:09:47 +03:00
…
2023-02-10 12:02:11 +02:00
2023-01-03 18:13:11 +02:00
2023-02-10 12:02:11 +02:00
2024-01-02 17:37:58 +02:00
2025-01-20 09:57:37 +02:00
2025-01-29 11:17:38 +01:00
2024-10-29 14:20:03 +01:00
2025-02-02 12:55:16 +01:00
2024-11-29 12:37:46 +02:00