-
Notifications
You must be signed in to change notification settings - Fork 14.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Sanitize filenames in MySQLHook #33328
Conversation
Can you please amend the commit message to a meaningful one? We generate release notes based on commit message thus it's important |
99867c1
to
72343e1
Compare
Done, sorry, I must have replaced the main commit message accidentally. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the linked issue, I see:
fillename = " file; SELECT * FROM DUAL"
Does your change remove the leading space? If not, could you add a strip on re.sub
result?
The change doesn't remove leading spaces. I presumed the issue was with SQL commands following any |
I think it's a little bit more complex though, sheer presence of ";" is not enough, it will be " ';" that will trigger it. I am thinking that better solution will be to actually use prepared statement in this case. Not sure if that works for this command (but there is no reason it should not): https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursorprepared.html This is the ultimate way how you can avoid sql injection type of problems like this one. |
Then you do not have sanitize file name at all. It's effectively mitigated by the driver parsing the statement first and adding filename later. |
Regarding PREPARE statements, would changing
into
do the trick? |
Very much so. |
It looks like the above syntax doesn't sit well with MySQL 5.7! |
Shall we wait :)?
Actually I would be qute fine to make it MySQL 8 only feature in anticipation of us dropping support in provider. Users might still use older provoders if they want to keep 5.7. |
One of the ways to do it is to make if (mysql 8 -> prepare, if not, don't) for now and then in 2 months we will drop it completely. |
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions. |
I wonder is this PR can still be useful in 1 month when MySQL 5.7 reaches EOL? |
yes |
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions. |
Perhaps this can be merged now? |
572e59c
to
af7693b
Compare
Rebased it. Generatlly when we have old PRs that (for whatever reason) has not been built for some time, rebasing is firt thing to do. |
There was an error that looked suspiciously related (MySQL test failed but also could be flake) I re-run it - if it happens again I think you will need to fix it @PApostol |
Yep. it looks like:
So ... no :) until it is fixed :) |
Hello, I have updated the PR, tests seem to pass now. Perhaps it can be reviewed? |
Cool. Thanks for fixing it :) |
This PR ensures filenames in MySQLHook are sanitized, so no arbitrary SQL execution could happen with e.g.
filename = "myfile; SELECT * FROM DUAL"
. Closes #33283.