Skip to content

*: introduce new API ParseWithParams (#22499)#22548

Merged
ti-chi-bot merged 4 commits intopingcap:release-4.0from
ti-srebot:release-4.0-ae0057da714e
Mar 1, 2021
Merged

*: introduce new API ParseWithParams (#22499)#22548
ti-chi-bot merged 4 commits intopingcap:release-4.0from
ti-srebot:release-4.0-ae0057da714e

Conversation

@ti-srebot
Copy link
Contributor

@ti-srebot ti-srebot commented Jan 27, 2021

cherry-pick #22499 to release-4.0
You can switch your code base to this Pull Request by using git-extras:

# In tidb repo:
git pr https://github.com/pingcap/tidb/pull/22548

After apply modifications, you can push your change to this PR via:

git push git@github.com:ti-srebot/tidb.git pr/22548:release-4.0-ae0057da714e

What problem does this PR solve?

Problem Summary: This PR adds a new API ParseWithParams to help process unsafe arguments than just fmt.Sprintf. Also a helper API ExecuteInternal that is using ParseWithParams and ExecuteStmt.

I did not use PrepareStmt since it is not possible to use placeholder like select * from t where c in ?. But we do have such requirement.

ExecuteInternal is redefined to use ParseWithParams and always use utf8 charset for safety. But it is still needed to modify cases like ExecuteInternal(fmt.Sprintf(...)).

ExecRestrictedSQL is too large, thus it is both annoying and duplicated to write a new RestrictedSQLExecutor based on ParseWithParams. From the git history, this is a very legacy API that is 4 or 5 years old. It should be removed/refactored in further works. So the current plan is, write like ExecRestrictedSQL(session.EscapeSQL(sql, args...)). And it will goes to the modified ExecuteInternal eventually to use utf8 charset to prevent attacks based on charsets.

Check List

Tests

  • Unit test
  • Integration test

Release note

  • No release note

@ti-srebot
Copy link
Contributor Author

/run-all-tests

@ti-srebot
Copy link
Contributor Author

@xhebox you're already a collaborator in bot's repo.

@morgo
Copy link
Contributor

morgo commented Jan 27, 2021

LGTM

@ti-srebot
Copy link
Contributor Author

@morgo, Thanks for your review. The bot only counts LGTMs from Reviewers and higher roles, but you're still welcome to leave your comments. See the corresponding SIG page for more information. Related SIGs: execution(slack),sql-infra(slack).

@bb7133 bb7133 changed the title *: preventing SQL injection (#22499) *: introduce new API ParseWithParams (#22499) Jan 27, 2021
@morgo
Copy link
Contributor

morgo commented Feb 2, 2021

LGTM

@ti-srebot ti-srebot added the status/LGT1 Indicates that a PR has LGTM 1. label Feb 2, 2021
@ti-srebot ti-srebot added status/LGT2 Indicates that a PR has LGTM 2. and removed status/LGT1 Indicates that a PR has LGTM 1. labels Feb 2, 2021
@bb7133
Copy link
Member

bb7133 commented Feb 2, 2021

LGTM

@bb7133
Copy link
Member

bb7133 commented Feb 2, 2021

/merge

@ti-srebot
Copy link
Contributor Author

Sorry @bb7133, this branch's release version is in progress, please contact zhouqiang-cl,shuke987,jebter,you06 for more details.

@ti-chi-bot ti-chi-bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed sig/infra labels Feb 22, 2021
@ti-chi-bot
Copy link
Member

@AilinKid: Please use /LGTM instead of LGTM when you want to approve the pull request by comment.
If you use the GitHub review feature, please approve the PR directly, the comment will not take effect in the GitHub review feature.
If you have any qustions please refer to lgtm command help or lgtm plugin design.

If you have approved this PR, please ignore this reply. This reply is being used as a temporary reply during the migration of the new bot and will be removed on April 1.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

Copy link
Contributor

@AilinKid AilinKid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@AilinKid
Copy link
Contributor

/run-all-tests

@xhebox
Copy link
Contributor

xhebox commented Feb 25, 2021

LGTM

Is this branch merge-able now?

Signed-off-by: ti-srebot <ti-srebot@pingcap.com>
Signed-off-by: xhe <xw897002528@gmail.com>
@xhebox xhebox force-pushed the release-4.0-ae0057da714e branch from a99dbc9 to 449f3e5 Compare February 25, 2021 03:05
@ti-chi-bot ti-chi-bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Feb 25, 2021
@tiancaiamao
Copy link
Contributor

LGTM

Is this branch merge-able now?

It depends on whether the 4.0 branch is still frozen

Signed-off-by: xhe <xw897002528@gmail.com>
@morgo
Copy link
Contributor

morgo commented Mar 1, 2021

/merge

@ti-chi-bot
Copy link
Member

@morgo: It seems you want to merge this PR, I will help you trigger all the tests:

/run-all-tests

You only need to trigger /merge once, and if the CI test fails, you just re-trigger the test that failed and the bot will merge the PR for you after the CI passes.

If you have any questions about the PR merge process, please refer to pr process.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

@ti-chi-bot
Copy link
Member

This pull request has been accepted and is ready to merge.

DetailsCommit hash: f248dbd

@ti-chi-bot ti-chi-bot added the status/can-merge Indicates a PR has been approved by a committer. label Mar 1, 2021
@ti-chi-bot
Copy link
Member

@ti-srebot: Your PR was out of date, I have automatically updated it for you.

At the same time I will also trigger all tests for you:

/run-all-tests

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

@ti-chi-bot ti-chi-bot merged commit d77d908 into pingcap:release-4.0 Mar 1, 2021
@tiancaiamao tiancaiamao deleted the release-4.0-ae0057da714e branch March 2, 2021 06:03
@zhouqiang-cl zhouqiang-cl modified the milestones: v4.0.11, v4.0.12 Mar 26, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

sig/execution SIG execution sig/sql-infra SIG: SQL Infra size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. status/can-merge Indicates a PR has been approved by a committer. status/LGT2 Indicates that a PR has LGTM 2. type/4.0-cherry-pick

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants