Skip to content

*: don't use DSN to avoid some security problems#38342

Merged
ti-chi-bot merged 6 commits intopingcap:masterfrom
lance6716:sec-dsn
Oct 19, 2022
Merged

*: don't use DSN to avoid some security problems#38342
ti-chi-bot merged 6 commits intopingcap:masterfrom
lance6716:sec-dsn

Conversation

@lance6716
Copy link
Contributor

@lance6716 lance6716 commented Oct 9, 2022 •
edited
Loading

Signed-off-by: lance6716 lance6716@gmail.com

What problem does this PR solve?

Issue Number: close #38541

--- copied from #37489 ---

Problem Summary:

TiDB uses Go MySQL Driver for connecting to MySQL servers. The Data Source Name (DSN) strings for describing database connections is not neutralized so they can escape and add new parameters to use as data source name.

What is changed and how it works?

Check List

Tests

  • Unit test
  • Integration test
  • Manual test (add detailed scripts or steps below)
  • No code

Side effects

  • Performance regression: Consumes more CPU
  • Performance regression: Consumes more Memory
  • Breaking backward compatibility

Documentation

  • Affects user behaviors
  • Contains syntax changes
  • Contains variable changes
  • Contains experimental features
  • Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

Fix the issue of arbitrary file read via data source name injection (CVE-2022-3023).

@lance6716
*: don't use DSN to avoid some security problems
85844cd 
Signed-off-by: lance6716 <lance6716@gmail.com>
@ti-chi-bot
Copy link
Member

ti-chi-bot commented Oct 9, 2022 •
edited
Loading

[REVIEW NOTIFICATION]

This pull request has been approved by:

  • kennytm
  • lichunzhu

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Details

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

@ti-chi-bot ti-chi-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 9, 2022
@lance6716
fix CI
4b68a4d 
Signed-off-by: lance6716 <lance6716@gmail.com>
@lance6716
fix CI
e72b168 
Signed-off-by: lance6716 <lance6716@gmail.com>
@ti-chi-bot ti-chi-bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 9, 2022
@lance6716
Copy link
Contributor Author

lance6716 commented Oct 9, 2022

@dwisiswant0 ptal. I didn't change some binaries that are only used in tests.

@lance6716
fix UT
f1fb540 
Signed-off-by: lance6716 <lance6716@gmail.com>
@lance6716
Copy link
Contributor Author

lance6716 commented Oct 10, 2022

/cc @kennytm

not sure if you have interest in this problem

@ti-chi-bot ti-chi-bot requested a review from kennytm October 10, 2022 02:19
@lance6716
Copy link
Contributor Author

lance6716 commented Oct 12, 2022

PTAL @dwisiswant0

@dwisiswant0
Copy link

dwisiswant0 commented Oct 12, 2022

LGTM, @lance6716. I can confirm it can't be reproduced anymore.

[mysql] 2022/10/12 15:43:04 packets.go:37: unexpected EOF
[2022/10/12 15:43:04.800 +07:00] [FATAL] [main.go:85] ["local file '/etc/passwd' is not registered"] [stack="main.main\n\t/tmp/tidb/cmd/importer/main.go:85\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:250"]

@ti-chi-bot ti-chi-bot added the status/LGT1 Indicates that a PR has LGTM 1. label Oct 12, 2022
@3pointer 3pointer added affects-5.4 This bug affects the 5.4.x(LTS) versions. affects-6.1 This bug affects the 6.1.x(LTS) versions. labels Oct 12, 2022
@lance6716
Copy link
Contributor Author

lance6716 commented Oct 13, 2022

/cc @lichunzhu

ptal

@ti-chi-bot ti-chi-bot requested a review from lichunzhu October 13, 2022 02:26
lichunzhu
lichunzhu approved these changes Oct 18, 2022
View reviewed changes
Copy link
Contributor

@lichunzhu lichunzhu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ti-chi-bot ti-chi-bot added status/LGT2 Indicates that a PR has LGTM 2. and removed status/LGT1 Indicates that a PR has LGTM 1. labels Oct 18, 2022
@lance6716
Copy link
Contributor Author

lance6716 commented Oct 18, 2022

/merge

@ti-chi-bot
Copy link
Member

ti-chi-bot commented Oct 18, 2022

This pull request has been accepted and is ready to merge.

DetailsCommit hash: f1fb540

@ti-chi-bot ti-chi-bot added the status/can-merge Indicates a PR has been approved by a committer. label Oct 18, 2022
niubell
niubell approved these changes Oct 18, 2022
View reviewed changes
Copy link
Contributor

@niubell niubell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@lance6716
Copy link
Contributor Author

lance6716 commented Oct 19, 2022

/run-mysql-test
/run-check_dev_2

@ti-chi-bot ti-chi-bot merged commit d037637 into pingcap:master Oct 19, 2022
@sre-bot
Copy link
Contributor

sre-bot commented Oct 19, 2022

TiDB MergeCI notify

🔴 Bad News! [2] CI still failing after this pr merged.
These failed integration tests don't seem to be introduced by the current PR.

CI Name Result Duration Compare with Parent commit
idc-jenkins-ci-tidb/integration-ddl-test 🔴 failed 1, success 5, total 6 28 min Existing failure
idc-jenkins-ci-tidb/integration-common-test 🔴 failed 2, success 15, total 17 10 min Existing failure
idc-jenkins-ci/integration-cdc-test 🟢 all 38 tests passed 22 min Existing passed
idc-jenkins-ci-tidb/common-test 🟢 all 11 tests passed 8 min 44 sec Existing passed
idc-jenkins-ci-tidb/tics-test 🟢 all 1 tests passed 5 min 41 sec Existing passed
idc-jenkins-ci-tidb/sqllogic-test-2 🟢 all 28 tests passed 4 min 35 sec Existing passed
idc-jenkins-ci-tidb/sqllogic-test-1 🟢 all 26 tests passed 4 min 20 sec Existing passed
idc-jenkins-ci-tidb/mybatis-test 🟢 all 1 tests passed 3 min 0 sec Existing passed
idc-jenkins-ci-tidb/integration-compatibility-test 🟢 all 1 tests passed 2 min 34 sec Existing passed
idc-jenkins-ci-tidb/plugin-test 🟢 build success, plugin test success 4min Existing passed

@lance6716
Copy link
Contributor Author

lance6716 commented Oct 19, 2022

/run-cherry-picker

@lance6716 lance6716 added needs-cherry-pick-release-5.4 Should cherry pick this PR to release-5.4 branch. needs-cherry-pick-release-6.1 Should cherry pick this PR to release-6.1 branch. labels Oct 19, 2022
@lance6716
Copy link
Contributor Author

lance6716 commented Oct 19, 2022

/run-cherry-picker

@ti-chi-bot ti-chi-bot mentioned this pull request Oct 19, 2022
Closed
12 tasks
@ti-chi-bot
Copy link
Member

ti-chi-bot commented Oct 19, 2022

In response to a cherrypick label: new pull request created: #38542.

ti-chi-bot pushed a commit to ti-chi-bot/tidb that referenced this pull request Oct 19, 2022
@lance6716 @ti-chi-bot
This is an automated cherry-pick of pingcap#38342
6d175df 
Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>
@ti-chi-bot ti-chi-bot mentioned this pull request Oct 19, 2022
Merged
12 tasks
@ti-chi-bot
Copy link
Member

ti-chi-bot commented Oct 19, 2022

In response to a cherrypick label: new pull request created: #38543.

ti-chi-bot pushed a commit to ti-chi-bot/tidb that referenced this pull request Oct 19, 2022
@lance6716 @ti-chi-bot
This is an automated cherry-pick of pingcap#38342
b1afbfd 
Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>
ti-chi-bot added a commit that referenced this pull request Nov 2, 2022
@ti-chi-bot
*: don't use DSN to avoid some security problems (#38342) (#38543)
dcc5cf7 
close #38541
@dwisiswant0
Copy link

dwisiswant0 commented Nov 4, 2022

Since it's already rolled out. Can you please give an update on 120f1346-e958-49d0-b66c-0f889a469540? Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kennytm kennytm kennytm approved these changes

@niubell niubell niubell approved these changes

+1 more reviewer

@lichunzhu lichunzhu lichunzhu approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

affects-5.4 This bug affects the 5.4.x(LTS) versions. affects-6.1 This bug affects the 6.1.x(LTS) versions. needs-cherry-pick-release-5.4 Should cherry pick this PR to release-5.4 branch. needs-cherry-pick-release-6.1 Should cherry pick this PR to release-6.1 branch. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. status/can-merge Indicates a PR has been approved by a committer. status/LGT2 Indicates that a PR has LGTM 2.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

should not use DSN to connect databases

8 participants

@lance6716 @ti-chi-bot @dwisiswant0 @sre-bot @kennytm @niubell @lichunzhu @3pointer