MXS-2457 Allow strings to be treated as fields
Before this change, if the firewall was configured to block the use
of certain columns, it could be be bypassed simply by
> set @@sql_mode='ANSI_QUOTES';
> select "ssn" from person;
The reason is that as the query classifier is not aware of whether
'ANSI_QUOTES' is on or not, it will not know that what above appears
to be the string "ssn", actually is the field name `ssn`. Consequently,
the select will not be blocked and the result returned in cleartext.
It's now possible to instruct the query classifier to report all strings
as fields, which will prevent the above. However, it will also mean that
there may be false positives.
This commit is contained in:
@ -36,9 +36,10 @@ typedef enum qc_init_kind
|
||||
enum qc_option_t
|
||||
{
|
||||
QC_OPTION_STRING_ARG_AS_FIELD = (1 << 0), /*< Report a string argument to a function as a field. */
|
||||
QC_OPTION_STRING_AS_FIELD = (1 << 1), /*< Report strings as fields. */
|
||||
};
|
||||
|
||||
const uint32_t QC_OPTION_MASK = QC_OPTION_STRING_ARG_AS_FIELD;
|
||||
const uint32_t QC_OPTION_MASK = QC_OPTION_STRING_ARG_AS_FIELD | QC_OPTION_STRING_AS_FIELD;
|
||||
|
||||
/**
|
||||
* qc_sql_mode_t specifies what should be assumed of the statements
|
||||
|
||||
Reference in New Issue
Block a user