MXS-2457 Allow strings to be treated as fields

Before this change, if the firewall was configured to block the use
of certain columns, it could be be bypassed simply by

        > set @@sql_mode='ANSI_QUOTES';
        > select "ssn" from person;

The reason is that as the query classifier is not aware of whether
'ANSI_QUOTES' is on or not, it will not know that what above appears
to be the string "ssn", actually is the field name `ssn`. Consequently,
the select will not be blocked and the result returned in cleartext.

It's now possible to instruct the query classifier to report all strings
as fields, which will prevent the above. However, it will also mean that
there may be false positives.
This commit is contained in:
Johan Wikman
2019-05-03 08:58:56 +03:00
parent fe5160a714
commit 4aa8eac799
3 changed files with 48 additions and 4 deletions

View File

@ -36,9 +36,10 @@ typedef enum qc_init_kind
enum qc_option_t
{
QC_OPTION_STRING_ARG_AS_FIELD = (1 << 0), /*< Report a string argument to a function as a field. */
QC_OPTION_STRING_AS_FIELD = (1 << 1), /*< Report strings as fields. */
};
const uint32_t QC_OPTION_MASK = QC_OPTION_STRING_ARG_AS_FIELD;
const uint32_t QC_OPTION_MASK = QC_OPTION_STRING_ARG_AS_FIELD | QC_OPTION_STRING_AS_FIELD;
/**
* qc_sql_mode_t specifies what should be assumed of the statements