hcq/MaxScale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MXS-2457 Allow strings to be treated as fields

Browse Source 
Before this change, if the firewall was configured to block the use
of certain columns, it could be be bypassed simply by

        > set @@sql_mode='ANSI_QUOTES';
        > select "ssn" from person;

The reason is that as the query classifier is not aware of whether
'ANSI_QUOTES' is on or not, it will not know that what above appears
to be the string "ssn", actually is the field name `ssn`. Consequently,
the select will not be blocked and the result returned in cleartext.

It's now possible to instruct the query classifier to report all strings
as fields, which will prevent the above. However, it will also mean that
there may be false positives.
This commit is contained in:
Johan Wikman
2019-05-03 08:58:56 +03:00
parent fe5160a714
commit 4aa8eac799
3 changed files with 48 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
query_classifier/qc_sqlite/qc_sqlite.cc
View File

@ -832,6 +832,14 @@ public:
update_field_infos_from_expr(pAliases, context, pExpr, pExclude);
break;
case TK_STRING: // select "a" ..., for @@sql_mode containing 'ANSI_QUOTES'
if (this_thread.options & QC_OPTION_STRING_AS_FIELD)
{
const char* zColumn = pExpr->u.zToken;
update_field_infos_from_column(pAliases, context, zColumn, pExclude);
}
break;
case TK_VARIABLE:
{
if (zToken[0] == '@')
@ -1184,6 +1192,17 @@ public:
}
}
void update_field_infos_from_column(QcAliases* pAliases,
uint32_t context,
const char* zColumn,
const ExprList* pExclude)
{
if (must_check_sequence_related_functions() || must_collect_fields())
{
update_field_info(pAliases, context, nullptr, nullptr, zColumn, pExclude);
}
}
void update_field_infos_from_exprlist(QcAliases* pAliases,
uint32_t context,
const ExprList* pEList,