Skip to content

Commit 22e0c4d

Browse files
fjssilvafjssilva
committed
Fix for Bug#30866178, Not recommended default for 'allowLoadLocalInfile'. Back-port from Bug#94051 (29261254).
1 parent 13f06c3 commit 22e0c4d

7 files changed

+66
-24
lines changed

‎CHANGES

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33

44
Version 5.1.49
55

6+
- Fix for Bug#30866178, Not recommended default for 'allowLoadLocalInfile'. Back-port from Bug#94051 (29261254).
7+
68
- Fix for Bug#30657312, Disable external entities in Fabric's XML parser.
79

810
- Fix for Bug#96442 (30151808), INCORRECT DATE ERROR WHEN CALLING GETMETADATA ON PREPARED STATEMENT.

‎src/com/mysql/jdbc/ConnectionPropertiesImpl.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2002, 2018, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
33
44
The MySQL Connector/J is licensed under the terms of the GPLv2
55
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most MySQL Connectors.
@@ -668,7 +668,7 @@ protected static DriverPropertyInfo[] exposeAsDriverPropertyInfo(Properties info
668668
}).exposeAsDriverPropertyInfoInternal(info, slotsToReserve);
669669
}
670670

671-
private BooleanConnectionProperty allowLoadLocalInfile = new BooleanConnectionProperty("allowLoadLocalInfile", true,
671+
private BooleanConnectionProperty allowLoadLocalInfile = new BooleanConnectionProperty("allowLoadLocalInfile", false,
672672
Messages.getString("ConnectionProperties.loadDataLocal"), "3.0.3", SECURITY_CATEGORY, Integer.MAX_VALUE);
673673

674674
private BooleanConnectionProperty allowMultiQueries = new BooleanConnectionProperty("allowMultiQueries", false,

‎src/com/mysql/jdbc/LocalizedErrorMessages.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -455,7 +455,7 @@ ConnectionProperties.categorySecurity=Security
455455
# ConnectionProperty Descriptions
456456
#
457457

458-
ConnectionProperties.loadDataLocal=Should the driver allow use of 'LOAD DATA LOCAL INFILE...' (defaults to 'true').
458+
ConnectionProperties.loadDataLocal=Should the driver allow use of 'LOAD DATA LOCAL INFILE...'?
459459
ConnectionProperties.replicationEnableJMX=Enables JMX-based management of replication connection groups, including live slave promotion, addition of new slaves and removal of master or slave hosts from load-balanced master and slave connection pools.
460460
ConnectionProperties.replicationConnectionGroup=Logical group of replication connections within a classloader, used to manage different groups independently. If not specified, live management of replication connections is disabled.
461461
ConnectionProperties.allowMasterDownConnections=By default, a replication-aware connection will fail to connect when configured master hosts are all unavailable at initial connection. Setting this property to 'true' allows to establish the initial connection, by failing over to the slave servers, in read-only state. It won't prevent subsequent failures when switching back to the master hosts i.e. by setting the replication connection to read/write state.

‎src/testsuite/regression/ConnectionRegressionTest.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
33

44
The MySQL Connector/J is licensed under the terms of the GPLv2
55
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most MySQL Connectors.
@@ -4911,6 +4911,7 @@ public void testBug11237() throws Exception {
49114911
}
49124912

49134913
Properties props = new Properties();
4914+
props.put("allowLoadLocalInfile", "true");
49144915
props.put("useCompression", "true");
49154916
Connection conn1 = getConnectionWithProps(props);
49164917
Statement stmt1 = conn1.createStatement();
@@ -4919,7 +4920,6 @@ public void testBug11237() throws Exception {
49194920
+ CharsetMapping.getMysqlCharsetForJavaEncoding(((MySQLConnection) this.conn).getEncoding(), (com.mysql.jdbc.Connection) conn1));
49204921

49214922
assertTrue(updateCount == loops);
4922-
49234923
}
49244924

49254925
public void testStackOverflowOnMissingInterceptor() throws Exception {

‎src/testsuite/regression/StatementRegressionTest.java

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
33
44
The MySQL Connector/J is licensed under the terms of the GPLv2
55
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most MySQL Connectors.
@@ -2255,8 +2255,25 @@ public void testLoadData() throws Exception {
22552255
} else {
22562256
fileNameBuf = new StringBuilder(tempFile.getAbsolutePath());
22572257
}
2258+
final String fileName = fileNameBuf.toString();
2259+
2260+
assertThrows(SQLException.class,
2261+
versionMeetsMinimum(8, 0, 19) ? "Loading local data is disabled;.*" : "The used command is not allowed with this MySQL version",
2262+
new Callable<Void>() {
2263+
public Void call() throws Exception {
2264+
StatementRegressionTest.this.stmt
2265+
.executeUpdate("LOAD DATA LOCAL INFILE '" + fileName + "' INTO TABLE loadDataRegress CHARACTER SET "
2266+
+ CharsetMapping.getMysqlCharsetForJavaEncoding(((MySQLConnection) StatementRegressionTest.this.conn).getEncoding(),
2267+
(com.mysql.jdbc.Connection) StatementRegressionTest.this.conn));
2268+
return null;
2269+
}
2270+
});
22582271

2259-
int updateCount = this.stmt.executeUpdate("LOAD DATA LOCAL INFILE '" + fileNameBuf.toString() + "' INTO TABLE loadDataRegress CHARACTER SET "
2272+
Properties props = new Properties();
2273+
props.setProperty("allowLoadLocalInfile", "true");
2274+
Connection testConn = getConnectionWithProps(props);
2275+
int updateCount = testConn.createStatement().executeUpdate("LOAD DATA LOCAL INFILE '" + fileNameBuf.toString()
2276+
+ "' INTO TABLE loadDataRegress CHARACTER SET "
22602277
+ CharsetMapping.getMysqlCharsetForJavaEncoding(((MySQLConnection) this.conn).getEncoding(), (com.mysql.jdbc.Connection) this.conn));
22612278
assertTrue(updateCount == rowCount);
22622279
} finally {
@@ -8841,4 +8858,4 @@ public void testBug96442() throws Exception {
88418858

88428859
}
88438860

8844-
}
8861+
}

‎src/testsuite/simple/ConnectionTest.java

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
33
44
The MySQL Connector/J is licensed under the terms of the GPLv2
55
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most MySQL Connectors.
@@ -733,6 +733,7 @@ public void testLocalInfileWithUrl() throws Exception {
733733
createTable("testLocalInfileWithUrl", "(field1 LONGTEXT)");
734734

735735
Properties props = new Properties();
736+
props.setProperty("allowLoadLocalInfile", "true");
736737
props.setProperty("allowUrlInLocalInfile", "true");
737738

738739
Connection loadConn = getConnectionWithProps(props);
@@ -784,25 +785,40 @@ public void testLocalInfileWithUrl() throws Exception {
784785
public void testLocalInfileDisabled() throws Exception {
785786
createTable("testLocalInfileDisabled", "(field1 varchar(255))");
786787

787-
File infile = File.createTempFile("foo", "txt");
788+
final File infile = File.createTempFile("foo", "txt");
788789
infile.deleteOnExit();
789790
//String url = infile.toURL().toExternalForm();
790791
FileWriter output = new FileWriter(infile);
791792
output.write("Test");
792793
output.flush();
793794
output.close();
794795

795-
Connection loadConn = getConnectionWithProps(new Properties());
796+
// Test load local infile support disabled via client capabilities by default.
797+
assertThrows(SQLException.class,
798+
versionMeetsMinimum(8, 0, 19) ? "Loading local data is disabled;.*" : "The used command is not allowed with this MySQL version",
799+
new Callable<Void>() {
800+
public Void call() throws Exception {
801+
ConnectionTest.this.stmt.executeUpdate("LOAD DATA LOCAL INFILE '" + infile.getCanonicalPath() + "' INTO TABLE testLocalInfileDisabled");
802+
return null;
803+
}
804+
});
805+
806+
// Test load local infile support enabled via client capabilities but disabled on the connector.
807+
Properties props = new Properties();
808+
props.setProperty("allowLoadLocalInfile", "true");
809+
final Connection loadConn = getConnectionWithProps(props);
796810

797811
try {
798-
// have to do this after connect, otherwise it's the server that's enforcing it
799-
((com.mysql.jdbc.Connection) loadConn).setAllowLoadLocalInfile(false);
800-
try {
801-
loadConn.createStatement().execute("LOAD DATA LOCAL INFILE '" + infile.getCanonicalPath() + "' INTO TABLE testLocalInfileDisabled");
802-
fail("Should've thrown an exception.");
803-
} catch (SQLException sqlEx) {
804-
assertEquals(SQLError.SQL_STATE_GENERAL_ERROR, sqlEx.getSQLState());
805-
}
812+
// Must be set after connect, otherwise it's the server that's enforcing it.
813+
((ConnectionProperties) loadConn).setAllowLoadLocalInfile(false);
814+
815+
assertThrows(SQLException.class, "Server asked for stream in response to LOAD DATA LOCAL INFILE but functionality is disabled at client by "
816+
+ "'allowLoadLocalInfile' being set to 'false'\\.", new Callable<Void>() {
817+
public Void call() throws Exception {
818+
loadConn.createStatement().execute("LOAD DATA LOCAL INFILE '" + infile.getCanonicalPath() + "' INTO TABLE testLocalInfileDisabled");
819+
return null;
820+
}
821+
});
806822

807823
assertFalse(loadConn.createStatement().executeQuery("SELECT * FROM testLocalInfileDisabled").next());
808824
} finally {

‎src/testsuite/simple/StatementsTest.java

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright (c) 2002, 2018, Oracle and/or its affiliates. All rights reserved.
2+
Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
33
44
The MySQL Connector/J is licensed under the terms of the GPLv2
55
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>, like most MySQL Connectors.
@@ -1758,20 +1758,27 @@ public void testLocalInfileHooked() throws Exception {
17581758
createTable("localInfileHooked", "(field1 int, field2 varchar(255))");
17591759
String streamData = "1\tabcd\n2\tefgh\n3\tijkl";
17601760
InputStream stream = new ByteArrayInputStream(streamData.getBytes());
1761+
1762+
Properties props = new Properties();
1763+
props.setProperty("allowLoadLocalInfile", "true");
1764+
Connection testConn = getConnectionWithProps(props);
1765+
Statement testStmt = testConn.createStatement();
1766+
17611767
try {
1762-
((com.mysql.jdbc.Statement) this.stmt).setLocalInfileInputStream(stream);
1763-
this.stmt.execute("LOAD DATA LOCAL INFILE 'bogusFileName' INTO TABLE localInfileHooked CHARACTER SET "
1768+
((com.mysql.jdbc.Statement) testStmt).setLocalInfileInputStream(stream);
1769+
testStmt.execute("LOAD DATA LOCAL INFILE 'bogusFileName' INTO TABLE localInfileHooked CHARACTER SET "
17641770
+ CharsetMapping.getMysqlCharsetForJavaEncoding(((MySQLConnection) this.conn).getEncoding(), (com.mysql.jdbc.Connection) this.conn));
17651771
assertEquals(-1, stream.read());
1766-
this.rs = this.stmt.executeQuery("SELECT field2 FROM localInfileHooked ORDER BY field1 ASC");
1772+
this.rs = testStmt.executeQuery("SELECT field2 FROM localInfileHooked ORDER BY field1 ASC");
17671773
this.rs.next();
17681774
assertEquals("abcd", this.rs.getString(1));
17691775
this.rs.next();
17701776
assertEquals("efgh", this.rs.getString(1));
17711777
this.rs.next();
17721778
assertEquals("ijkl", this.rs.getString(1));
17731779
} finally {
1774-
((com.mysql.jdbc.Statement) this.stmt).setLocalInfileInputStream(null);
1780+
((com.mysql.jdbc.Statement) testStmt).setLocalInfileInputStream(null);
1781+
testConn.close();
17751782
}
17761783
}
17771784
}

0 commit comments

Comments
 (0)