db: relation creation fails when charm name is > 16 characters

[Wouter van Bommel]

When a database relation is created, the databasename and username for the entry are based on the name of the charm requesting the relation. Charm names are user defined.

See #647 in hooks/percona_hooks.py

The problem is that the username is limited to 16 characters, which is not taken into account. The other issue is, that limiting the username to 16 chars will result in conflicts if multiple charms have the same 16 starting letters.

The lack of input validation might leave a window for sql injection, based on the naming of the charm that requests a relation to be created.

Looking to the regular mysql charm, they use a randomly generated string for the username, which should be perfectly fine.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/606202

[Wouter van Bommel (woutervb)]

Subscribed field-medium

[Ryan Beisner (1chb1n)]

Please see the reviews in gerrit. But to bring over the outstanding question to this bug:

I agree with Chris - what is the expected behavior during a charm upgrade, where a pre-existing deployment's charm is upgraded to this proposed charm? Has that been tested?

[James Page (james-page)]

TBH in the context of OpenStack this change makes no difference - the OS charms all use the shared-db relation, not the db relation which this change impacts.

shared-db uses a username provided by the remote service requesting setup and configuration of a new DB.

[James Page (james-page)]

@woutervb which charms are making use of the db relation and have this particular issue?

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Alex Kavanagh <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/charm-percona-cluster/+/606202
Reason: The review is stale; there's been no further work from the OP following the review comments. If this is still required, then please re-open the review.

[Alex Kavanagh (ajkavanagh)]

Triaging to Won't fix, as the percona-cluster charm is now in maintenance mode. However, if this fix is still needed then please comment as to why it should be re-opened.