Percona Server moved to https://jira.percona.com/projects/PS

Revert our fixes for bug 1049871, bug 1175519, bug 1223196, and bug 1277351

Bug #1208371 reported by Laurynas Biveinis
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Percona Server moved to https://jira.percona.com/projects/PS
Fix Released
Medium
Laurynas Biveinis
Percona Server moved to https://jira.percona.com/projects/PS 5.6.20-68.0
5.1
Invalid
Undecided
Unassigned
5.5
Won't Fix
Medium
Unassigned
5.6
Fix Released
Medium
Laurynas Biveinis
Percona Server moved to https://jira.percona.com/projects/PS 5.6.20-68.0

Bug Description

In MySQL 5.5.33, the upstream bugs http://bugs.mysql.com/bug.php?id=66550, http://bugs.mysql.com/bug.php?id=68045, http://bugs.mysql.com/bug.php?id=69124 (bug 1049871 and bug 1175519 for us) finally appear to be fixed.

Thus revert the MariaDB fix but keep its testcase rpl_mdev382.

Related branches

lp:~laurynas-biveinis/percona-server/bug1208371
Laurynas Biveinis (community): Approve
Diff: 1997 lines (+459/-572)
23 files modified
client/sql_string.cc (+0/-44)
client/sql_string.h (+0/-10)
mysql-test/suite/rpl/r/rpl_mdev382.result (+0/-2)
sql/binlog.cc (+8/-6)
sql/ha_ndbcluster_binlog.cc (+31/-17)
sql/item.cc (+0/-16)
sql/item.h (+0/-4)
sql/item_func.cc (+2/-2)
sql/item_func.h (+1/-1)
sql/log_event.cc (+225/-260)
sql/log_event.h (+25/-28)
sql/log_event_old.cc (+1/-1)
sql/log_event_old.h (+1/-1)
sql/sql_base.cc (+15/-31)
sql/sql_db.cc (+42/-21)
sql/sql_load.cc (+43/-32)
sql/sql_select.cc (+0/-1)
sql/sql_show.cc (+39/-7)
sql/sql_show.h (+1/-1)
sql/sql_string.cc (+10/-61)
sql/sql_string.h (+0/-10)
sql/sql_truncate.cc (+14/-15)
sql/sql_yacc.yy (+1/-1)
Laurynas Biveinis (laurynas-biveinis)
tags: added: merge-regression
Revision history for this message
Laurynas Biveinis (laurynas-biveinis) wrote :

Valerii -

Did you set 5.6 from New to Confirmed because you verified the referenced bugfixes on MySQL 5.6.13?

Revision history for this message
Valerii Kravchuk (valerii-kravchuk) wrote :

No, this happened because I've noted 5.6.13-60.5 as a target milestone, checked that https://bugs.launchpad.net/percona-server/+bug/1175519 actually had fixes both in 5.5 and 5.6, and because of general Oracle policy to release fixes for "security" bugs in all versions affected at the same time (that's why their releases recently go in 5.1, 5.5 and 5.6 bathces every two months).

I know that SQL injection based on LOAD DATA is fixed in 5.5.33 (from Ovais) and thus I assumed it is fixed in upstream 5.6.13 as well. I probably had to doublecheck and test 5.6.13 myself using test case from the bug above. I am doing this now and will share results soon.

Revision history for this message
Valerii Kravchuk (valerii-kravchuk) wrote :
Download full text (5.7 KiB)

From a quick test I'd say it is fixed:

C:\Program Files\MySQL\MySQL Server 5.5\bin>mysql -uroot -proot -P3314 test < p:
\percona\1175519.sql
a b
| 123456789A123456789B123456789C123456789D123456789E123456789F123456789G12345678
 9H123456789I123456789J123456789K123456789L123456789M123456789N123456789O12345678
9P123456789Q123456789R123456789123456789T123456789U123456789V123456789W123456789
X123456789Y123456789Z123456789|X
| 123456789A123456789B123456789C123456789D123456789E123456789F123456789G12345678
 9H123456789I123456789J123456789K123456789L123456789M123456789N123456789O12345678
9P123456789Q123456789R123456789123456789T123456789U123456789V123456789W123456789
X123456789Y123456789Z123456789|A
a b
| 123456789A123456789B123456789C123456789D123456789E123456789F123456789G12345678
 9H123456789I123456789J123456789K123456789L123456789M123456789N123456789O12345678
9P123456789Q123456789R123456789123456789T123456789U123456789V123456789W123456789
X123456789Y123456789Z123456789|X
| 123456789A123456789B123456789C123456789D123456789E123456789F123456789G12345678
 9H123456789I123456789J123456789K123456789L123456789M123456789N123456789O12345678
9P123456789Q123456789R123456789123456789T123456789U123456789V123456789W123456789
X123456789Y123456789Z123456789|A
100 '); CREATE TABLE t_sql_injection(a INT PRIMARY KEY);
Tables_in_test
t1
VERSION()
5.6.13-log

C:\Program Files\MySQL\MySQL Server 5.5\bin>cd "..\..\MySQL Server 5.6"\bin

...

C:\Program Files\MySQL\MySQL Server 5.6\bin>mysqlbinlog -uroot -proot "c:\Progra
mData\MySQL\MySQL Server 5.6\data\pc-PC-bin.000002"
Warning: Using a password on the command line interface can be insecure.
/*!50530 SET @@SESSION.PSEUDO_SLAVE_MODE=1*/;
/*!40019 SET @@session.max_insert_delayed_threads=0*/;
/*!50003 SET @OLD_COMPLETION_TYPE=@@COMPLETION_TYPE,COMPLETION_TYPE=0*/;
DELIMITER /*!*/;
# at 4
#130805 19:48:22 server id 1 end_log_pos 120 CRC32 0xad9719c9 Start: binlog v
4, server v 5.6.13-log created 130805 19:48:22
BINLOG '
Vtf/UQ8BAAAAdAAAAHgAAAAAAAQANS42LjEzLWxvZwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAEzgNAAgAEgAEBAQEEgAAXAAEGggAAAAICAgCAAAACgoKGRkAAckZ
l60=
'/*!*/;
# at 120
#130805 19:48:23 server id 1 end_log_pos 246 CRC32 0x4a956458 Query thread_i
d=2 exec_time=0 error_code=0
use `test`/*!*/;
SET TIMESTAMP=1375721303/*!*/;
SET @@session.pseudo_thread_id=2/*!*/;
SET @@session.foreign_key_checks=1, @@session.sql_auto_is_null=0, @@session.uniq
ue_checks=1, @@session.autocommit=1/*!*/;
SET @@session.sql_mode=1344274432/*!*/;
SET @@session.auto_increment_increment=1, @@session.auto_increment_offset=1/*!*/
;
/*!\C utf8 *//*!*/;
SET @@session.character_set_client=33,@@session.collation_connection=33,@@sessio
n.collation_server=33/*!*/;
SET @@session.lc_time_names=0/*!*/;
SET @@session.collation_database=DEFAULT/*!*/;
CREATE TABLE t1 (a INT PRIMARY KEY, b VARCHAR(1000))
/*!*/;
# at 246
#130805 19:48:23 server id 1 end_log_pos 325 CRC32 0xee147dd9 Query thread_i
d=2 exec_time=0 error_code=0
SET TIMESTAMP=1375721303/*!*/;
BEGIN
/*!*/;
# at 325
#130805 19:48:23 server id 1 end_log_pos 362 CRC32 0x4bf77064
#Begin_load_query: file_id: 1 block_len: 10
# at 362
#130805 19:48:2...

Read more...

Revision history for this message
Valerii Kravchuk (valerii-kravchuk) wrote :

The other bug, https://bugs.launchpad.net/percona-server/+bug/1049871, had not list 5.6 at all, so I had not checked it.

Revision history for this message
Vlad Lesin (vlad-lesin) wrote :

The bug #1049871 is not fixed as there are multiple failed cases when running rpl_mdev382.

The bug #1175519 is fixed but with bug. I wrote mtr test to illustrate the bug and attached the test files to this comment. Just unpack the test files into mysql-5.5.33 source directory and run "./mtr rpl_bug-16753869". Here is the difference between original result and generated one:

--- /home/vlesin/src/work/tmp/mysql-5.5.33/mysql-test/suite/rpl/r/rpl_bug-16753869.result 2013-08-26 14:16:25.816554708 +0300
+++ /home/vlesin/src/work/tmp/mysql-5.5.33/mysql-test/suite/rpl/r/rpl_bug-16753869.reject 2013-08-26 14:16:39.724554040 +0300
@@ -18,7 +18,7 @@
 /*!*/;
 use `test`/*!*/;
 SET TIMESTAMP=1000000000/*!*/;
-LOAD DATA LOCAL INFILE '<name>' INTO TABLE `t1` FIELDS TERMINATED BY ',' ENCLOSED BY '\'' ESCAPED BY '\\' LINES TERMINATED BY '\n' (@`a1`, @`b1`)
SET `a`= @`a1`, `b`= @`b1`
+LOAD DATA LOCAL INFILE '<name>' INTO TABLE `t1` FIELDS TERMINATED BY ',' ENCLOSED BY '\'' ESCAPED BY '\\' LINES TERMINATED BY '\n' (@`a1`, @`b1`)
SET `a`= @`a1`, `b` = @`b1`, `b`= @`b1`
 /*!*/;
 COMMIT/*!*/;
 DELIMITER ;

As it can be seen `b` = @`b1` is repeated twice in "LOAD DATA" statement in binlog.

Revision history for this message
Laurynas Biveinis (laurynas-biveinis) wrote :

Vlad -

1) What are the multiple failing cases for bug 1049871?

2) Can you please log a new bug in the upstream bug db and copy to our bug db?

Revision history for this message
Vlad Lesin (vlad-lesin) wrote :

Upstream bug report on LOAD DATA ... SET ... bug is here http://bugs.mysql.com/bug.php?id=70277 .

Revision history for this message
Laurynas Biveinis (laurynas-biveinis) wrote :

This bug will be reopened and the fixes reverted once the upstream fix is complete.

Revision history for this message
Vlad Lesin (vlad-lesin) wrote :
Download full text (3.9 KiB)

Laurynas asked:
> 1) What are the multiple failing cases for bug 1049871?

I have attached rpl_mdev382 test with modified .result file. Modifications were required because include/show_binlog_events.inc issues different messages to result file in PS-5.6 and mysql-5.5.33. Here is the difference between .reject and .result file with my comments:

@@ -24,6 +24,8 @@
 master-bin.000001 # Query # # BEGIN
 master-bin.000001 # Query # # use `test`; insert into t1 values (1)
 master-bin.000001 # Query # # SAVEPOINT "a`; create database couldbebadthingshere; savepoint `dummy"
+master-bin.000001 # Query # # use `test`; insert into t1 values (2)
+master-bin.000001 # Query # # ROLLBACK TO `a``; create database couldbebadthingshere; savepoint ``dummy`
 master-bin.000001 # Query # # use `test`; insert into t1 values (3)
 master-bin.000001 # Xid # # COMMIT /* XID */
 BEGIN;

I don't think this is a bug at all, most likely PS-5.6 and MySQL-5.5.33 have different algorithms to push such events to binlog.

@@ -145,12 +147,12 @@
 `c``3` VARCHAR(7))
 master-bin.000001 # Query # # BEGIN
 master-bin.000001 # Begin_load_query # # ;file_id=#;block_len=#
-master-bin.000001 # Execute_load_query # # use `db1``; SELECT 'oops!'`; LOAD DATA INFILE 'MYSQLTEST_VARDIR/tmp/f\'le.txt' INTO TABLE `t``1` FIELDS TERMINATED BY ',' ENCLOSED BY '\'' ESCAPED BY '\\' LINES TERMINATED BY '\n' (`a``1`, @`b```) SET `b``2`= @`b```, `c``3`= concat('|', "b""a'z", "!") ;file_id=#
+master-bin.000001 # Execute_load_query # # use `db1``; SELECT 'oops!'`; LOAD DATA INFILE 'MYSQLTEST_VARDIR/tmp/f'le.txt' INTO TABLE `t``1` FIELDS TERMINATED BY ',' ENCLOSED BY '\'' ESCAPED BY '\\' LINES TERMINATED BY '\n' (`a``1`, @`b```) SET `b``2`= @`b```, `c``3` = concat('|', "b""a'z", "!"), `c``3`= concat('|', "b""a'z", "!") ;file_id=#

Except this http://bugs.mysql.com/bug.php?id=70277 bug MySQL-5.5.33 does not escape this
MYSQLTEST_VARDIR/tmp/f'le.txt path in right way.

 master-bin.000001 # Xid # # COMMIT /* XID */
 master-bin.000001 # Query # # use `db1``; SELECT 'oops!'`; truncate `t``1`
 master-bin.000001 # Query # # BEGIN
 master-bin.000001 # Begin_load_query # # ;file_id=#;block_len=#
-master-bin.000001 # Execute_load_query # # use `test`; LOAD DATA INFILE 'MYSQLTEST_VARDIR/tmp/f\'le.txt' INTO TABLE `db1``; SELECT 'oops!'`.`t``1` FIELDS TERMINATED BY ',' ENCLOSED BY '\'' ESCAPED BY '\\' LINES TERMINATED BY '\n' (`a``1`, `b``2`) SET `c``3`= concat('|', "b""a'z", "!") ;file_id=#
+master-bin.000001 # Execute_load_query # # use `test`; LOAD DATA INFILE 'MYSQLTEST_VARDIR/tmp/f'le.txt' INTO TABLE `db1``; SELECT 'oops!'`.`t``1` FIELDS TERMINATED BY ',' ENCLOSED BY '\'' ESCAPED BY '\\' LINES TERMINATED BY '\n' (`a``1`, `b``2`) SET `c``3`= concat('|', "b""a'z", "!") ;fil...

Read more...

Revision history for this message
Laurynas Biveinis (laurynas-biveinis) wrote :

Upstream has fixed http://bugs.mysql.com/bug.php?id=70277 / https://bugs.launchpad.net/percona-server/+bug/1223196 in 5.5.35 / 5.6.15.

Thus it's time again to verify their fixes for https://bugs.launchpad.net/percona-server/+bug/1223196, https://bugs.launchpad.net/percona-server/+bug/1049871, and https://bugs.launchpad.net/percona-server/+bug/1083377, and either revert ours, either report more bugs upstream.

summary: - Revert our fixes for bug 1049871 and bug 1175519
+ Revert our fixes for bug 1049871, bug 1175519, and bug 1223196
Revision history for this message
Vlad Lesin (vlad-lesin) wrote : Re: Revert our fixes for bug 1049871, bug 1175519, and bug 1223196

Laurynas, there is still unfixed bug http://bugs.mysql.com/bug.php?id=71603 which is detected with modified rpl_mdev382 I attached earlier.

Revision history for this message
Laurynas Biveinis (laurynas-biveinis) wrote :

Amazing.

Temporarily closing the bug again until the upstream fixes 71603.

summary: - Revert our fixes for bug 1049871, bug 1175519, and bug 1223196
+ Revert our fixes for bug 1049871, bug 1175519, bug 1223196, and bug
+ 1277351
Revision history for this message
Laurynas Biveinis (laurynas-biveinis) wrote :

Reverting the fixes now and fixing 71603 on the top of revert as needed.

Revision history for this message
Shahriyar Rzayev (rzayev-sehriyar) wrote :

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-120

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.