Skip to content

Commit 2eaabf0

Browse files
marinesovitchmarinesovitch
committed
security fix - by default 'local infile' is disabled:
- set default for mysqli.allow_local_infile=0 - explicitly disable PDO::MYSQL_ATTR_LOCAL_INFILE in case of lack of driver options - add getAttribute support for PDO::MYSQL_ATTR_LOCAL_INFILE - update existing tests where needed - add new tests [checking default value and setting on] the 'local infile' in ext/mysqli and ext/pdo_mysql
1 parent 65d8183 commit 2eaabf0

18 files changed

+148
-6
lines changed

‎NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? 2019, PHP 7.1.27
44

5+
- MySQL
6+
. Disabled LOCAL INFILE by default, can be enabled using php.ini directive
7+
mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE
8+
attribute for pdo_mysql. (Darek Slusarczyk)
59

610
10 Jan 2019, PHP 7.1.26
711

‎ext/mysqli/mysqli.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -524,7 +524,7 @@ PHP_INI_BEGIN()
524524
STD_PHP_INI_ENTRY("mysqli.default_socket", NULL, PHP_INI_ALL, OnUpdateStringUnempty, default_socket, zend_mysqli_globals, mysqli_globals)
525525
#endif
526526
STD_PHP_INI_BOOLEAN("mysqli.reconnect", "0", PHP_INI_SYSTEM, OnUpdateLong, reconnect, zend_mysqli_globals, mysqli_globals)
527-
STD_PHP_INI_BOOLEAN("mysqli.allow_local_infile", "1", PHP_INI_SYSTEM, OnUpdateLong, allow_local_infile, zend_mysqli_globals, mysqli_globals)
527+
STD_PHP_INI_BOOLEAN("mysqli.allow_local_infile", "0", PHP_INI_SYSTEM, OnUpdateLong, allow_local_infile, zend_mysqli_globals, mysqli_globals)
528528
PHP_INI_END()
529529
/* }}} */
530530

@@ -549,7 +549,7 @@ static PHP_GINIT_FUNCTION(mysqli)
549549
mysqli_globals->reconnect = 0;
550550
mysqli_globals->report_mode = 0;
551551
mysqli_globals->report_ht = 0;
552-
mysqli_globals->allow_local_infile = 1;
552+
mysqli_globals->allow_local_infile = 0;
553553
#ifdef HAVE_EMBEDDED_MYSQLI
554554
mysqli_globals->embedded = 1;
555555
#else

‎ext/mysqli/tests/061.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ if ($msg = check_local_infile_support($link, $engine))
1717

1818
mysqli_close($link);
1919
?>
20+
--INI--
21+
mysqli.allow_local_infile=1
2022
--FILE--
2123
<?php
2224
require_once("connect.inc");

‎ext/mysqli/tests/bug36745.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ Bug #36745 (LOAD DATA LOCAL INFILE doesn't return correct error message)
55
require_once('skipif.inc');
66
require_once('skipifconnectfailure.inc');
77
?>
8+
--INI--
9+
mysqli.allow_local_infile=1
810
--FILE--
911
<?php
1012
require_once("connect.inc");

‎ext/mysqli/tests/bug53503.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ if ($msg = check_local_infile_support($link, $engine))
1515
mysqli_close($link);
1616

1717
?>
18+
--INI--
19+
mysqli.allow_local_infile=1
1820
--FILE--
1921
<?php
2022
require_once("connect.inc");

‎ext/mysqli/tests/bug68077.phpt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ if ($msg = check_local_infile_support($link, $engine))
1717
mysqli_close($link);
1818
?>
1919
--INI--
20+
mysqli.allow_local_infile=1
21+
mysqli.allow_persistent=1
22+
mysqli.max_persistent=1
2023
open_basedir=
2124
--FILE--
2225
<?php

‎ext/mysqli/tests/mysqli_constants.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ require_once('skipif.inc');
66
require_once('skipifemb.inc');
77
require_once('skipifconnectfailure.inc');
88
?>
9+
--INI--
10+
mysqli.allow_local_infile=1
911
--FILE--
1012
<?php
1113
require("connect.inc");

‎ext/mysqli/tests/mysqli_get_client_stats.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ if (!function_exists('mysqli_get_client_stats')) {
1212
--INI--
1313
mysqlnd.collect_statistics=1
1414
mysqlnd.collect_memory_statistics=1
15+
mysqli.allow_local_infile=1
1516
--FILE--
1617
<?php
1718
/*

‎ext/mysqli/tests/mysqli_info.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ require_once('skipif.inc');
66
require_once('skipifemb.inc');
77
require_once('skipifconnectfailure.inc');
88
?>
9+
--INI--
10+
mysqli.allow_local_infile=1
911
--FILE--
1012
<?php
1113
require_once("connect.inc");

‎ext/mysqli/tests/mysqli_local_infile_default_off.phpt

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
ensure default for local infile is off
3+
--SKIPIF--
4+
<?php
5+
require_once('skipif.inc');
6+
require_once('skipifconnectfailure.inc');
7+
?>
8+
--FILE--
9+
<?php
10+
require_once("connect.inc");
11+
12+
$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
13+
$res = mysqli_query($link, 'SHOW VARIABLES LIKE "local_infile"');
14+
$row = mysqli_fetch_assoc($res);
15+
echo "server: ", $row['Value'], "\n";
16+
mysqli_free_result($res);
17+
mysqli_close($link);
18+
19+
echo "connector: ", ini_get("mysqli.allow_local_infile"), "\n";
20+
21+
print "done!\n";
22+
?>
23+
--EXPECTF--
24+
server: %s
25+
connector: 0
26+
done!

‎ext/mysqli/tests/mysqli_local_infile_set_on.phpt

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
enable local infile
3+
--SKIPIF--
4+
<?php
5+
require_once('skipif.inc');
6+
require_once('skipifconnectfailure.inc');
7+
?>
8+
--INI--
9+
mysqli.allow_local_infile=1
10+
--FILE--
11+
<?php
12+
require_once("connect.inc");
13+
14+
$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
15+
$res = mysqli_query($link, 'SHOW VARIABLES LIKE "local_infile"');
16+
$row = mysqli_fetch_assoc($res);
17+
echo "server: ", $row['Value'], "\n";
18+
mysqli_free_result($res);
19+
mysqli_close($link);
20+
21+
echo "connector: ", ini_get("mysqli.allow_local_infile"), "\n";
22+
23+
print "done!\n";
24+
?>
25+
--EXPECTF--
26+
server: %s
27+
connector: 1
28+
done!

‎ext/mysqli/tests/mysqli_real_connect.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ require_once('skipif.inc');
66
require_once('skipifemb.inc');
77
require_once('skipifconnectfailure.inc');
88
?>
9+
--INI--
10+
mysqli.allow_local_infile=1
911
--FILE--
1012
<?php
1113
include("connect.inc");

‎ext/mysqli/tests/mysqli_real_connect_pconn.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ if (!$IS_MYSQLND)
1010
die("skip mysqlnd only test");
1111
?>
1212
--INI--
13+
mysqli.allow_local_infile=1
1314
mysqli.allow_persistent=1
1415
mysqli.max_persistent=10
1516
--FILE--

‎ext/mysqlnd/mysqlnd_connection.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -489,7 +489,8 @@ MYSQLND_METHOD(mysqlnd_conn_data, get_updated_connect_flags)(MYSQLND_CONN_DATA *
489489
MYSQLND_VIO * vio = conn->vio;
490490

491491
DBG_ENTER("mysqlnd_conn_data::get_updated_connect_flags");
492-
/* we allow load data local infile by default */
492+
/* allow CLIENT_LOCAL_FILES capability, although extensions basing on mysqlnd
493+
shouldn't allow 'load data local infile' by default due to security issues */
493494
mysql_flags |= MYSQLND_CAPABILITIES;
494495

495496
mysql_flags |= conn->options->flags; /* use the flags from set_client_option() */

‎ext/pdo_mysql/mysql_driver.c

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -467,6 +467,12 @@ static int pdo_mysql_get_attribute(pdo_dbh_t *dbh, zend_long attr, zval *return_
467467
case PDO_MYSQL_ATTR_MAX_BUFFER_SIZE:
468468
ZVAL_LONG(return_value, H->max_buffer_size);
469469
break;
470+
#else
471+
case PDO_MYSQL_ATTR_LOCAL_INFILE:
472+
ZVAL_BOOL(
473+
return_value,
474+
(H->server->data->options->flags & CLIENT_LOCAL_FILES) == CLIENT_LOCAL_FILES);
475+
break;
470476
#endif
471477

472478
default:
@@ -746,6 +752,15 @@ static int pdo_mysql_handle_factory(pdo_dbh_t *dbh, zval *driver_options)
746752
CLIENT_SSL_DONT_VERIFY_SERVER_CERT;
747753
}
748754
}
755+
#endif
756+
} else {
757+
#if defined(MYSQL_OPT_LOCAL_INFILE) || defined(PDO_USE_MYSQLND)
758+
// in case there are no driver options disable 'local infile' explicitly
759+
zend_long local_infile = 0;
760+
if (mysql_options(H->server, MYSQL_OPT_LOCAL_INFILE, (const char *)&local_infile)) {
761+
pdo_mysql_error(dbh);
762+
goto cleanup;
763+
}
749764
#endif
750765
}
751766

‎ext/pdo_mysql/tests/pdo_mysql___construct_options.phpt

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ MySQLPDOTest::skip();
1919
try {
2020
$db = new PDO($dsn, $user, $pass, array($option => $value));
2121
if (!is_object($db) || ($value !== ($tmp = @$db->getAttribute($option))))
22-
printf("[%03d] Execting '%s'/%s got '%s'/%s' for options '%s'\n",
22+
printf("[%03d] Expecting '%s'/%s got '%s'/%s' for options '%s'\n",
2323
$offset,
2424
$value, gettype($value),
2525
$tmp, gettype($tmp),
@@ -172,8 +172,7 @@ MySQLPDOTest::skip();
172172
[016] PDO::MYSQL_ATTR_DIRECT_QUERY should be on
173173
[017] PDO::ATTR_EMULATE_PREPARES should be off
174174
[018] PDO::MYSQL_ATTR_DIRECT_QUERY should be off
175-
[021] Execting '1'/boolean got ''/boolean' for options 'PDO::MYSQL_ATTR_LOCAL_INFILE'
176-
[023] Execting 'SET @a=1'/string got ''/boolean' for options 'PDO::MYSQL_ATTR_INIT_COMMAND'
175+
[023] Expecting 'SET @a=1'/string got ''/boolean' for options 'PDO::MYSQL_ATTR_INIT_COMMAND'
177176
[024] SQLSTATE[42000] [1065] Query was empty
178177
[025] SQLSTATE[42S02] [1146] Table '%s.nonexistent' doesn't exist
179178
done!

‎ext/pdo_mysql/tests/pdo_mysql_local_infile_default_off.phpt

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
ensure default for local infile is off
3+
--SKIPIF--
4+
<?php
5+
require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
6+
require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
7+
MySQLPDOTest::skip();
8+
if (!MYSQLPDOTest::isPDOMySQLnd())
9+
die("skip mysqlnd only test");
10+
?>
11+
--FILE--
12+
<?php
13+
require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'config.inc');
14+
require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
15+
16+
$dsn = MySQLPDOTest::getDSN();
17+
$user = PDO_MYSQL_TEST_USER;
18+
$pass = PDO_MYSQL_TEST_PASS;
19+
20+
$db = new PDO($dsn, $user, $pass);
21+
echo var_export($db->getAttribute(PDO::MYSQL_ATTR_LOCAL_INFILE)), "\n";
22+
echo "done!\n";
23+
?>
24+
--EXPECTF--
25+
false
26+
done!

‎ext/pdo_mysql/tests/pdo_mysql_local_infile_set_on.phpt

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
enable local infile
3+
--SKIPIF--
4+
<?php
5+
require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
6+
require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
7+
MySQLPDOTest::skip();
8+
if (!MYSQLPDOTest::isPDOMySQLnd())
9+
die("skip mysqlnd only test");
10+
?>
11+
--FILE--
12+
<?php
13+
require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'config.inc');
14+
require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
15+
16+
$dsn = MySQLPDOTest::getDSN();
17+
$user = PDO_MYSQL_TEST_USER;
18+
$pass = PDO_MYSQL_TEST_PASS;
19+
20+
$db = new PDO($dsn, $user, $pass, array(PDO::MYSQL_ATTR_LOCAL_INFILE => true));
21+
echo var_export($db->getAttribute(PDO::MYSQL_ATTR_LOCAL_INFILE)), "\n";
22+
echo "done!\n";
23+
?>
24+
--EXPECTF--
25+
true
26+
done!

0 commit comments

Comments
 (0)