Last modified: 2014-08-29 19:15:37 UTC
Currently DatabaseMysql::addIdentifierQuotes() uses mysql_real_escape_string() via strencode() but that is incorrect, as mysql_real_escape_string() does not escape backticks (`). See: http://dev.mysql.com/doc/refman/5.6/en/identifiers.html Section that starts with "Identifier quote characters can be included within an identifier if you quote the identifier."
Thanks for the bug report!
I need to look into this a little more, but I'm marking it a security bug for now.
Created attachment 11201 [details] Escape ` characters in identifiers I haven't yet seen any code that passes user-controlled data into the table or field names, but this will prevent an attacks of this type, if someone ever does something like that.
Comment on attachment 11201 [details] Escape ` characters in identifiers Not sure that any escaping added by strencode()/mysql_real_escape_string() will ever be unescaped by mysql's lexer. But given the set of characters escaped, \0, \n, \r, ", ', and \ (or just ' when mysql is running with sql_mode=NO_BACKSLASH_ESCAPES) I don't think it could cause any harm other then cause an error.
This was fixed publicly in bug 55427
When can we get this moved out of the Security component?
(In reply to Alex Monk from comment #7) > When can we get this moved out of the Security component? Now I guess, but I'm not sure it's so much needed as it has a public counterpart in bug 55427
Let's default to keeping these things public unless they actually need to be private, please. *** This bug has been marked as a duplicate of bug 55427 ***
