• Ravinder Thakur's avatar
    bug#11761752: DO NOT ALLOW USE OF ALTERNATE DATA STREAMS ON NTFS FILESYSTEM. · 2d16c5bd
    Ravinder Thakur authored
    File names with colon are being disallowed because of the Alternate Data 
    Stream (ADS) feature of NTFS that could be misused. ADS allows data to be 
    written to alternate streams of a normal file. The data in alternate 
    streams cannot be seen by normal tools on Windows (explorer, cmd.exe). As 
    a result someone can use this feature to hide large amount of data in 
    alternate streams and admins will have no easy way of figuring out the 
    files that are using that disk space. The fix also disallows ADS in the 
    scenarios where file name is passed as some dynamic variable.
    
    An important thing about the fix is that it DOES NOT disallow ADS file 
    names if they are not dynamic (i.e. if the file is created by using some 
    option that needs local access to the MySQL server, for example error log
    file). The reasoning is that if some MySQL option related to files 
    requires access to the local machine (it is not dynamic), then user can very 
    well create data in ADS by some other means. This fixes only those scenarios 
    which can allow users to create data in ADS over the wire.
    
    File names with colon are being disallowed only on Windows. UNIX 
    (Linux in particular) supports NTFS, but it will not be a common 
    scenario for someone to configure a NTFS file system to store MySQL 
    data on Linux.
    
    Changes in file bug11761752-master.opt are needed due to 
    bug number 15937938.
    2d16c5bd
my_fopen.c 8.86 KB