Bug #27884 mysql --html does not quote HTML special characters in output
Submitted: 17 Apr 2007 17:06 Modified: 16 Dec 2009 16:33
Reporter: Thomas Henlich
Status: Closed
Category:Client Severity:S3 (Non-critical)
Version:5.0.37, 5.0.26, 5.0.45, 5.0.66, 5.0.67 OS:Any
Assigned to: Jim Winstead Target Version:5.0+
Triage: Triaged: D2 (Serious)

[17 Apr 2007 17:06] Thomas Henlich 
Description:
The mysql command-line client does not quote HTML special characters like & < > " in its
output. This allows an attacker who is able to write data into a table to inject
potentially dangerous code, e. g. Javascript, into the output.

How to repeat:
c:\> mysql --html -execute "select '<a>'"

<TABLE BORDER=1><TR><TH><a></TH></TR><TR><TD><a></TD></TR></TABLE>

Suggested fix:
The quoting of special characters should be the same as for XML output, e. g.:
c:\> mysql --xml -execute "select 'b<a>'"

<?xml version="1.0"?>

<resultset statement="select 'b&lt;a&gt;'
">
  <row>
	<field name="b&lt;a&gt;">b&lt;a&gt;</field>
  </row>
</resultset>
[17 Apr 2007 21:34] Valeriy Kravchuk 
Thank you for a bug report. Verified just as described.
[16 Apr 2008 14:41] Thomas Henlich 
The option should read --execute and not -execute
[1 May 2008 21:32] Jim Winstead 
Patch to fix lack of HTML encoding

Attachment: bug27884.patch (text/plain), 1.70 KiB.
[2 Oct 2008 8:47] Thomas Henlich 
Request to review/push the patch.
[16 Oct 2008 7:11] Mikiya Okuno 
Any version of MySQL could be impacted by this bug.
[6 Apr 2009 14:23] Chad MILLER 
Good, except I would also include "apos" in the predef entity list.
[28 Apr 2009 19:55] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/72932

2875 Jim Winstead	2009-04-28
      Bug #27884: mysql --html does not quote HTML special characters in output
      
        Fix encoding of field values and names in HTML output from mysql client.
      modified:
        client/mysql.cc
        mysql-test/r/mysql.result
        mysql-test/t/mysql.test
[28 Apr 2009 19:56] Jim Winstead 
Queued to lp:~mysql-cteam/mysql-server/5.1.
[1 May 2009 2:23] Trent Lloyd 
This is queued for 5.1 but will it be fixed in 5.0? There was a lot of customer demand in
this as well as the fact it had a CVE, even if the impact is probably reasonably low.
[28 May 2009 10:13] Bugs System 
Pushed into 5.1.36 (revid:joro@sun.com-20090528073639-yohsb4q1jzg7ycws) (version source
revid:mats@sun.com-20090511132802-nnkiyb2huih1tklz) (merge vers: 5.1.35) (pib:6)
[29 May 2009 3:31] Paul DuBois 
Noted in 5.1.36 changelog.

Output from mysql --html did not encode the <, >, or & characters.

Setting to NDI pending push into 6.0.x.
[17 Jun 2009 21:21] Bugs System 
Pushed into 5.4.4-alpha (revid:alik@sun.com-20090616183122-chjzbaa30qopdra9) (version
source revid:jimw@mysql.com-20090505173706-9ze3q4qzngw8kt2b) (merge vers: 6.0.12-alpha)
(pib:11)
[18 Jun 2009 2:56] Trent Lloyd 
Repeat; will this be fixed in 5.0 => lots of customers raised concern about 5.0
pecificlaly
[18 Jun 2009 16:59] Paul DuBois 
Noted in 5.4.4 changelog.
[13 Aug 2009 1:01] Paul DuBois 
Noted in 5.4.2 changelog because next 5.4 version will be 5.4.2 and not 5.4.4.
[15 Aug 2009 4:19] Paul DuBois 
Ignore previous comment about 5.4.2.
[26 Aug 2009 15:45] Bugs System 
Pushed into 5.1.37-ndb-7.0.8 (revid:jonas@mysql.com-20090826132541-yablppc59e3yb54l)
(version source revid:jonas@mysql.com-20090826132541-yablppc59e3yb54l) (merge vers:
5.1.37-ndb-7.0.8) (pib:11)
[26 Aug 2009 15:46] Bugs System 
Pushed into 5.1.37-ndb-6.3.27 (revid:jonas@mysql.com-20090826105955-bkj027t47gfbamnc)
(version source revid:jonas@mysql.com-20090826105955-bkj027t47gfbamnc) (merge vers:
5.1.37-ndb-6.3.27) (pib:11)
[26 Aug 2009 15:48] Bugs System 
Pushed into 5.1.37-ndb-6.2.19 (revid:jonas@mysql.com-20090825194404-37rtosk049t9koc4)
(version source revid:jonas@mysql.com-20090825194404-37rtosk049t9koc4) (merge vers:
5.1.37-ndb-6.2.19) (pib:11)
[27 Aug 2009 18:32] Bugs System 
Pushed into 5.1.35-ndb-7.1.0 (revid:magnus.blaudd@sun.com-20090827163030-6o3kk6r2oua159hr)
(version source revid:jonas@mysql.com-20090826132541-yablppc59e3yb54l) (merge vers:
5.1.37-ndb-7.0.8) (pib:11)
[24 Sep 2009 8:40] Trent Lloyd 
[18 Jun 2:56] Trent Lloyd
Repeat; will this be fixed in 5.0 => lots of customers raised concern about 5.0
specifically
[24 Sep 2009 9:14] Valeriy Kravchuk 
Please, re-triage (it is more like I2/P2). Also note that target was set as 5.0+, but
development closed the bug without fixing in 5.0! This should never happen.
[1 Oct 2009 19:47] brandon ammann 
Will this be patched at all on 5.0 +?
[9 Oct 2009 3:30] Paul DuBois 
The 5.4 fix has been pushed to 5.4.2.
[22 Oct 2009 19:31] brandon ammann 
Will this be patched at all on 5.0 +?
[23 Nov 2009 23:39] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91358

2850 Jim Winstead	2009-11-23
      Backport fix for Bug #27884.
[23 Nov 2009 23:46] Jim Winstead 
Fix is now queued to 5.0-bugteam.
[27 Nov 2009 14:47] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91917

2854 Georgi Kodinov	2009-11-27
      Addendum to Bug #27884: fixed test incompatibility on windows.
[2 Dec 2009 9:01] Bugs System 
Pushed into 5.0.89 (revid:joro@sun.com-20091202075830-mzl79q7mc1v72pf1) (version source
revid:joro@sun.com-20091127134654-a2nx7yc8k02zcv0w) (merge vers: 5.0.89) (pib:13)
[2 Dec 2009 9:03] Bugs System 
Pushed into 5.1.42 (revid:joro@sun.com-20091202080033-mndu4sxwx19lz2zs) (version source
revid:joro@sun.com-20091127141724-8aag7bic3nhj67ld) (merge vers: 5.1.42) (pib:13)
[4 Dec 2009 2:45] Paul DuBois 
Noted in 5.0.89 changelog.

Already fixed in 5.1.x.
[16 Dec 2009 9:34] Bugs System 
Pushed into 6.0.14-alpha (revid:alik@sun.com-20091216083311-xorsasf5kopjxshf) (version
source revid:alik@sun.com-20091214191830-wznm8245ku8xo702) (merge vers: 6.0.14-alpha)
(pib:14)
[16 Dec 2009 9:42] Bugs System 
Pushed into 5.5.0-beta (revid:alik@sun.com-20091216082430-s0gtzibcgkv4pqul) (version
source revid:alexey.kopytov@sun.com-20091201145844-39gy4wmejbisbxac) (merge vers:
5.5.0-beta) (pib:14)
[16 Dec 2009 9:48] Bugs System 
Pushed into mysql-next-mr (revid:alik@sun.com-20091216083231-rp8ecpnvkkbhtb27) (version
source revid:alik@sun.com-20091212203859-fx4rx5uab47wwuzd) (merge vers: 5.6.0-beta)
(pib:14)
[16 Dec 2009 16:33] Paul DuBois 
Noted in 5.5.1, 6.0.14 changelogs.
[21 Dec 2009 22:01] James Day 
This was reported as CVE-2008-4456 .