MySQL Bugs: #76568: mysqluc considers commands in backticks(``) as bash command

Bug #76568	mysqluc considers commands in backticks(``) as bash command
Submitted:	1 Apr 2015 21:49	Modified:	2 Apr 2015 6:09
Reporter:	Shahriyar Rzayev	Email Updates:
Status:	Verified	Impact on me:	None
Category:	MySQL Utilities	Severity:	S1 (Critical)
Version:	1.5.4, 1 6.1	OS:	Linux (CentOS 7)
Assigned to:		CPU Architecture:	Any

Description:
After installing MySQL Utilities from YUM repo on CentOS 7,
i decide to test some utilities and find out that when commands are in bacticks mysqluc considers them as bash command and in fact it runs these commands.

-- 1

[root@node1 ~]# mysqluc -- `*`
-bash: anaconda-ks.cfg: command not found
Launching console ...

Welcome to the MySQL Utilities Client (mysqluc) version 1.5.4

-- 2

[root@node1 ~]# mysqluc -- `sdfjsdhfjshd`
-bash: sdfjsdhfjshd: command not found
Launching console ...

Welcome to the MySQL Utilities Client (mysqluc) version 1.5.4

--  3
-- Here you can ls directories and redirect output to file

[root@node1 ~]# mysqluc -- `/usr/bin/ls /home > /root/ls.txt`
Launching console ...

-- 4

-- It raises a Warning about a password typed as cleartext directly on commandline, but indeed i have not typed any mysql password as you see.

Welcome to the MySQL Utilities Client (mysqluc) version 1.5.4
[fake@node1 ~]$ mysqluc -- `/bin/su - fake`
Password: 
[fake@node1 ~]$ exit
logout
WARNING: Using a password on the command line interface can be insecure.
Usage: mysqluc 

mysqluc: error: Unbalanced arguments. Please check your command.

How to repeat:
Just install MySQL Utilities 1.5.4 from YUM repo and type commands from description.

Suggested fix:
Maybe some error messages for these conditions.

Hello Shahriyar Rzayev,

Thank you for the report.
Observed this on CentOS7 with MySQL utilities 1.5.4 and with OL6( but with 1.6.1).

Thanks,
Umesh

// OL6, 1.6.1

[root@cluster-repo ~]# rpm -qa|grep -i mysql-utilities
mysql-utilities-1.6.1-1.el6.noarch
mysql-utilities-extra-1.6.1-1.el6.noarch

[root@cluster-repo ~]# mysqluc -- `*`
-bash: anaconda-ks.cfg: command not found
Launching console ...

Welcome to the MySQL Utilities Client (mysqluc) version 1.6.1
Copyright (c) 2010, 2015 Oracle and/or its affiliates. All rights reserved.
This is a release of dual licensed MySQL Utilities. For the avoidance of
doubt, this particular copy of the software is released
under the version 2 of the GNU General Public License.
MySQL Utilities is brought to you by Oracle.

Type 'help' for a list of commands or press TAB twice for list of utilities.

mysqluc>

[root@cluster-repo ~]# mysqluc -- `sdfjsdhfjshd`
-bash: sdfjsdhfjshd: command not found
Launching console ...

Welcome to the MySQL Utilities Client (mysqluc) version 1.6.1
Copyright (c) 2010, 2015 Oracle and/or its affiliates. All rights reserved.
This is a release of dual licensed MySQL Utilities. For the avoidance of
doubt, this particular copy of the software is released
under the version 2 of the GNU General Public License.
MySQL Utilities is brought to you by Oracle.

Type 'help' for a list of commands or press TAB twice for list of utilities.

mysqluc>

// CentOS7 1.5.4

[root@ushastry Downloads]# rpm -qa|grep -i mysql-utilities
mysql-utilities-1.5.4-1.el7.noarch
[root@ushastry Downloads]# cat /etc/*release
CentOS Linux release 7.0.1406 (Core) 
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CentOS Linux release 7.0.1406 (Core) 
CentOS Linux release 7.0.1406 (Core) 
[root@ushastry Downloads]# mysqluc -- `*`
bash: jemalloc: command not found...
Launching console ...

Welcome to the MySQL Utilities Client (mysqluc) version 1.5.4
Copyright (c) 2010, 2015 Oracle and/or its affiliates. All rights reserved.
This is a release of dual licensed MySQL Utilities. For the avoidance of
doubt, this particular copy of the software is released
under the version 2 of the GNU General Public License.
MySQL Utilities is brought to you by Oracle.

Type 'help' for a list of commands or press TAB twice for list of utilities.

mysqluc> 

[root@ushastry Downloads]# mysqluc -- `sdfjsdhfjshd`
bash: sdfjsdhfjshd: command not found...
Launching console ...

Welcome to the MySQL Utilities Client (mysqluc) version 1.5.4
Copyright (c) 2010, 2015 Oracle and/or its affiliates. All rights reserved.
This is a release of dual licensed MySQL Utilities. For the avoidance of
doubt, this particular copy of the software is released
under the version 2 of the GNU General Public License.
MySQL Utilities is brought to you by Oracle.

Type 'help' for a list of commands or press TAB twice for list of utilities.

mysqluc>