Skip to content

Commit a63172c

Browse files
CBL-Mariner-Botkevin-b-lockwood
CBL-Mariner-Bot
and
kevin-b-lockwood
authored
[AUTO-CHERRYPICK] [Low] Patch vitess for CVE-2024-53257 - branch main (#12953)
Co-authored-by: Kevin Lockwood <57274670+kevin-b-lockwood@users.noreply.github.com>
1 parent 9877611 commit a63172c

2 files changed

Lines changed: 177 additions & 1 deletion

File tree

‎SPECS/vitess/CVE-2024-53257.patch‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
From 2b71d1b5f8ca676beeab2875525003cd45096217 Mon Sep 17 00:00:00 2001
2+
From: Dirkjan Bussink <d.bussink@gmail.com>
3+
Date: Mon, 2 Dec 2024 16:47:59 +0100
4+
Subject: [PATCH] Merge commit from fork
5+
6+
These templates were rendered using text/template which is fundamentally
7+
broken as it would allow for trivial HTML injection.
8+
9+
Instead render using safehtml/template so that we have automatic
10+
escaping.
11+
12+
Signed-off-by: Dirkjan Bussink <d.bussink@gmail.com>
13+
Link: https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217.patch
14+
---
15+
go/vt/vtgate/debugenv.go | 3 ++-
16+
go/vt/vtgate/querylogz.go | 4 ++--
17+
go/vt/vtgate/querylogz_test.go | 8 ++++----
18+
go/vt/vttablet/tabletserver/debugenv.go | 3 ++-
19+
go/vt/vttablet/tabletserver/querylogz.go | 3 ++-
20+
go/vt/vttablet/tabletserver/querylogz_test.go | 8 ++++----
21+
6 files changed, 16 insertions(+), 13 deletions(-)
22+
23+
diff --git a/go/vt/vtgate/debugenv.go b/go/vt/vtgate/debugenv.go
24+
index 4fa989c69a3..7213353432d 100644
25+
--- a/go/vt/vtgate/debugenv.go
26+
+++ b/go/vt/vtgate/debugenv.go
27+
@@ -22,9 +22,10 @@ import (
28+
"html"
29+
"net/http"
30+
"strconv"
31+
- "text/template"
32+
"time"
33+
34+
+ "github.com/google/safehtml/template"
35+
+
36+
"vitess.io/vitess/go/acl"
37+
"vitess.io/vitess/go/vt/discovery"
38+
"vitess.io/vitess/go/vt/log"
39+
diff --git a/go/vt/vtgate/querylogz.go b/go/vt/vtgate/querylogz.go
40+
index 7c72e950d4a..05d301f28be 100644
41+
--- a/go/vt/vtgate/querylogz.go
42+
+++ b/go/vt/vtgate/querylogz.go
43+
@@ -20,15 +20,15 @@ import (
44+
"net/http"
45+
"strconv"
46+
"strings"
47+
- "text/template"
48+
"time"
49+
50+
- "vitess.io/vitess/go/vt/vtgate/logstats"
51+
+ "github.com/google/safehtml/template"
52+
53+
"vitess.io/vitess/go/acl"
54+
"vitess.io/vitess/go/vt/log"
55+
"vitess.io/vitess/go/vt/logz"
56+
"vitess.io/vitess/go/vt/sqlparser"
57+
+ "vitess.io/vitess/go/vt/vtgate/logstats"
58+
)
59+
60+
var (
61+
diff --git a/go/vt/vtgate/querylogz_test.go b/go/vt/vtgate/querylogz_test.go
62+
index 3cecb983b3f..9236b2ac840 100644
63+
--- a/go/vt/vtgate/querylogz_test.go
64+
+++ b/go/vt/vtgate/querylogz_test.go
65+
@@ -35,7 +35,7 @@ import (
66+
67+
func TestQuerylogzHandlerFormatting(t *testing.T) {
68+
req, _ := http.NewRequest("GET", "/querylogz?timeout=10&limit=1", nil)
69+
- logStats := logstats.NewLogStats(context.Background(), "Execute", "select name from test_table limit 1000", "suuid", nil)
70+
+ logStats := logstats.NewLogStats(context.Background(), "Execute", "select name, 'inject <script>alert();</script>' from test_table limit 1000", "suuid", nil)
71+
logStats.StmtType = "select"
72+
logStats.RowsAffected = 1000
73+
logStats.ShardQueries = 1
74+
@@ -64,7 +64,7 @@ func TestQuerylogzHandlerFormatting(t *testing.T) {
75+
`<td>0.002</td>`,
76+
`<td>0.003</td>`,
77+
`<td>select</td>`,
78+
- `<td>select name from test_table limit 1000</td>`,
79+
+ regexp.QuoteMeta(`<td>select name,​ &#39;inject &lt;script&gt;alert()​;&lt;/script&gt;&#39; from test_table limit 1000</td>`),
80+
`<td>1</td>`,
81+
`<td>1000</td>`,
82+
`<td></td>`,
83+
@@ -94,7 +94,7 @@ func TestQuerylogzHandlerFormatting(t *testing.T) {
84+
`<td>0.002</td>`,
85+
`<td>0.003</td>`,
86+
`<td>select</td>`,
87+
- `<td>select name from test_table limit 1000</td>`,
88+
+ regexp.QuoteMeta(`<td>select name,​ &#39;inject &lt;script&gt;alert()​;&lt;/script&gt;&#39; from test_table limit 1000</td>`),
89+
`<td>1</td>`,
90+
`<td>1000</td>`,
91+
`<td></td>`,
92+
@@ -124,7 +124,7 @@ func TestQuerylogzHandlerFormatting(t *testing.T) {
93+
`<td>0.002</td>`,
94+
`<td>0.003</td>`,
95+
`<td>select</td>`,
96+
- `<td>select name from test_table limit 1000</td>`,
97+
+ regexp.QuoteMeta(`<td>select name,​ &#39;inject &lt;script&gt;alert()​;&lt;/script&gt;&#39; from test_table limit 1000</td>`),
98+
`<td>1</td>`,
99+
`<td>1000</td>`,
100+
`<td></td>`,
101+
diff --git a/go/vt/vttablet/tabletserver/debugenv.go b/go/vt/vttablet/tabletserver/debugenv.go
102+
index 9a802a5d49c..6f1ea854ea9 100644
103+
--- a/go/vt/vttablet/tabletserver/debugenv.go
104+
+++ b/go/vt/vttablet/tabletserver/debugenv.go
105+
@@ -23,9 +23,10 @@ import (
106+
"html"
107+
"net/http"
108+
"strconv"
109+
- "text/template"
110+
"time"
111+
112+
+ "github.com/google/safehtml/template"
113+
+
114+
"vitess.io/vitess/go/acl"
115+
"vitess.io/vitess/go/vt/log"
116+
)
117+
diff --git a/go/vt/vttablet/tabletserver/querylogz.go b/go/vt/vttablet/tabletserver/querylogz.go
118+
index 33341d1641b..09f375aa329 100644
119+
--- a/go/vt/vttablet/tabletserver/querylogz.go
120+
+++ b/go/vt/vttablet/tabletserver/querylogz.go
121+
@@ -20,9 +20,10 @@ import (
122+
"net/http"
123+
"strconv"
124+
"strings"
125+
- "text/template"
126+
"time"
127+
128+
+ "github.com/google/safehtml/template"
129+
+
130+
"vitess.io/vitess/go/acl"
131+
"vitess.io/vitess/go/vt/log"
132+
"vitess.io/vitess/go/vt/logz"
133+
diff --git a/go/vt/vttablet/tabletserver/querylogz_test.go b/go/vt/vttablet/tabletserver/querylogz_test.go
134+
index 25f03c762c7..ee26437f330 100644
135+
--- a/go/vt/vttablet/tabletserver/querylogz_test.go
136+
+++ b/go/vt/vttablet/tabletserver/querylogz_test.go
137+
@@ -37,7 +37,7 @@ func TestQuerylogzHandler(t *testing.T) {
138+
req, _ := http.NewRequest("GET", "/querylogz?timeout=10&limit=1", nil)
139+
logStats := tabletenv.NewLogStats(context.Background(), "Execute")
140+
logStats.PlanType = planbuilder.PlanSelect.String()
141+
- logStats.OriginalSQL = "select name from test_table limit 1000"
142+
+ logStats.OriginalSQL = "select name, 'inject <script>alert();</script>' from test_table limit 1000"
143+
logStats.RowsAffected = 1000
144+
logStats.NumberOfQueries = 1
145+
logStats.StartTime, _ = time.Parse("Jan 2 15:04:05", "Nov 29 13:33:09")
146+
@@ -64,7 +64,7 @@ func TestQuerylogzHandler(t *testing.T) {
147+
`<td>0.001</td>`,
148+
`<td>1e-08</td>`,
149+
`<td>Select</td>`,
150+
- `<td>select name from test_table limit 1000</td>`,
151+
+ regexp.QuoteMeta(`<td>select name,​ &#39;inject &lt;script&gt;alert()​;&lt;/script&gt;&#39; from test_table limit 1000</td>`),
152+
`<td>1</td>`,
153+
`<td>none</td>`,
154+
`<td>1000</td>`,
155+
@@ -95,7 +95,7 @@ func TestQuerylogzHandler(t *testing.T) {
156+
`<td>0.001</td>`,
157+
`<td>1e-08</td>`,
158+
`<td>Select</td>`,
159+
- `<td>select name from test_table limit 1000</td>`,
160+
+ regexp.QuoteMeta(`<td>select name,​ &#39;inject &lt;script&gt;alert()​;&lt;/script&gt;&#39; from test_table limit 1000</td>`),
161+
`<td>1</td>`,
162+
`<td>none</td>`,
163+
`<td>1000</td>`,
164+
@@ -126,7 +126,7 @@ func TestQuerylogzHandler(t *testing.T) {
165+
`<td>0.001</td>`,
166+
`<td>1e-08</td>`,
167+
`<td>Select</td>`,
168+
- `<td>select name from test_table limit 1000</td>`,
169+
+ regexp.QuoteMeta(`<td>select name,​ &#39;inject &lt;script&gt;alert()​;&lt;/script&gt;&#39; from test_table limit 1000</td>`),
170+
`<td>1</td>`,
171+
`<td>none</td>`,
172+
`<td>1000</td>`,

‎SPECS/vitess/vitess.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
Name: vitess
55
Version: 17.0.7
6-
Release: 5%{?dist}
6+
Release: 6%{?dist}
77
Summary: Database clustering system for horizontal scaling of MySQL
88
# Upstream license specification: MIT and Apache-2.0
99
License: MIT and ASL 2.0
@@ -29,6 +29,7 @@ Source1: %{name}-%{version}-vendor.tar.gz
2929
Patch0: CVE-2024-45338.patch
3030
Patch1: CVE-2024-45339.patch
3131
Patch2: CVE-2025-22868.patch
32+
Patch3: CVE-2024-53257.patch
3233
BuildRequires: golang
3334

3435
%description
@@ -101,6 +102,9 @@ go test -v ./go/cmd/... \
101102
%{_bindir}/*
102103

103104
%changelog
105+
* Thu Mar 06 2025 Kevin Lockwood <v-klockwood@microsoft.com> - 17.0.7-6
106+
- Fix add patch for CVE-2024-53257
107+
104108
* Mon Mar 03 2025 Kanishk Bansal <kanbansal@microsoft.com> - 17.0.7-5
105109
- Fix CVE-2025-22868 with an upstream patch
106110

0 commit comments

Comments
 (0)