Merge pull request #6515 from dolthub/db/sql

Prevent `dolt sql` from allowing `LOAD_FILE` from directories outside of working directory

go/cmd/dolt/commands/sql.go

@@ -196,6 +196,18 @@ func (cmd SqlCmd) Exec(ctx context.Context, commandStr string, args []string, dE
 		}
 	}
 
+	// restrict LOAD FILE invocations to current directory
+	wd, err := os.Getwd()
+	if err != nil {
+		wd = "/dev/null"
+	}
+	err = sql.SystemVariables.AssignValues(map[string]interface{}{
+		"secure_file_priv": wd,
+	})
+	if err != nil {
+		return HandleVErrAndExitCode(errhand.VerboseErrorFromError(err), usage)
+	}
+
 	queryist, sqlCtx, closeFunc, err := cliCtx.QueryEngine(ctx)
 	if err != nil {
 		return HandleVErrAndExitCode(errhand.VerboseErrorFromError(err), usage)

integration-tests/bats/sql.bats

@@ -2328,7 +2328,7 @@ SQL
     [[ "$output" =~ "name,create_stmt,created_at,modified_at" ]] || false
     [[ "$output" =~ 'p1,CREATE PROCEDURE p1() SELECT 5*5' ]] || false
     [[ "$output" =~ 'p2,CREATE PROCEDURE p2() SELECT 6*6' ]] || false
-    
+
     run dolt sql -b -q "SET @@show_external_procedures = 0;SHOW PROCEDURE STATUS" -r=csv
     [ "$status" -eq "0" ]
     [[ "$output" =~ "Db,Name,Type,Definer,Modified,Created,Security_type,Comment,character_set_client,collation_connection,Database Collation" ]] || false
@@ -2859,5 +2859,19 @@ SQL
     [ "$status" -eq 0 ]
     [[ "$output" =~ "Database changed" ]] || false
     [[ "$output" =~ "role_edges" ]] || false
-    
+
+}
+
+@test "sql: prevent LOAD_FILE() from accessing files outside of working directory" {
+    echo "should not be able to read this" > ../dont_read.txt
+    echo "should be able to read this" > ./do_read.txt
+
+    run dolt sql -q "select load_file('../dont_read.txt')";
+    [ "$status" -eq 0 ]
+    [[ "$output" =~ "NULL" ]] || false
+    [[ "$output" != "should not be able to read this" ]] || false
+
+    run dolt sql -q "select load_file('./do_read.txt')";
+    [ "$status" -eq 0 ]
+    [[ "$output" =~ "should be able to read this" ]] || false
 }