Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inline comments improperly removed during query #332

Open
ibennetch opened this issue Jan 8, 2020 · 6 comments
Open

Inline comments improperly removed during query #332

ibennetch opened this issue Jan 8, 2020 · 6 comments
Labels

Comments

@ibennetch
Copy link
Member

Describe the bug

The query:
select * from /*!i*/nformation_schema.tables;

Executes as if it were:
select * from information_schema.tables;

This is improper.

Expected behavior

MySQL and MariaDB return an error message, this is probably the most expected result. Perhaps a syntax error should be generated from the parser.

Server configuration

  • Operating system: Debian
  • Web server: Apache
  • Database version: MariaDB 10.4.10
  • PHP version: 7.4
  • phpMyAdmin version: 5.0.0

Client configuration

  • Browser: Firefox
  • Operating system: MacOS

This was originally reported by email.

@ibennetch
Copy link
Member Author

Note that this does not circumvent existing access controls; it cannot be used to escalate privileges.

@thesmallstar
Copy link

Can I work on this?

@williamdes
Copy link
Member

@thesmallstar Yes, but you will maybe need to do changes on https://github.com/phpmyadmin/sql-parser/tree/QA

@thesmallstar
Copy link

@williamdes okay thank you :)

@shucon
Copy link
Contributor

shucon commented Nov 6, 2020

Working on this.

@shucon
Copy link
Contributor

shucon commented Nov 7, 2020

I've looked into the problem and I think adding a space after the comment token in the SQL parser would solve the problem. @ibennetch what do you think?

@williamdes williamdes transferred this issue from phpmyadmin/phpmyadmin Feb 14, 2021
@williamdes williamdes added the bug label Feb 14, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants