proxysql

Commit Graph

Author	SHA1	Message	Date
Rene Cannao	9d8c6b77b3	fix(security): close MCP run_sql_readonly multi-statement bypass (GHSA-7wh6-2vcc-gcm4) The MCP /mcp/query endpoint advertised a read-only contract for the run_sql_readonly tool, but enforcement was a substring-only validator on the first keyword while the backend MySQL connection was opened with CLIENT_MULTI_STATEMENTS. A payload like SELECT 1; RENAME TABLE testdb.x TO testdb.y passed validation (starts with SELECT) and executed both statements, renaming the backend table. The pre-fix substring blacklist also omitted several side-effecting MySQL keywords (RENAME, SET, RESET, LOCK, UNLOCK, KILL, FLUSH, OPTIMIZE, REPAIR, HANDLER, ...) so the bypass also worked as a single statement when those keywords appeared at the start. Fixes applied in defense-in-depth order: 1. Drop CLIENT_MULTI_STATEMENTS from the MCP backend mysql_real_connect calls in Query_Tool_Handler.cpp:init_connection_pool and backend_client.cpp:dial_mysql. This alone closes the demonstrated PoC end-to-end: the server-side parser will reject the trailing statement as a syntax error. 2. Add Query_Tool_Handler::contains_multi_statement() which tracks lexical state (single/double-quoted strings, backtick-quoted identifiers, '--' line comments, '/* */' block comments) and rejects any ';' followed by non-whitespace. Call it at the top of validate_readonly_query so multi-statement payloads are rejected before they ever reach the backend. 3. Expand the dangerous-keyword denylist to cover RENAME, RESET, LOCK, UNLOCK, KILL, FLUSH, GRANT, REVOKE, OPTIMIZE, REPAIR, HANDLER, INSTALL/UNINSTALL, CHANGE, PURGE, SAVEPOINT/RELEASE, transaction control (BEGIN, START, COMMIT, ROLLBACK, XA), SHUTDOWN, INTO OUTFILE/DUMPFILE. Reject 'SET ' and 'USE ' as standalone leading keywords (they appear legitimately as substrings inside SELECT, but never as the first token of a read-only query). 4. Reject 'EXPLAIN ANALYZE' explicitly: PostgreSQL EXPLAIN ANALYZE actually executes the wrapped statement, and the same applies to some MySQL configurations. 5. Apply the same validation in the explain_sql handler, which previously did no read-only validation at all. An MCP caller could send "SELECT 1; RENAME TABLE ..." through explain_sql, the handler would prepend "EXPLAIN " and execute the multi-statement payload. Operator note: this only closes the bypass. /mcp/query authentication defaults to mcp-query_endpoint_auth="" (no auth) when MCP is enabled, which makes any deployment exposing /mcp/query reachable to an unauthenticated network attacker. Hardening that default is tracked separately.	2 months ago
Rene Cannao	a9f2eaaa13	feat: remove PROXYSQLGENAI flag, genai now builds under PROXYSQL40 (issue #5722 ) PROXYSQLGENAI flag eliminated entirely. PROXYSQL40=1 now unconditionally builds the genai plugin alongside core. All #ifdef PROXYSQLGENAI replaced with #ifdef PROXYSQL40 in source, Makefiles, and 61 CI workflows.	2 months ago
Rene Cannao	5fe286e972	feat(plugins/genai): Step 4.C — move MCP subsystem into the plugin Per docs/superpowers/plans/2026-04-19-step4-mcp-subsystem-move.md "4.C / 4.D / 4.E merge" revision. This is the largest single carve-out commit so far: ~13 K LOC physically relocated, plus surgical edits across the core admin SQL surface to neutralize references to the moved code. What moved (git mv preserves history) Tool handlers (lib/<name>.cpp -> plugins/genai/src/tool_handlers/<name>.cpp; include/<name>.h -> plugins/genai/include/<name>.h) Admin_Tool_Handler, Cache_Tool_Handler, Config_Tool_Handler, MySQL_Tool_Handler, Observe_Tool_Handler, Query_Tool_Handler, Stats_Tool_Handler. MCP listener stack (lib/<name>.cpp -> plugins/genai/src/<name>.cpp; include/<name>.h(pp) -> plugins/genai/include/...) MCP_Endpoint, MCP_Thread, ProxySQL_MCP_Server. Promoted from Step 6 (bidirectional dep with MySQL_Tool_Handler): MySQL_FTS. MCP_Tool_Handler base stays in core because AI_Tool_Handler and RAG_Tool_Handler (Steps 5/6 scope) inherit from it; moving the base would force pulling those in too. Plugin lifecycle takeover plugins/genai/include/genai_plugin.h: GenAIPluginContext now holds the MCP_Threads_Handler. plugins/genai/src/plugin_main.cpp: genai_init constructs the MCP_Threads_Handler and assigns to a plugin-local GloMCPH symbol (the legacy global name, kept for the moved tool handlers that still reference it; the symbol no longer exists in core). genai_stop tears down on shutdown. genai_start is a no-op for now; the MCP listener auto-start is gated on the admin-SQL surface that 4.F restores. plugins/genai/src/ProxySQL_MCP_Server.cpp: AI_Tool_Handler and RAG_Tool_Handler endpoint registration is disabled via stub assignments (the headers stay included so member-pointer types resolve). Steps 5/6 re-enable when those classes move into the plugin. Core neutralization (FIXME stubs awaiting 4.F/4.G) src/main.cpp: GloMCPH global removed; ProxySQL_Main_init_MCP_module removed; shutdown block deleted. lib/ProxySQL_Admin.cpp: init_mcp_variables, load_mcp_server, load_mcp_query_rules_to_runtime, save_mcp_query_rules_from_runtime stubbed to no-ops; original bodies preserved inside `#if 0` for 4.F reference. lib/Admin_FlushVariables.cpp: flush_mcp_variables___database_to_runtime and flush_mcp_variables___runtime_to_database stubbed similarly. lib/ProxySQL_Admin_Stats.cpp: stats___mcp_query_tools_counters, stats___mcp_query_digest, stats___mcp_query_rules stubbed. lib/Admin_Handler.cpp: has_variable("mcp-…") and the load_target_auth_map call site in LOAD MCP PROFILES … stubbed. Result: the MCP listener does NOT start automatically between this commit and 4.F (mcp- admin variables are not pushed into the running plugin). Documented in the plan's "4.C/4.D/4.E merge" section. src link change: --whole-archive on libproxysql.a src/Makefile: the proxysql binary now links libproxysql.a with -Wl,--whole-archive so all symbols are exported via -Wl,--export-dynamic, allowing the genai plugin .so to dlopen cleanly even when core code paths don't reference moved-but-still- in-core classes (LLM_Bridge, Discovery_Schema, MySQL_Catalog, Static_Harvester, …) directly. test/tap/tests/unit/Makefile gets the same change so unit tests can dlopen the plugin. Without this, ld dead-code-eliminates the unreferenced symbols and dlopen fails with "undefined symbol". Tests passing - genai_plugin_anomaly_unit-t : 6/6 - genai_plugin_load_unit-t : 8/8 (lifecycle init/start/stop + admin table registration) - genai_plugin_backend_client_unit-t : 27/27 Carve-out scoreboard Step 0-2 : 0 (infrastructure only) Step 3 : ~1.1 K (Anomaly_Detector) Step 4.B : ~0.5 K (backend_client helper, no callers yet) Step 4.C : ~13 K (this commit; MCP subsystem) Pending : Steps 4.F, 4.G, 5, 6, 7	2 months ago

Author

SHA1

Message

Date

Rene Cannao

9d8c6b77b3

fix(security): close MCP run_sql_readonly multi-statement bypass (GHSA-7wh6-2vcc-gcm4)

The MCP /mcp/query endpoint advertised a read-only contract for the
run_sql_readonly tool, but enforcement was a substring-only validator on
the first keyword while the backend MySQL connection was opened with
CLIENT_MULTI_STATEMENTS.  A payload like

    SELECT 1; RENAME TABLE testdb.x TO testdb.y

passed validation (starts with SELECT) and executed both statements,
renaming the backend table.  The pre-fix substring blacklist also
omitted several side-effecting MySQL keywords (RENAME, SET, RESET, LOCK,
UNLOCK, KILL, FLUSH, OPTIMIZE, REPAIR, HANDLER, ...) so the bypass also
worked as a single statement when those keywords appeared at the start.

Fixes applied in defense-in-depth order:

1. Drop CLIENT_MULTI_STATEMENTS from the MCP backend mysql_real_connect
   calls in Query_Tool_Handler.cpp:init_connection_pool and
   backend_client.cpp:dial_mysql.  This alone closes the demonstrated
   PoC end-to-end: the server-side parser will reject the trailing
   statement as a syntax error.

2. Add Query_Tool_Handler::contains_multi_statement() which tracks
   lexical state (single/double-quoted strings, backtick-quoted
   identifiers, '--' line comments, '/* */' block comments) and rejects
   any ';' followed by non-whitespace.  Call it at the top of
   validate_readonly_query so multi-statement payloads are rejected
   before they ever reach the backend.

3. Expand the dangerous-keyword denylist to cover RENAME, RESET, LOCK,
   UNLOCK, KILL, FLUSH, GRANT, REVOKE, OPTIMIZE, REPAIR, HANDLER,
   INSTALL/UNINSTALL, CHANGE, PURGE, SAVEPOINT/RELEASE, transaction
   control (BEGIN, START, COMMIT, ROLLBACK, XA), SHUTDOWN, INTO
   OUTFILE/DUMPFILE.  Reject 'SET ' and 'USE ' as standalone leading
   keywords (they appear legitimately as substrings inside SELECT, but
   never as the first token of a read-only query).

4. Reject 'EXPLAIN ANALYZE' explicitly: PostgreSQL EXPLAIN ANALYZE
   actually executes the wrapped statement, and the same applies to
   some MySQL configurations.

5. Apply the same validation in the explain_sql handler, which
   previously did no read-only validation at all.  An MCP caller could
   send "SELECT 1; RENAME TABLE ..." through explain_sql, the handler
   would prepend "EXPLAIN " and execute the multi-statement payload.

Operator note: this only closes the bypass.  /mcp/query authentication
defaults to mcp-query_endpoint_auth="" (no auth) when MCP is enabled,
which makes any deployment exposing /mcp/query reachable to an
unauthenticated network attacker.  Hardening that default is tracked
separately.

Rene Cannao

a9f2eaaa13

feat: remove PROXYSQLGENAI flag, genai now builds under PROXYSQL40 (issue #5722 )

PROXYSQLGENAI flag eliminated entirely. PROXYSQL40=1 now unconditionally
builds the genai plugin alongside core. All #ifdef PROXYSQLGENAI replaced
with #ifdef PROXYSQL40 in source, Makefiles, and 61 CI workflows.

Rene Cannao

5fe286e972

feat(plugins/genai): Step 4.C — move MCP subsystem into the plugin

Per docs/superpowers/plans/2026-04-19-step4-mcp-subsystem-move.md
"4.C / 4.D / 4.E merge" revision.  This is the largest single carve-out
commit so far: ~13 K LOC physically relocated, plus surgical edits
across the core admin SQL surface to neutralize references to the
moved code.

What moved (git mv preserves history)

  Tool handlers (lib/<name>.cpp -> plugins/genai/src/tool_handlers/<name>.cpp;
                 include/<name>.h  -> plugins/genai/include/<name>.h)
    Admin_Tool_Handler, Cache_Tool_Handler, Config_Tool_Handler,
    MySQL_Tool_Handler, Observe_Tool_Handler, Query_Tool_Handler,
    Stats_Tool_Handler.

  MCP listener stack (lib/<name>.cpp -> plugins/genai/src/<name>.cpp;
                      include/<name>.h(pp) -> plugins/genai/include/...)
    MCP_Endpoint, MCP_Thread, ProxySQL_MCP_Server.

  Promoted from Step 6 (bidirectional dep with MySQL_Tool_Handler):
    MySQL_FTS.

  MCP_Tool_Handler base stays in core because AI_Tool_Handler and
  RAG_Tool_Handler (Steps 5/6 scope) inherit from it; moving the base
  would force pulling those in too.

Plugin lifecycle takeover

  plugins/genai/include/genai_plugin.h: GenAIPluginContext now holds
  the MCP_Threads_Handler*.

  plugins/genai/src/plugin_main.cpp: genai_init constructs the
  MCP_Threads_Handler and assigns to a plugin-local GloMCPH symbol
  (the legacy global name, kept for the moved tool handlers that
  still reference it; the symbol no longer exists in core).
  genai_stop tears down on shutdown.  genai_start is a no-op for now;
  the MCP listener auto-start is gated on the admin-SQL surface that
  4.F restores.

  plugins/genai/src/ProxySQL_MCP_Server.cpp: AI_Tool_Handler and
  RAG_Tool_Handler endpoint registration is disabled via stub
  assignments (the headers stay included so member-pointer types
  resolve).  Steps 5/6 re-enable when those classes move into the
  plugin.

Core neutralization (FIXME stubs awaiting 4.F/4.G)

  src/main.cpp: GloMCPH global removed; ProxySQL_Main_init_MCP_module
  removed; shutdown block deleted.

  lib/ProxySQL_Admin.cpp: init_mcp_variables, load_mcp_server,
  load_mcp_query_rules_to_runtime, save_mcp_query_rules_from_runtime
  stubbed to no-ops; original bodies preserved inside `#if 0` for
  4.F reference.

  lib/Admin_FlushVariables.cpp: flush_mcp_variables___database_to_runtime
  and flush_mcp_variables___runtime_to_database stubbed similarly.

  lib/ProxySQL_Admin_Stats.cpp: stats___mcp_query_tools_counters,
  stats___mcp_query_digest, stats___mcp_query_rules stubbed.

  lib/Admin_Handler.cpp: has_variable("mcp-…") and the
  load_target_auth_map call site in LOAD MCP PROFILES …  stubbed.

  Result: the MCP listener does NOT start automatically between this
  commit and 4.F (mcp-* admin variables are not pushed into the
  running plugin).  Documented in the plan's "4.C/4.D/4.E merge"
  section.

src link change: --whole-archive on libproxysql.a

  src/Makefile: the proxysql binary now links libproxysql.a with
  -Wl,--whole-archive so all symbols are exported via
  -Wl,--export-dynamic, allowing the genai plugin .so to dlopen
  cleanly even when core code paths don't reference moved-but-still-
  in-core classes (LLM_Bridge, Discovery_Schema, MySQL_Catalog,
  Static_Harvester, …) directly.  test/tap/tests/unit/Makefile gets
  the same change so unit tests can dlopen the plugin.  Without this,
  ld dead-code-eliminates the unreferenced symbols and dlopen fails
  with "undefined symbol".

Tests passing

  - genai_plugin_anomaly_unit-t : 6/6
  - genai_plugin_load_unit-t    : 8/8 (lifecycle init/start/stop +
                                       admin table registration)
  - genai_plugin_backend_client_unit-t : 27/27

Carve-out scoreboard

  Step 0-2 :     0  (infrastructure only)
  Step 3   :  ~1.1 K  (Anomaly_Detector)
  Step 4.B :    ~0.5 K  (backend_client helper, no callers yet)
  Step 4.C : ~13 K  (this commit; MCP subsystem)
  Pending  : Steps 4.F, 4.G, 5, 6, 7

3 Commits (docs/passthrough-auth-spec)