proxysql

Commit Graph

Author	SHA1	Message	Date
Rene Cannao	02918d18b8	Fix PR #25 Review: All AI code reviewer feedback addressed This commit addresses all recommendations from CodeRabbit, Gemini Code Assist, and Copilot for PR #25 (FTS security and code quality improvements). Critical Security Fixes: - MCP_Thread.cpp: Rollback fts_path on reset failure to keep config consistent - MySQL_FTS.cpp: Add escape_mysql_identifier() for MySQL query identifier escaping - MySQL_FTS.cpp: Add unique hash-based fallback to sanitize_name() for empty strings - MySQL_FTS.cpp: Add where_clause validation to block dangerous SQL patterns Memory Safety Fixes: - MySQL_FTS.cpp: Fix indexes_result memory leak on early return in search() - MySQL_FTS.h: Delete copy/move operations to prevent accidental resource duplication Thread Safety Documentation: - MySQL_Tool_Handler.cpp: Add comment explaining FTS lock design rationale Test Script Improvements: - test_mcp_fts.sh: Add curl timeouts (5s connect, 30s max) - test_mcp_fts.sh: Remove unused delete_response variable - test_mcp_fts_detailed.sh: Make cleanup tolerant of non-existent indexes Build Fixes: - Makefile: Fix EXCLUDE_TRACKING_VARAIABLES typo to EXCLUDE_TRACKING_VARIABLES - vector_db_performance-t.cpp: Fix printf format specifiers to %lld with cast Schema Fixes: - Query_Tool_Handler.cpp: Change fts_index_table columns schema from string to array Code Cleanup: - MySQL_Tool_Handler.cpp: Remove all remaining debug fprintf statements (34 lines) - Documentation: Change "Full Text" to "Full-Text" (hyphenated) Total: ~50 fixes across 10 files	5 months ago
Rene Cannao	a10c09bcc9	Fix PR #21 review: Security, memory safety, thread safety, and code cleanup Security fixes: - Add escape_identifier() helper for proper SQLite identifier escaping - Replace sanitize_name() with allowlist validation (ASCII letters, digits, underscore only) - Fix MATCH clause FTS5 operator injection by wrapping query in double quotes - Apply escape_identifier() to all DDL statements (CREATE, DROP, triggers) Memory safety fixes: - Replace VLA with std::vector in MySQL_FTS::init(), add delete on error path - Fix memory leak: free error string before return in list_indexes() - Fix reindex_json["error"] potential exception using .value() with default Thread safety fixes: - reinit_fts(): Add mutex lock around pointer swap - reset_fts_path(): Move blocking init() outside lock, only swap pointer under lock Code cleanup: - Remove 7 debug fprintf statements from Query_Tool_Handler.cpp - Remove unused #include <memory> from MySQL_FTS.h Test script security fixes: - Use MYSQL_PWD environment variable instead of -p"..." for password - Add escape_sql() function and apply to INSERT statement - Fix CURL_OPTS quoting: ${CURL_OPTS:+"${CURL_OPTS}"} - Remove unused FTS_INDEX_NAME and SEARCH_QUERIES variables Documentation fixes: - Fix bare URL to markdown link format - Add code block language identifiers (text, bash)	5 months ago
Rahim Kanji	18dd249438	Merge remote-tracking branch 'v3.1-vec' into v3.1_fts-support	5 months ago

Author

SHA1

Message

Date

Rene Cannao

02918d18b8

Fix PR #25 Review: All AI code reviewer feedback addressed

This commit addresses all recommendations from CodeRabbit, Gemini Code Assist,
and Copilot for PR #25 (FTS security and code quality improvements).

Critical Security Fixes:
- MCP_Thread.cpp: Rollback fts_path on reset failure to keep config consistent
- MySQL_FTS.cpp: Add escape_mysql_identifier() for MySQL query identifier escaping
- MySQL_FTS.cpp: Add unique hash-based fallback to sanitize_name() for empty strings
- MySQL_FTS.cpp: Add where_clause validation to block dangerous SQL patterns

Memory Safety Fixes:
- MySQL_FTS.cpp: Fix indexes_result memory leak on early return in search()
- MySQL_FTS.h: Delete copy/move operations to prevent accidental resource duplication

Thread Safety Documentation:
- MySQL_Tool_Handler.cpp: Add comment explaining FTS lock design rationale

Test Script Improvements:
- test_mcp_fts.sh: Add curl timeouts (5s connect, 30s max)
- test_mcp_fts.sh: Remove unused delete_response variable
- test_mcp_fts_detailed.sh: Make cleanup tolerant of non-existent indexes

Build Fixes:
- Makefile: Fix EXCLUDE_TRACKING_VARAIABLES typo to EXCLUDE_TRACKING_VARIABLES
- vector_db_performance-t.cpp: Fix printf format specifiers to %lld with cast

Schema Fixes:
- Query_Tool_Handler.cpp: Change fts_index_table columns schema from string to array

Code Cleanup:
- MySQL_Tool_Handler.cpp: Remove all remaining debug fprintf statements (34 lines)
- Documentation: Change "Full Text" to "Full-Text" (hyphenated)

Total: ~50 fixes across 10 files

Rene Cannao

a10c09bcc9

Fix PR #21 review: Security, memory safety, thread safety, and code cleanup

Security fixes:
- Add escape_identifier() helper for proper SQLite identifier escaping
- Replace sanitize_name() with allowlist validation (ASCII letters, digits, underscore only)
- Fix MATCH clause FTS5 operator injection by wrapping query in double quotes
- Apply escape_identifier() to all DDL statements (CREATE, DROP, triggers)

Memory safety fixes:
- Replace VLA with std::vector in MySQL_FTS::init(), add delete on error path
- Fix memory leak: free error string before return in list_indexes()
- Fix reindex_json["error"] potential exception using .value() with default

Thread safety fixes:
- reinit_fts(): Add mutex lock around pointer swap
- reset_fts_path(): Move blocking init() outside lock, only swap pointer under lock

Code cleanup:
- Remove 7 debug fprintf statements from Query_Tool_Handler.cpp
- Remove unused #include <memory> from MySQL_FTS.h

Test script security fixes:
- Use MYSQL_PWD environment variable instead of -p"..." for password
- Add escape_sql() function and apply to INSERT statement
- Fix CURL_OPTS quoting: ${CURL_OPTS:+"${CURL_OPTS}"}
- Remove unused FTS_INDEX_NAME and SEARCH_QUERIES variables

Documentation fixes:
- Fix bare URL to markdown link format
- Add code block language identifiers (text, bash)

Rahim Kanji

18dd249438

Merge remote-tracking branch 'v3.1-vec' into v3.1_fts-support

3 Commits (53bd4b60658d1e66712e88cc257abe352c84843d)