security(cdc): fix some security problems (#3700)

pingcap · Dec 6, 2021 · eed6f9b · eed6f9b
1 parent 9388e0b
commit eed6f9b
Show file tree

Hide file tree

Showing 10 changed files with 15 additions and 16 deletions.
diff --git a/cdc/server.go b/cdc/server.go
@@ -262,7 +262,7 @@ func (s *Server) initDataDir(ctx context.Context) error {
 		return errors.Trace(err)
 	}
 	conf := config.GetGlobalServerConfig()
-	err := os.MkdirAll(conf.DataDir, 0o755)
+	err := os.MkdirAll(conf.DataDir, 0o700)
 	if err != nil {
 		return errors.Trace(err)
 	}
@@ -316,7 +316,7 @@ func findBestDataDir(candidates []string) (result string, ok bool) {
 	var low uint64 = 0
 
 	checker := func(dir string) (*util.DiskInfo, error) {
-		if err := os.MkdirAll(dir, 0o755); err != nil {
+		if err := os.MkdirAll(dir, 0o700); err != nil {
 			return nil, err
 		}
 		if err := util.IsDirReadWritable(dir); err != nil {

diff --git a/cdc/sink/producer/kafka/config.go b/cdc/sink/producer/kafka/config.go
@@ -72,7 +72,7 @@ func (c *Config) CompleteByOpts(sinkURI *url.URL, replicaConfig *config.ReplicaC
 	params := sinkURI.Query()
 	s := params.Get("partition-num")
 	if s != "" {
-		a, err := strconv.Atoi(s)
+		a, err := strconv.ParseInt(s, 10, 32)
 		if err != nil {
 			return err
 		}
@@ -84,7 +84,7 @@ func (c *Config) CompleteByOpts(sinkURI *url.URL, replicaConfig *config.ReplicaC
 
 	s = params.Get("replication-factor")
 	if s != "" {
-		a, err := strconv.Atoi(s)
+		a, err := strconv.ParseInt(s, 10, 16)
 		if err != nil {
 			return err
 		}

diff --git a/cdc/sorter/unified/file_backend.go b/cdc/sorter/unified/file_backend.go
@@ -65,7 +65,7 @@ func newFileBackEnd(fileName string, serde encoding.SerializerDeserializer) (*fi
 }
 
 func (f *fileBackEnd) reader() (backEndReader, error) {
-	fd, err := os.OpenFile(f.fileName, os.O_RDWR, 0o644)
+	fd, err := os.OpenFile(f.fileName, os.O_RDWR, 0o600)
 	if err != nil {
 		return nil, errors.Trace(wrapIOError(err))
 	}
@@ -103,7 +103,7 @@ func (f *fileBackEnd) reader() (backEndReader, error) {
 }
 
 func (f *fileBackEnd) writer() (backEndWriter, error) {
-	fd, err := os.OpenFile(f.fileName, os.O_TRUNC|os.O_RDWR, 0o644)
+	fd, err := os.OpenFile(f.fileName, os.O_TRUNC|os.O_RDWR, 0o600)
 	if err != nil {
 		return nil, errors.Trace(wrapIOError(err))
 	}

diff --git a/cdc/sorter/unified/unified_sorter.go b/cdc/sorter/unified/unified_sorter.go
@@ -69,7 +69,7 @@ func CheckDir(cfSortDir string) error {
 	err := util.IsDirAndWritable(dir)
 	if err != nil {
 		if os.IsNotExist(errors.Cause(err)) {
-			err = os.MkdirAll(dir, 0o755)
+			err = os.MkdirAll(dir, 0o700)
 			if err != nil {
 				return errors.Annotate(cerror.WrapError(cerror.ErrProcessorSortDir, err), "create dir")
 			}

diff --git a/cmd/kafka-consumer/main.go b/cmd/kafka-consumer/main.go
@@ -117,7 +117,7 @@ func init() {
 		}
 		kafkaPartitionNum = partition
 	} else {
-		c, err := strconv.Atoi(s)
+		c, err := strconv.ParseInt(s, 10, 32)
 		if err != nil {
 			log.Fatal("invalid partition-num of upstream-uri")
 		}

diff --git a/pkg/filelock/filelock.go b/pkg/filelock/filelock.go
@@ -30,7 +30,7 @@ type FileLock struct {
 
 // NewFileLock creates a new file lock on the file described in filePath.
 func NewFileLock(filePath string) (*FileLock, error) {
-	file, err := os.OpenFile(filePath, os.O_RDWR|os.O_CREATE|syscall.O_NONBLOCK, 0o666)
+	file, err := os.OpenFile(filePath, os.O_RDWR|os.O_CREATE|syscall.O_NONBLOCK, 0o600)
 	if err != nil {
 		return nil, errors.Trace(err)
 	}

diff --git a/tests/integration_tests/bank/case.go b/tests/integration_tests/bank/case.go
@@ -619,11 +619,10 @@ func getDownStreamSyncedEndTs(ctx context.Context, db *sql.DB, tableName string)
 }
 
 func tryGetEndTs(db *sql.DB, tableName string) (result string, ok bool) {
-	query := fmt.Sprintf("admin show ddl jobs where table_name = '%s'", tableName)
+	query := "admin show ddl jobs where table_name = ?"
 	log.Info("try get end ts", zap.String("query", query))
-
 	var line dataRow
-	row := db.QueryRow(query)
+	row := db.QueryRow(query, tableName)
 	if err := row.Scan(&line.JobID, &line.DBName, &line.TblName, &line.JobType, &line.SchemaState, &line.SchemeID,
 		&line.TblID, &line.RowCount, &line.StartTime, &line.EndTime, &line.State); err != nil {
 		if err != sql.ErrNoRows {

diff --git a/tests/integration_tests/resolve_lock/main.go b/tests/integration_tests/resolve_lock/main.go
@@ -142,7 +142,7 @@ func getTableID(dbAddr, dbName, table string) (int64, error) {
 	dbStatusAddr := net.JoinHostPort(dbAddr, "10080")
 	url := fmt.Sprintf("http://%s/schema/%s/%s", dbStatusAddr, dbName, table)
 
-	resp, err := http.Get(url)
+	resp, err := http.Get(url) // #nosec G107
 	if err != nil {
 		return 0, errors.Trace(err)
 	}

diff --git a/tests/utils/many_sorters_test/many_sorters.go b/tests/utils/many_sorters_test/many_sorters.go
@@ -65,7 +65,7 @@ func main() {
 		_ = http.ListenAndServe("localhost:6060", nil)
 	}()
 
-	err = os.MkdirAll(*sorterDir, 0o755)
+	err = os.MkdirAll(*sorterDir, 0o700)
 	if err != nil {
 		log.Error("sorter_stress_test:", zap.Error(err))
 	}

diff --git a/tests/utils/sorter_stress_test/sorter_stress.go b/tests/utils/sorter_stress_test/sorter_stress.go
@@ -18,7 +18,7 @@ import (
 	"flag"
 	"math/rand"
 	"net/http"
-	_ "net/http/pprof"
+	_ "net/http/pprof" // #nosec G108
 	"os"
 	"strings"
 
@@ -61,7 +61,7 @@ func main() {
 		_ = http.ListenAndServe("localhost:6060", nil)
 	}()
 
-	err = os.MkdirAll(*sorterDir, 0o755)
+	err = os.MkdirAll(*sorterDir, 0o700)
 	if err != nil {
 		log.Error("sorter_stress_test:", zap.Error(err))
 	}