Confirm MySQL SET forms that change server state

SET PASSWORD, SET GLOBAL and SET PERSIST (also as @@GLOBAL.x) change
the server or the database account rather than the session, so they
need confirmation like other writes. Session variables stay a read.
This commit is contained in:
2026-09-30 10:44:24 +02:00
parent 9861313961
commit bea30b94c9
2 changed files with 9 additions and 1 deletions
+6
View File
@@ -71,6 +71,8 @@ class SqlGuardTest extends TestCase
['SHOW search_path'],
['EXPLAIN SELECT 1'],
["SET myvar.uid = 'alice'"],
['SET @uid = 5'],
['SET SESSION sql_mode = \'\''],
["SELECT \$\$DELETE FROM x\$\$"],
["SELECT E'it\\'s delete' FROM t"],
['VALUES (1)'],
@@ -109,6 +111,10 @@ class SqlGuardTest extends TestCase
['EXPLAIN ANALYZE DELETE FROM t'],
['SET ROLE postgres'],
['SET SESSION AUTHORIZATION postgres'],
["SET PASSWORD = 'x'"],
['SET GLOBAL max_connections = 10'],
['SET PERSIST max_connections = 10'],
['SET @@GLOBAL.max_connections = 10'],
['SELECT pg_terminate_backend(123)'],
["SELECT set_config('x', 'y', false)"],
["SELECT setval('seq', 1)"],