{"action":"created","issue":{"url":"https://api.github.com/repos/perl5-dbi/DBD-mysql/issues/117","repository_url":"https://api.github.com/repos/perl5-dbi/DBD-mysql","labels_url":"https://api.github.com/repos/perl5-dbi/DBD-mysql/issues/117/labels{/name}","comments_url":"https://api.github.com/repos/perl5-dbi/DBD-mysql/issues/117/comments","events_url":"https://api.github.com/repos/perl5-dbi/DBD-mysql/issues/117/events","html_url":"https://github.com/perl5-dbi/DBD-mysql/issues/117","id":220004478,"number":117,"title":"4.042 improperly encoding blobs when sql_type is SQL_UNKNOWN_TYPE","user":{"login":"cthulhuology","id":88509,"avatar_url":"https://avatars2.githubusercontent.com/u/88509?v=3","gravatar_id":"","url":"https://api.github.com/users/cthulhuology","html_url":"https://github.com/cthulhuology","followers_url":"https://api.github.com/users/cthulhuology/followers","following_url":"https://api.github.com/users/cthulhuology/following{/other_user}","gists_url":"https://api.github.com/users/cthulhuology/gists{/gist_id}","starred_url":"https://api.github.com/users/cthulhuology/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cthulhuology/subscriptions","organizations_url":"https://api.github.com/users/cthulhuology/orgs","repos_url":"https://api.github.com/users/cthulhuology/repos","events_url":"https://api.github.com/users/cthulhuology/events{/privacy}","received_events_url":"https://api.github.com/users/cthulhuology/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":86,"created_at":"2017-04-06T19:20:15Z","updated_at":"2017-06-29T15:06:20Z","closed_at":null,"body":"The utf8 encoding changes have resulted in a regression that has unexpected side effects.\r\nConsider the following table:\r\n\r\n create table foo (foo longblob);\r\n\r\nand script:\r\n\r\nuse DBI;\r\n\r\nmy $dbh = DBI->connect('DBI:mysql:database=test','desktop','',{ mysql_enable_utf8 => 1 })\r\n    or die $DBI::errstr;\r\n\r\nmy $sth = $dbh->prepare('INSERT INTO foo (foo) values (?)');\r\n$sth->execute(\"I18N Web Testing æøå\");\r\n\r\nmy $rth = $dbh->prepare('SELECT foo FROM foo');\r\n$rth->execute();\r\nwhile (@row = $rth->fetchrow_array) {\r\n    print $row[0],\"\\n\";\r\n}\r\n\r\nNow the longblob mysql type should be considered a SQL_BLOB, but because the exec call doesn't call bind_param with the attrib set to SQL_BLOB, the default value of 0 is used SQL_UNKNOWN_TYPE and passed to bind_param.  If you sv_dump at 939 in dbdimp.c you'll see:\r\n\r\nSV = PV(0x162d950) at 0x15f8630\r\n  REFCNT = 1\r\n  FLAGS = (POK,IsCOW,READONLY,PROTECT,pPOK)\r\n  PV = 0x15dc200 \"I18N Web Testing \\303\\246\\303\\270\\303\\245\"\\0\r\n  CUR = 23\r\n  LEN = 25\r\n  COW_REFCNT = 0\r\n\r\nAnd sql_type is the default value of 0.\r\n\r\nthe output of the scrip will print the value stored in the database:\r\n\r\nI18N Web Testing Ã¦Ã¸Ã¥`\r\n\r\nbecause it is double encoding the characters, and not preserving the blob value because the\r\nsql_type_is_binary check returns false because the SQL_UNKNOWN_TYPE value of sql_type.\r\n\r\nOne example of widely used code that exhibit this behavior is Apache::Session (Apache::Session::MySQL), which calls bind_param explicitly but never passes the SQL_BLOB at and of the call sites.  Since Apache::Session is using a Storable (which is binary data stored in a blob) the additional UTF8 encoding can result in data corruption which can cause perl to crash with an OOM error when materialize is invoked.  This is a potential security threat."},"comment":{"url":"https://api.github.com/repos/perl5-dbi/DBD-mysql/issues/comments/311995788","html_url":"https://github.com/perl5-dbi/DBD-mysql/issues/117#issuecomment-311995788","issue_url":"https://api.github.com/repos/perl5-dbi/DBD-mysql/issues/117","id":311995788,"user":{"login":"nightlight1","id":29754111,"avatar_url":"https://avatars0.githubusercontent.com/u/29754111?v=3","gravatar_id":"","url":"https://api.github.com/users/nightlight1","html_url":"https://github.com/nightlight1","followers_url":"https://api.github.com/users/nightlight1/followers","following_url":"https://api.github.com/users/nightlight1/following{/other_user}","gists_url":"https://api.github.com/users/nightlight1/gists{/gist_id}","starred_url":"https://api.github.com/users/nightlight1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nightlight1/subscriptions","organizations_url":"https://api.github.com/users/nightlight1/orgs","repos_url":"https://api.github.com/users/nightlight1/repos","events_url":"https://api.github.com/users/nightlight1/events{/privacy}","received_events_url":"https://api.github.com/users/nightlight1/received_events","type":"User","site_admin":false},"created_at":"2017-06-29T15:06:20Z","updated_at":"2017-06-29T15:06:20Z","body":"I disagree with one that says it is necessary to revisit all manual pages of all modules an application depends on each time an application is upgraded. This is unfeasable, and undesired. Who starts reading all source code files of a module and read the manual pages of all its dependencies before starting to use it? Nobody.\r\n\r\nPlease read and respect the Perl policy that have been carefully put together by the community to maintain the quality of Perl as it is today.\r\n\r\n> If end-user developers have adopted a bug as a feature, we need to treat it as such.\r\n\r\n[http://perldoc.perl.org/perlpolicy.html#BACKWARD-COMPATIBILITY-AND-DEPRECATION](url)"}}
{"actor":{"display_login":"nightlight1"}}