Information disclosure vulnerability with LOAD DATA LOCAL INFILE

[bgrainger]

A malicious server could respond with 0xFB C:\local\filename.ext to any COM_QUERY request, and MySqlConnector would transmit that file to the server. See https://dev.mysql.com/doc/refman/5.7/en/load-data-local.html for a full description.

The simplest mitigation would be to obfuscate all source file names in MySqlBulkLoader.LoadAsync; that is, if a file name is specified, open it for reading then treat it as a SourceStream. In ResultSet.ReadResultSetHeaderAsync, only allow "file names" that begin with MySqlBulkLoader.StreamPrefix. This would prohibit arbitrary filesystem paths from being requested.

This would break clients who manually construct a LOAD DATA LOCAL INFILE SQL statement and execute it. However this seems to be rare, and has a fairly simple workaround: switch to MySqlBulkLoader. We could also relax the "path must start with MySqlBulkLoader.StreamPrefix" requirement if SslMode is VerifyCA (or higher), as that implies we can trust the server; if we did that, another workaround would be to use a SSL certificate to connect to the server.

[bgrainger]

Fixed in 0.29.0.