Bug #72346 [Opn->Nab]: mysql_query() not subject to max_execution_time()
Edit report at https://bugs.php.net/bug.php?id=72346&edit=1
ID: 72346
Updated by: requinix@php.net
Reported by: maggus dot staab at googlemail dot com
Summary: mysql_query() not subject to max_execution_time()
-Status: Open
+Status: Not a bug
Type: Bug
-Package: *Database Functions
+Package: MySQL related
PHP Version: Irrelevant
Block user comment: N
Private report: N
New Comment:
As the docs for set_time_limit() say, the time limit only measures time spent in the script itself.
Database queries are not included because PHP is sleeping while those are running.
Server-side timeouts are the solution.
Previous Comments:
------------------------------------------------------------------------
[2016-06-06 16:26:35] maggus dot staab at googlemail dot com
fixed package
------------------------------------------------------------------------
[2016-06-06 16:04:13] maggus dot staab at googlemail dot com
Description:
------------
similar to https://bugs.php.net/bug.php?id=72345
A DOS attack vector for SQL injections uses the mysql SELECT SLEEP() command, as it will block a PHP
process which is waiting for the mysql result and also one connection to the database itself.
this renders this kind of attack as very effective because you easily can bring either apache/php or
mysql above its processlimits.
Additionally the mysql version distributed with ubuntu12lts and ubuntu14lts is not recent enough to
contain server side timouts on a per statement basis.
Test script:
---------------
<?php
$start = time();
set_time_limit(2);
define("DB_HOSTNAME", "localhost");
define("DB_USERNAME", "root");
define("DB_PASSWORD", "");
define("DB_NAME", "mysql");
$connection_id = mysql_connect(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, false);
mysql_query('SELECT SLEEP(5)', $connection_id);
$end = time();
echo $end - $start;
Expected result:
----------------
mysql query should be interrupted after 2 seconds with a fatal error
Actual result:
--------------
no error, no timeouts triggered.
echos "5"
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72346&edit=1
Thread (4 messages)