OWASP / OWASP/SecurityShepherd

Fix issue with MySQL GRANTS for moduleSchema.sql

Open
#388 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
1.5k
Forks
515
Avg merge
3h 46m
Merged PRs (30d)
1

Description

Currently GRANTS are hardcoded to localhost in the moduleSchema.sql

https://github.com/OWASP/SecurityShepherd/blob/18513600910351e622acbf3efbc49a288379cf28/src/main/resources/database/moduleSchemas.sql#L1236

This causes issues when trying to have MySQL on a different host / IP.

Possibly these can be dynamically set from the setup.jsp screen where the user must enter the host of the DB. Possibly restricting this to IP as adding hostname lookup in MySQL slows down performance e.g.

Slow
https://github.com/OWASP/SecurityShepherd/blob/18513600910351e622acbf3efbc49a288379cf28/docker/mysql/Dockerfile#L12

Fast
https://github.com/docker-library/mysql/blob/333935aa6612376d58737a8cab0e3f5df370585a/5.5/Dockerfile#L66

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with src/main/resources/database/moduleSchemas.sql at the referenced GRANTS, then trace how the database host is collected in setup.jsp. Review docker/mysql/Dockerfile and the linked MySQL image Dockerfile to understand the hostname-resolution concern. Done means MySQL can run on a non-local host without hardcoded localhost grants, with the intended host restriction documented or tested.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, mysql
Domain
database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.