VYPR
Moderate severityNVD Advisory· Published Dec 31, 2005· Updated Apr 16, 2026

CVE-2005-4849

CVE-2005-4849

Description

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.derby:derbyMaven
< 10.1.2.110.1.2.1

Affected products

1
  • cpe:2.3:a:apache:derby:*:*:*:*:*:*:*:*
    Range: <=10.1.1.0

Patches

3
fd24a7590ff5

DERBY-530

https://github.com/apache/derbyKatherine MarsdenSep 18, 2005via ghsa
2 files changed · +8 7
  • java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/checkDriver.out+4 4 modified
    @@ -32,13 +32,13 @@ getUserName() = testuser
     CURRENT SCHEMA = TESTUSER
     Expected Exception:08006:DERBY SQL error: SQLCODE: -1, SQLSTATE: 08006, SQLERRMC: Database 'testcreatedb1' shutdown.
     testClientAttributes()
    -Connection info for connect(jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace.out, {})
    -getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace.out
    +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]/trace.out, {})
    +getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]/trace.out
     getUserName() = APP
     CURRENT SCHEMA = APP
      trace file exists
    -Connection info for connect(jdbc:derby://localhost:1527/testpropdb, {traceFile=[DERBY_SYSTEM_HOME]\trace2.out})
    -getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace2.out
    +Connection info for connect(jdbc:derby://localhost:1527/testpropdb, {traceFile=[DERBY_SYSTEM_HOME]/trace2.out})
    +getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]/trace2.out
     getUserName() = APP
     CURRENT SCHEMA = APP
      trace file exists
    
  • java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/checkDriver.java+4 3 modified
    @@ -360,12 +360,13 @@ private static void testConnect(Driver driver, String url, Properties info) thro
     	 * @return origString with derby.system.home path replaed with [DERBY_SYSTEM_HOME]
     	 */
     	private static String replaceSystemHome(String origString) {
    -		int offset = origString.indexOf(DERBY_SYSTEM_HOME);
    +		String replaceString = DERBY_SYSTEM_HOME + File.separator;
    +		int offset = origString.indexOf(replaceString);
     		if (offset == -1)
     			return origString;
     		else
    -			return origString.substring(0,offset) + "[DERBY_SYSTEM_HOME]"+ 
    -			origString.substring(offset + DERBY_SYSTEM_HOME.length());
    +			return origString.substring(0,offset) + "[DERBY_SYSTEM_HOME]/"+ 
    +			origString.substring(offset + replaceString.length());
     	}
     	
     }
    \ No newline at end of file
    
82d721fd53e3

DERBY-530

https://github.com/apache/derbyKatherine MarsdenSep 15, 2005via ghsa
12 files changed · +447 96
  • java/client/org/apache/derby/jdbc/ClientDriver.java+34 6 modified
    @@ -20,6 +20,9 @@
     
     package org.apache.derby.jdbc;
     
    +import java.util.Enumeration;
    +import java.util.Properties;
    +
     import org.apache.derby.client.am.Configuration;
     import org.apache.derby.client.am.ResourceUtilities;
     import org.apache.derby.client.am.SqlException;
    @@ -92,11 +95,11 @@ public java.sql.Connection connect(String url,
                 port = ClientDataSource.propertyDefault_portNumber;
             }
     
    -        // longDatabase is the databaseName and attributes.  This will be
    +        // database is the database name and attributes.  This will be
             // sent to network server as the databaseName
             String database = tokenizeDatabase(urlTokenizer, url); // "database"
             java.util.Properties augmentedProperties = tokenizeURLProperties(url, properties);
    -
    +        database = appendDatabaseAttributes(database,augmentedProperties);
     
             int traceLevel;
             try {
    @@ -129,8 +132,33 @@ public java.sql.Connection connect(String url,
             return conn;
         }
     
    -    public boolean acceptsURL(String url) throws java.sql.SQLException {
    -        java.util.StringTokenizer urlTokenizer = new java.util.StringTokenizer(url, "/:=; \t\n\r\f", true);
    +    /**
    +     * Append attributes to the database name except for user/password 
    +     * which are sent as part of the protocol.
    +     * Other attributes will  be sent to the server with the database name
    +     * Assumes augmentedProperties is not null
    +     * 
    +	 * @param database - Short database name
    +	 * @param augmentedProperties - Set of properties to append as attributes
    +	 * @return databaseName + attributes (e.g. mydb;create=true) 
    +	 */
    +	private String appendDatabaseAttributes(String database, Properties augmentedProperties) {
    +	
    +		StringBuffer longDatabase = new StringBuffer(database);
    +		for (Enumeration keys = augmentedProperties.keys(); keys.hasMoreElements() ;)
    +		{
    +			String key = (String) keys.nextElement();
    +			if (key.equals(ClientDataSource.propertyKey_user) || 
    +				key.equals(ClientDataSource.propertyKey_password))
    +				continue;
    +			longDatabase.append(";" + key + "=" + augmentedProperties.getProperty(key));
    +		}
    +		return longDatabase.toString();
    +	}
    +
    +	public boolean acceptsURL(String url) throws java.sql.SQLException {
    +        java.util.StringTokenizer urlTokenizer = 
    +        		new java.util.StringTokenizer(url, "/:=; \t\n\r\f", true);
             int protocol = tokenizeProtocol(url, urlTokenizer);
             return protocol != 0;
         }
    @@ -262,11 +290,11 @@ private static int tokenizeOptionalPortNumber(java.util.StringTokenizer urlToken
             }
         }
     
    -    //return database name and attributes
    +    //return database name
         private static String tokenizeDatabase(java.util.StringTokenizer urlTokenizer,
                                                String url) throws SqlException {
             try {
    -            String databaseName = urlTokenizer.nextToken(" \t\n\r\f");
    +            String databaseName = urlTokenizer.nextToken(" \t\n\r\f;");
                 return databaseName;
             } catch (java.util.NoSuchElementException e) {
                 // A null log writer is passed, because jdbc 1 sqlexceptions are automatically traced
    
  • java/testing/org/apache/derbyTesting/functionTests/master/checkDriver.out+29 0 modified
    @@ -1,4 +1,33 @@
    +jdbcCompliant() = true
    +driver.getMajorVersion() = EXPECTED VERSION
    +driver.getMinorVersion() = EXPECTED VERSION
     checking acceptsURL(jdbc:derby:wombat;create=true)
     checking acceptsURL(jdbc:derby://localhost:1527/wombat;create=true)
     checking acceptsURL(jdbc:derby:net://localhost:1527/wombat;create=true)
     checking acceptsURL(jdbc:db2j:wombat;create=true)
    +testEmbeddedAttributes()
    +Connection info for connect(jdbc:derby:testcreatedb1, {create=true})
    +getURL() = jdbc:derby:testcreatedb1
    +getUserName() = APP
    +CURRENT SCHEMA = APP
    +Connection info for connect(jdbc:derby:testcreatedb2;create=true, null)
    +getURL() = jdbc:derby:testcreatedb2
    +getUserName() = APP
    +CURRENT SCHEMA = APP
    +Connection info for connect(jdbc:derby:testpropdb, {user=APP, password=xxxx})
    +getURL() = jdbc:derby:testpropdb
    +getUserName() = APP
    +CURRENT SCHEMA = APP
    +Connection info for connect(jdbc:derby:testpropdb;user=testuser;password=testpass, null)
    +getURL() = jdbc:derby:testpropdb
    +getUserName() = testuser
    +CURRENT SCHEMA = TESTUSER
    +Connection info for connect(jdbc:derby:testpropdb;user=testusr, {password=testpass})
    +getURL() = jdbc:derby:testpropdb
    +getUserName() = testusr
    +CURRENT SCHEMA = TESTUSR
    +Connection info for connect(jdbc:derby:testpropdb;user=testuser;password=testpass, null)
    +getURL() = jdbc:derby:testpropdb
    +getUserName() = testuser
    +CURRENT SCHEMA = TESTUSER
    +Expected Exception:08006:Database 'testcreatedb1' shutdown.
    
  • java/testing/org/apache/derbyTesting/functionTests/master/DerbyNet/checkDriver.out+7 0 added
    @@ -0,0 +1,7 @@
    +jdbcCompliant() = true
    +driver.getMajorVersion() = EXPECTED VERSION
    +driver.getMinorVersion() = EXPECTED VERSION
    +checking acceptsURL(jdbc:derby:wombat;create=true)
    +checking acceptsURL(jdbc:derby://localhost:1527/wombat;create=true)
    +checking acceptsURL(jdbc:derby:net://localhost:1527/wombat;create=true)
    +checking acceptsURL(jdbc:db2j:wombat;create=true)
    
  • java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/checkDriver.out+44 0 added
    @@ -0,0 +1,44 @@
    +jdbcCompliant() = true
    +driver.getMajorVersion() = EXPECTED VERSION
    +driver.getMinorVersion() = EXPECTED VERSION
    +checking acceptsURL(jdbc:derby:wombat;create=true)
    +checking acceptsURL(jdbc:derby://localhost:1527/wombat;create=true)
    +checking acceptsURL(jdbc:derby:net://localhost:1527/wombat;create=true)
    +checking acceptsURL(jdbc:db2j:wombat;create=true)
    +testEmbeddedAttributes()
    +Connection info for connect(jdbc:derby://localhost:1527/testcreatedb1, {create=true})
    +getURL() = jdbc:derby://localhost:1527/testcreatedb1;create=true
    +getUserName() = APP
    +CURRENT SCHEMA = APP
    +Connection info for connect(jdbc:derby://localhost:1527/testcreatedb2;create=true, null)
    +getURL() = jdbc:derby://localhost:1527/testcreatedb2;create=true
    +getUserName() = APP
    +CURRENT SCHEMA = APP
    +Connection info for connect(jdbc:derby://localhost:1527/testpropdb, {user=APP, password=xxxx})
    +getURL() = jdbc:derby://localhost:1527/testpropdb
    +getUserName() = APP
    +CURRENT SCHEMA = APP
    +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;user=testuser;password=testpass, null)
    +getURL() = jdbc:derby://localhost:1527/testpropdb
    +getUserName() = testuser
    +CURRENT SCHEMA = TESTUSER
    +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;user=testusr, {password=testpass})
    +getURL() = jdbc:derby://localhost:1527/testpropdb
    +getUserName() = testusr
    +CURRENT SCHEMA = TESTUSR
    +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;user=testuser;password=testpass, null)
    +getURL() = jdbc:derby://localhost:1527/testpropdb
    +getUserName() = testuser
    +CURRENT SCHEMA = TESTUSER
    +Expected Exception:08006:DERBY SQL error: SQLCODE: -1, SQLSTATE: 08006, SQLERRMC: Database 'testcreatedb1' shutdown.
    +testClientAttributes()
    +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace.out, {})
    +getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace.out
    +getUserName() = APP
    +CURRENT SCHEMA = APP
    + trace file exists
    +Connection info for connect(jdbc:derby://localhost:1527/testpropdb, {traceFile=[DERBY_SYSTEM_HOME]\trace2.out})
    +getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace2.out
    +getUserName() = APP
    +CURRENT SCHEMA = APP
    + trace file exists
    
  • java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/secureUsers.out+44 44 modified
    @@ -98,11 +98,11 @@ ij(CONNECTION2)> connect 'wombat;user=francois;password=paceesalute';
     ij(CONNECTION3)> -- Invalid ones:
     connect 'wombat;user=Jamie;password=theHooligan';
     ij(CONNECTION4)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;create=true;user=kreg;password=IwasBornReady
    -CONNECTION1 - 	jdbc:derby://localhost:1527/wombat;user=jeff;password=homeRun
    -CONNECTION2 - 	jdbc:derby://localhost:1527/wombat;user=howardR;password=takeItEasy
    -CONNECTION3 - 	jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute
    -CONNECTION4* - 	jdbc:derby://localhost:1527/wombat;user=Jamie;password=theHooligan
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;create=true
    +CONNECTION1 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION2 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION3 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION4* - 	jdbc:derby://localhost:1527/wombat
     * = current connection
     ij(CONNECTION4)> connect 'guestSchemeDB;user=kreg;password=IwasBornReady';
     ij(CONNECTION5)> connect 'guestSchemeDB;user=jeff;password=homeRun';
    @@ -111,16 +111,16 @@ ij(CONNECTION7)> connect 'guestSchemeDB;user=francois;password=paceesalute';
     ij(CONNECTION8)> -- Invalid ones:
     connect 'guestSchemeDB;user=Jamie;password=theHooligan';
     ij(CONNECTION9)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;create=true;user=kreg;password=IwasBornReady
    -CONNECTION1 - 	jdbc:derby://localhost:1527/wombat;user=jeff;password=homeRun
    -CONNECTION2 - 	jdbc:derby://localhost:1527/wombat;user=howardR;password=takeItEasy
    -CONNECTION3 - 	jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute
    -CONNECTION4 - 	jdbc:derby://localhost:1527/wombat;user=Jamie;password=theHooligan
    -CONNECTION5 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=kreg;password=IwasBornReady
    -CONNECTION6 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=jeff;password=homeRun
    -CONNECTION7 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=howardR;password=takeItEasy
    -CONNECTION8 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=francois;password=paceesalute
    -CONNECTION9* - 	jdbc:derby://localhost:1527/guestSchemeDB;user=Jamie;password=theHooligan
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;create=true
    +CONNECTION1 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION2 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION3 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION4 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION5 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION6 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION7 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION8 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION9* - 	jdbc:derby://localhost:1527/guestSchemeDB
     * = current connection
     ij(CONNECTION9)> connect 'derbySchemeDB;user=mamta;password=ieScape';
     ij(CONNECTION10)> connect 'derbySchemeDB;user=dan;password=makeItFaster';
    @@ -131,19 +131,19 @@ ERROR (no SQLState): Connection authorization failure occurred.  Reason: userid
     ij(CONNECTION12)> connect 'derbySchemeDB;user=francois;password=paceesalute';
     ERROR (no SQLState): Connection authorization failure occurred.  Reason: userid invalid.
     ij(CONNECTION12)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;create=true;user=kreg;password=IwasBornReady
    -CONNECTION1 - 	jdbc:derby://localhost:1527/wombat;user=jeff;password=homeRun
    -CONNECTION10 - 	jdbc:derby://localhost:1527/derbySchemeDB;user=mamta;password=ieScape
    -CONNECTION11 - 	jdbc:derby://localhost:1527/derbySchemeDB;user=dan;password=makeItFaster
    -CONNECTION12* - 	jdbc:derby://localhost:1527/derbySchemeDB;user=martin;password=obfuscateIt
    -CONNECTION2 - 	jdbc:derby://localhost:1527/wombat;user=howardR;password=takeItEasy
    -CONNECTION3 - 	jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute
    -CONNECTION4 - 	jdbc:derby://localhost:1527/wombat;user=Jamie;password=theHooligan
    -CONNECTION5 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=kreg;password=IwasBornReady
    -CONNECTION6 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=jeff;password=homeRun
    -CONNECTION7 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=howardR;password=takeItEasy
    -CONNECTION8 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=francois;password=paceesalute
    -CONNECTION9 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=Jamie;password=theHooligan
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;create=true
    +CONNECTION1 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION10 - 	jdbc:derby://localhost:1527/derbySchemeDB
    +CONNECTION11 - 	jdbc:derby://localhost:1527/derbySchemeDB
    +CONNECTION12* - 	jdbc:derby://localhost:1527/derbySchemeDB
    +CONNECTION2 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION3 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION4 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION5 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION6 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION7 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION8 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION9 - 	jdbc:derby://localhost:1527/guestSchemeDB
     * = current connection
     ij(CONNECTION12)> connect 'simpleSchemeDB;user=jeff;password=homeRun';
     ij(CONNECTION13)> connect 'simpleSchemeDB;user=howardR;password=takeItEasy';
    @@ -159,22 +159,22 @@ ERROR (no SQLState): Connection authorization failure occurred.  Reason: userid
     ij(CONNECTION15)> connect 'simpleSchemeDB;user=francois;password=corsica';
     ERROR (no SQLState): Connection authorization failure occurred.  Reason: userid invalid.
     ij(CONNECTION15)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;create=true;user=kreg;password=IwasBornReady
    -CONNECTION1 - 	jdbc:derby://localhost:1527/wombat;user=jeff;password=homeRun
    -CONNECTION10 - 	jdbc:derby://localhost:1527/derbySchemeDB;user=mamta;password=ieScape
    -CONNECTION11 - 	jdbc:derby://localhost:1527/derbySchemeDB;user=dan;password=makeItFaster
    -CONNECTION12 - 	jdbc:derby://localhost:1527/derbySchemeDB;user=martin;password=obfuscateIt
    -CONNECTION13 - 	jdbc:derby://localhost:1527/simpleSchemeDB;user=jeff;password=homeRun
    -CONNECTION14 - 	jdbc:derby://localhost:1527/simpleSchemeDB;user=howardR;password=takeItEasy
    -CONNECTION15* - 	jdbc:derby://localhost:1527/simpleSchemeDB;user=francois;password=paceesalute
    -CONNECTION2 - 	jdbc:derby://localhost:1527/wombat;user=howardR;password=takeItEasy
    -CONNECTION3 - 	jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute
    -CONNECTION4 - 	jdbc:derby://localhost:1527/wombat;user=Jamie;password=theHooligan
    -CONNECTION5 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=kreg;password=IwasBornReady
    -CONNECTION6 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=jeff;password=homeRun
    -CONNECTION7 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=howardR;password=takeItEasy
    -CONNECTION8 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=francois;password=paceesalute
    -CONNECTION9 - 	jdbc:derby://localhost:1527/guestSchemeDB;user=Jamie;password=theHooligan
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;create=true
    +CONNECTION1 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION10 - 	jdbc:derby://localhost:1527/derbySchemeDB
    +CONNECTION11 - 	jdbc:derby://localhost:1527/derbySchemeDB
    +CONNECTION12 - 	jdbc:derby://localhost:1527/derbySchemeDB
    +CONNECTION13 - 	jdbc:derby://localhost:1527/simpleSchemeDB
    +CONNECTION14 - 	jdbc:derby://localhost:1527/simpleSchemeDB
    +CONNECTION15* - 	jdbc:derby://localhost:1527/simpleSchemeDB
    +CONNECTION2 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION3 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION4 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION5 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION6 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION7 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION8 - 	jdbc:derby://localhost:1527/guestSchemeDB
    +CONNECTION9 - 	jdbc:derby://localhost:1527/guestSchemeDB
     * = current connection
     ij(CONNECTION15)> disconnect all;
     ij> show connections;
    
  • java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/users2.out+17 17 modified
    @@ -72,12 +72,12 @@ ERROR 25502: An SQL data change is not permitted for a read-only connection, use
     ij(CONNECTION5)> create table APP.t2(c1 char(30));
     ERROR 25503: DDL is not permitted for a read-only connection, user or database.
     ij(CONNECTION5)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;user=system;password=manager
    -CONNECTION1 - 	jdbc:derby://localhost:1527/wombat;user=kreg;password=visualWhat?
    -CONNECTION2 - 	jdbc:derby://localhost:1527/wombat;user=jeff;password=HomeRun61
    -CONNECTION3 - 	jdbc:derby://localhost:1527/wombat;user=ames;password=AnyVolunteer?
    -CONNECTION4 - 	jdbc:derby://localhost:1527/wombat;user=howardR;password=IamBetterAtTennis
    -CONNECTION5* - 	jdbc:derby://localhost:1527/wombat;user=jamie;password=MrNamePlates
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION1 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION2 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION3 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION4 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION5* - 	jdbc:derby://localhost:1527/wombat
     * = current connection
     ij(CONNECTION5)> disconnect all;
     ij> -- check allowed users in myDB db.
    @@ -169,13 +169,13 @@ FRANCOIS
     ij(CONNECTION6)> update APP.t1 set c1 = USER;
     ERROR 23513: The check constraint 'xxxxGENERATED-IDxxxx' was violated while performing an INSERT or UPDATE on table 'APP.T1'.
     ij(CONNECTION6)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/myDB;user=system;password=manager
    -CONNECTION1 - 	jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu
    -CONNECTION2 - 	jdbc:derby://localhost:1527/myDB;user=kreg;password=visualWhat?
    -CONNECTION3 - 	jdbc:derby://localhost:1527/myDB;user=ames;password=AnyVolunteer?
    -CONNECTION4 - 	jdbc:derby://localhost:1527/myDB;user=dan;password=MakeItFaster
    -CONNECTION5 - 	jdbc:derby://localhost:1527/myDB;user=francois;password=paceesalute
    -CONNECTION6* - 	jdbc:derby://localhost:1527/myDB;user=jamie;password=MrNamePlates
    +CONNECTION0 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION1 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION2 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION3 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION4 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION5 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION6* - 	jdbc:derby://localhost:1527/myDB
     * = current connection
     ij(CONNECTION6)> disconnect all;
     ij> --
    @@ -201,7 +201,7 @@ ij> connect 'wombat;user=jerry;password=SacreBleu';
     ERROR (no SQLState): Connection authorization failure occurred.  Reason: userid invalid.
     ij> connect 'wombat;user=jamie;password=MrNamePlates';
     ij> show connections;
    -CONNECTION0* - 	jdbc:derby://localhost:1527/wombat;user=jamie;password=MrNamePlates
    +CONNECTION0* - 	jdbc:derby://localhost:1527/wombat
     * = current connection
     ij> connect 'wombat;user=francois;password=paceesalute';
     ij(CONNECTION1)> connect 'myDB;user=jerry;password=SacreBleu';
    @@ -213,9 +213,9 @@ ERROR (no SQLState): Connection authorization failure occurred.  Reason: userid
     ij(CONNECTION2)> connect 'wombat;user=jerry;password=SacreBleu;shutdown=true';
     ERROR (no SQLState): Connection authorization failure occurred.  Reason: userid invalid.
     ij(CONNECTION2)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;user=jamie;password=MrNamePlates
    -CONNECTION1 - 	jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute
    -CONNECTION2* - 	jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION1 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION2* - 	jdbc:derby://localhost:1527/myDB
     * = current connection
     ij(CONNECTION2)> disconnect all;
     ij> show connections;
    
  • java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/users.out+15 15 modified
    @@ -36,11 +36,11 @@ ij(CONNECTION1)> connect 'wombat;user=ames;password=AnyVolunteer?';
     ij(CONNECTION2)> connect 'wombat;user=howardR;password=IamBetterAtTennis';
     ij(CONNECTION3)> connect 'wombat;user=francois;password=paceesalute';
     ij(CONNECTION4)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;user=kreg;password=visualWhat?
    -CONNECTION1 - 	jdbc:derby://localhost:1527/wombat;user=jeff;password=HomeRun61
    -CONNECTION2 - 	jdbc:derby://localhost:1527/wombat;user=ames;password=AnyVolunteer?
    -CONNECTION3 - 	jdbc:derby://localhost:1527/wombat;user=howardR;password=IamBetterAtTennis
    -CONNECTION4* - 	jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION1 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION2 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION3 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION4* - 	jdbc:derby://localhost:1527/wombat
     * = current connection
     ij(CONNECTION4)> disconnect all;
     ij> -- check allowed users in myDB db.
    @@ -84,12 +84,12 @@ FRANCOIS
     ij(CONNECTION5)> update APP.t1 set c1 = USER;
     ERROR 23513: The check constraint 'xxxxGENERATED-IDxxxx' was violated while performing an INSERT or UPDATE on table 'APP.T1'.
     ij(CONNECTION5)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu
    -CONNECTION1 - 	jdbc:derby://localhost:1527/myDB;user=kreg;password=visualWhat?
    -CONNECTION2 - 	jdbc:derby://localhost:1527/myDB;user=ames;password=AnyVolunteer?
    -CONNECTION3 - 	jdbc:derby://localhost:1527/myDB;user=dan;password=MakeItFaster
    -CONNECTION4 - 	jdbc:derby://localhost:1527/myDB;user=francois;password=paceesalute
    -CONNECTION5* - 	jdbc:derby://localhost:1527/myDB;user=jamie;password=MrNamePlates
    +CONNECTION0 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION1 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION2 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION3 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION4 - 	jdbc:derby://localhost:1527/myDB
    +CONNECTION5* - 	jdbc:derby://localhost:1527/myDB
     * = current connection
     ij(CONNECTION5)> disconnect all;
     ij> --
    @@ -127,8 +127,8 @@ ERROR (no SQLState): Connection authorization failure occurred.  Reason: userid
     ij(CONNECTION1)> connect 'wombat;user=jerry;password=SacreBleu;shutdown=true';
     ERROR 04501: DERBY SQL error: SQLCODE: -1, SQLSTATE: 04501, SQLERRMC: Database connection refused.
     ij(CONNECTION1)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute
    -CONNECTION1* - 	jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION1* - 	jdbc:derby://localhost:1527/myDB
     * = current connection
     ij(CONNECTION1)> -- Database shutdown - check user - should succeed
     ----- beetle 5367
    @@ -137,8 +137,8 @@ ERROR 08006: DERBY SQL error: SQLCODE: -1, SQLSTATE: 08006, SQLERRMC: Database '
     ij(CONNECTION1)> connect 'myDB;user=jerry;password=SacreBleu;shutdown=true';
     ERROR 08006: DERBY SQL error: SQLCODE: -1, SQLSTATE: 08006, SQLERRMC: Database 'myDB' shutdown.
     ij(CONNECTION1)> show connections;
    -CONNECTION0 - 	jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute
    -CONNECTION1* - 	jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu
    +CONNECTION0 - 	jdbc:derby://localhost:1527/wombat
    +CONNECTION1* - 	jdbc:derby://localhost:1527/myDB
     * = current connection
     ij(CONNECTION1)> -- JBMS System shutdown - check user - should fail
     connect ';user=jamie;password=LetMeIn;shutdown=true';
    
  • java/testing/org/apache/derbyTesting/functionTests/suites/jdbcapi.runall+1 0 modified
    @@ -1,5 +1,6 @@
     jdbcapi/bestrowidentifier.sql
     jdbcapi/characterStreams.java
    +jdbcapi/checkDriver.java
     jdbcapi/nullSQLText.java
     jdbcapi/prepStmtMetaData.java
     jdbcapi/resultset.java
    
  • java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/checkDriver_app.properties+3 0 modified
    @@ -1,4 +1,7 @@
     #Exclude for J2ME/Foundation - test requires java.sql.Driver
     runwithfoundation=false
    +#Exclude with jdk13 - test call JDBC30 methods
    +runwithjdk13=false
    +runwithibm13=false
     usedefaults=true
     
    
  • java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/checkDriver_derby.properties+20 0 added
    @@ -0,0 +1,20 @@
    +#
    +# This properties file is for the 'users' test.
    +# 
    +# This file is expected to be placed into $WS/systest/out by
    +# the run script, and expects to be run in an environment where
    +# the property derby.system.home points to $WS/systest/out.
    +#
    +derby.infolog.append=true
    +#derby.connection.requireAuthentication=true
    +derby.authentication.provider=BUILTIN
    +derby.debug.true=AuthenticationTrace
    +
    +#
    +# Users definition
    +#
    +derby.user.testuser=testpass
    +derby.user.APP=xxxx
    +
    +# Database users restriction lists
    +derby.database.users.testpropdb=testuser,APP
    
  • java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/checkDriver.java+232 14 modified
    @@ -20,17 +20,22 @@
     
     package org.apache.derbyTesting.functionTests.tests.jdbcapi;
     import org.apache.derbyTesting.functionTests.util.TestUtil;
    +
    +import java.io.File;
    +import java.sql.DatabaseMetaData;
     import java.sql.Driver;
     import java.sql.DriverManager;
     import java.sql.Connection;
    +import java.sql.ResultSet;
     import java.sql.SQLException;
     import java.util.Properties;
    +import org.apache.derby.tools.JDBCDisplayUtil;
     
     /**
      * @author marsden
      *
      * This test tests java.sql.Driver methods.
    - * Right now it just tests acceptsURL.  
    + * Right now it just tests acceptsURL and some attributes  
      * Tests for getPropertyInfo need to be added. as well as connection attributes
      * 
      */
    @@ -42,6 +47,8 @@ public class checkDriver {
     	private static String JCC_URL = "jdbc:derby:net://localhost:1527/wombat;create=true";
     	private static String INVALID_URL = "jdbc:db2j:wombat;create=true";
     	
    +	private static String DERBY_SYSTEM_HOME = System.getProperty("derby.system.home");
    +	
     	// URLS to check.  New urls need to also be added to the acceptsUrl table
     	private static String[] urls = new String[]
     	{
    @@ -52,7 +59,10 @@ public class checkDriver {
     	};
     	
     	
    -	
    +	/**
    +	 * url prefix for this framework
    +	 */
    +	private static String frameworkPrefix;
     	
     	// The acceptsURLTable uses  the frameworkOffset column int he table 
     	// to check for valid results for each framework
    @@ -64,6 +74,7 @@ public class checkDriver {
     	private static int DERBYNET_OFFSET = 2;   // JCC
     	
     	static {
    +		frameworkPrefix = TestUtil.getJdbcUrlPrefix();
     		if (TestUtil.isEmbeddedFramework())
     			frameworkOffset = EMBEDDED_OFFSET;
     		else if (TestUtil.isDerbyNetClientFramework())
    @@ -87,19 +98,149 @@ else if (TestUtil.isJCCFramework())
     
     	public static void main(String[] args) {
     		try {
    -			Driver driver = loadAndCheckDriverForFramework();
    +			Driver driver = loadAndCheckDriverForFramework();			
     			checkAcceptsURL(driver);
    -		} catch (Exception e)
    +			testEmbeddedAttributes(driver);
    +			testClientAttributes(driver);
    +		}
    +		catch (SQLException se)
    +		{
    +			while (se != null)
    +			{
    +				se.printStackTrace(System.out);
    +				se = se.getNextException();
    +			}
    +		}
    +		catch (Throwable e)
     		{
    -			e.printStackTrace();
    +			e.printStackTrace(System.out);
     		}
    +		
     	}
     	
     
     	/**
    +	 * Tests that client side attributes cann be specified in either url or info argument to connect.
    +	 * DERBY"-530. 
    +	 * 
    +	 * TODO: Add more comprehensive client attribute testing and enhance to handle jcc attributes in url. 
     	 * 
     	 * @param driver
     	 */
    +	private static void testClientAttributes(Driver driver) throws SQLException
    +	{
    +		if (!TestUtil.isDerbyNetClientFramework())
    +			return;
    +		
    +		System.out.println("\ntestClientAttributes()");
    +		Properties info = new Properties();
    +
    +		// Note: we have to put the trace file in an absolute path because the 
    +		// test harness sets user.dir and this confuses the File api greatly.
    +		// We put it in DERBY_SYSTEM_HOME since that is always available when 
    +		// tests are run
    +		String traceDirectory = DERBY_SYSTEM_HOME
    +			+ File.separator;
    +		String traceFile= traceDirectory + "trace.out";
    +		
    +		//		 traceFile attribute in url
    +		testConnect(driver, frameworkPrefix + "testpropdb;traceFile=" + 
    +					traceFile,info);
    +		assertTraceFileExists(traceFile);
    +		
    +		traceFile = traceDirectory + "trace2.out";
    +		
    +		// traceFile attribute in property
    +		info.setProperty("traceFile",traceFile);
    +		testConnect(driver, frameworkPrefix + "testpropdb",info);
    +		assertTraceFileExists(traceFile);
    +
    +	}
    +
    +
    +
    +	/**
    +	 * Check that trace file exists in <framework> directory
    +	 * 
    +	 * @param filename Name of trace file
    +	 */
    +	private static void assertTraceFileExists(String filename) 
    +	{
    +		File traceFile = new File(filename);
    +		//System.out.println("user.dir=" + System.getProperty("user.dir"));
    +		//System.out.println("fullpath = " + traceFile.getAbsolutePath());
    +		boolean exists = traceFile.exists();
    +		if (! exists)
    +			new Exception("FAILED trace file: " + filename + " does not exist").printStackTrace(System.out); 
    +		else
    +			System.out.println(" trace file exists");
    +			
    +	}
    +
    +
    +	/**
    +	 * Tests that embedded attributes can be specified in either url or info argument to connect
    +	 * DERBY-530. Only valid for emebedded driver and client. JCC has a different url format for 
    +	 * embedded attributes
    +	 * 
    +	 * @param driver
    +	 */
    +	private static void testEmbeddedAttributes(Driver driver) throws SQLException
    +	{
    +		// JCC can't take embedded attributes in info or as normal url attributes,
    +		// so not tested here.
    +		if (TestUtil.isJCCFramework())
    +			return;
    +		
    +		System.out.println("\ntestEmbeddedAttributes()");
    +		Properties info = new Properties();
    +		// create attribute as property
    +		info.setProperty("create","true");
    +		testConnect(driver, frameworkPrefix + "testcreatedb1", info);
    +		
    +		// create attribute in url
    +		testConnect(driver, frameworkPrefix + "testcreatedb2;create=true", null);
    +		
    +		// user/password in properties
    +		// testpropdb was created in load and test driver
    +		info.clear();
    +		info.setProperty("user","APP");
    +		info.setProperty("password", "xxxx");
    +		testConnect(driver, frameworkPrefix + "testpropdb", info);
    +		
    +		// user/password  in url
    +		testConnect(driver, frameworkPrefix + "testpropdb;user=testuser;password=testpass", null);
    +		
    +		// user in url, password in property
    +		info.clear();
    +		info.setProperty("password","testpass");
    +		testConnect(driver,frameworkPrefix + "testpropdb;user=testusr",info);
    +
    +		// different users in url and in properties. URL is the winner
    +		info.clear();
    +		info.setProperty("user","APP");
    +		info.setProperty("password","xxxx");
    +		testConnect(driver, frameworkPrefix + "testpropdb;user=testuser;password=testpass", null);
    +		
    +		// shutdown with properties
    +		info.clear();
    +		info.setProperty("shutdown","true");				
    +		try {
    +			testConnect(driver,frameworkPrefix + "testcreatedb1", info);
    +		} catch (SQLException se)
    +		{
    +			System.out.println("Expected Exception:" + se.getSQLState() + ":" + se.getMessage());
    +		}
    +	}
    +		
    +
    +	/**
    +	 * Check that drivers accept the correct urls and reject those for other supported drivers.
    +	 * 
    +	 * @param driver  driver we are testing.
    +	 * 
    +	 * @throws SQLException
    +	 */
     	private static void checkAcceptsURL(Driver driver) throws SQLException{
     		for (int u = 0; u < urls.length;u++)
     		{
    @@ -115,39 +256,116 @@ private static void checkAcceptsURL(Driver driver) throws SQLException{
     	}
     
     
    +	/**
    +	 * Load the driver and check java.sql.Driver methods, 
    +	 * @return
    +	 * @throws Exception
    +	 */
     	private static Driver loadAndCheckDriverForFramework() throws Exception	
     	{	
     		TestUtil.loadDriver();
    -			
    -		String frameworkURL = TestUtil.getJdbcUrlPrefix() + "wombat;create=true";
    -		TestUtil.loadDriver();
    +		String frameworkURL = TestUtil.getJdbcUrlPrefix() + "testpropdb;create=true";
     		
     		// Test that we loaded the right driver by making a connection
     		Driver driver = DriverManager.getDriver(frameworkURL);
     		Properties props = new Properties();
    -		props.put("user","APP");
    -		props.put("password","xxx");
    -		Connection conn = driver.connect(frameworkURL,props);
    -		//System.out.println("Successfully made connection for  " + conn.getMetaData().getDriverName());
    +		props.put("user","testuser");
    +		props.put("password","testpass");
    +		Connection conn = DriverManager.getConnection(frameworkURL, props);
    +		DatabaseMetaData dbmd = conn.getMetaData();
    +		System.out.println("jdbcCompliant() = " +  driver.jdbcCompliant());
    +		
    +		// Just check versions against database metadata to avoid more master updates.
    +		// Metadata test prints the actual version.
    +		
    +		int majorVersion = driver.getMajorVersion();
    +		if (majorVersion == dbmd.getDriverMajorVersion())
    +			System.out.println("driver.getMajorVersion() = EXPECTED VERSION");
    +		else 
    +			new Exception("FAILED: unexpected value for  getMajorVersion(): " +
    +						majorVersion).printStackTrace();
    +		
    +		int  minorVersion = driver.getMinorVersion();
    +		if (minorVersion == dbmd.getDriverMinorVersion())
    +			System.out.println("driver.getMinorVersion() = EXPECTED VERSION");
    +		else 
    +			new Exception("FAILED: unexpected value for getMinorVersion()" +
    +					minorVersion).printStackTrace(System.out);
    +		
     		conn.close();
    -		//System.out.println("jdbcCompliant = " +  driver.jdbcCompliant());	
     		return driver;
     	}
     		
     
     	
     	
    +	/**
    +	 * Check the actual return value of acceptsURL against the expected value and error and stack
    +	 * trace if they don't match
    +	 * 
    +	 * @param url URL that was checked for acceptsURL
    +	 * @param expectedAcceptance  expected return value 
    +	 * @param actualAcceptance    actual return value
    +	 * 
    +	 */
     	private static void assertExpectedURLAcceptance(String url, boolean expectedAcceptance, 
     				boolean actualAcceptance)
     	{
     		if (actualAcceptance != expectedAcceptance)
     		{
    -			new Exception("FAILED acceptURL check. url = " + url  + 
    +			new Exception("FAILED acceptsURL check. url = " + url  + 
     						   " expectedAcceptance = " + expectedAcceptance +
     						   " actualAcceptance = " + actualAcceptance).printStackTrace(System.out);
     		}
     
     	}
     	
    +	/**
    +	 * Make  java.sql.Driver.connect(String url, Properties info call) and print the status of
    +	 * the connection.
    +	 * 
    +	 * @param driver   driver for framework
    +	 * @param url       url to pass to Driver.connect()
    +	 * @param info      properties to pass to Driver.Connect()
    +	 * 
    +	 * @throws SQLException on error.
    +	 */
    +	private static void testConnect(Driver driver, String url, Properties info) throws SQLException
    +	{
    +		String infoString = null;
    +		if (info != null)
    +			infoString = replaceSystemHome(info.toString());
    +		String urlString = replaceSystemHome(url);
    +		Connection conn = driver.connect(url,info);
    +		
    +		System.out.println("\nConnection info for connect(" + urlString + ", " + infoString +")");
    +		String getUrlValue = conn.getMetaData().getURL();
    +		// URL may include path of DERBY_SYSTEM_HOME for traceFile
    +		// filter it out.
    +		getUrlValue = replaceSystemHome(getUrlValue);
    +		System.out.println("getURL() = " + getUrlValue);
    +		System.out.println("getUserName() = " + conn.getMetaData().getUserName());
    +		// CURRENT SCHEMA should match getUserName()
    +		ResultSet rs = conn.createStatement().executeQuery("VALUES(CURRENT SCHEMA)");
    +		rs.next();
    +		System.out.println("CURRENT SCHEMA = " + rs.getString(1));
    +		conn.close();
    +
    +	}
    +
    +
    +	/**
    +	 * @param origString
    +	 * 
    +	 * @return origString with derby.system.home path replaed with [DERBY_SYSTEM_HOME]
    +	 */
    +	private static String replaceSystemHome(String origString) {
    +		int offset = origString.indexOf(DERBY_SYSTEM_HOME);
    +		if (offset == -1)
    +			return origString;
    +		else
    +			return origString.substring(0,offset) + "[DERBY_SYSTEM_HOME]"+ 
    +			origString.substring(offset + DERBY_SYSTEM_HOME.length());
    +	}
     	
     }
    \ No newline at end of file
    
  • java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/copyfiles.ant+1 0 modified
    @@ -7,6 +7,7 @@ blobclob4BLOB_derby.properties
     bestrowidentifier.sql
     bestrowidentifier_app.properties
     checkDriver_app.properties
    +checkDriver_derby.properties
     dbMetaDataJdbc30_app.properties
     dbMetaDataJdbc30_sed.properties
     default_app.properties
    
09a7325f75a4

DERBY-561 - Embedded driver jdbcCompliant() method should return true

https://github.com/apache/derbyKatherine MarsdenSep 9, 2005via ghsa
1 file changed · +1 1
  • java/engine/org/apache/derby/jdbc/InternalDriver.java+1 1 modified
    @@ -209,7 +209,7 @@ public int getMinorVersion() {
     	}
    
     
    
     	public boolean jdbcCompliant() {
    
    -		return false;
    
    +		return true;
    
     	}
    
     
    
     	/*
    
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.