Moderate severityNVD Advisory· Published Dec 31, 2005· Updated Apr 16, 2026
CVE-2005-4849
CVE-2005-4849
Description
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.derby:derbyMaven | < 10.1.2.1 | 10.1.2.1 |
Affected products
1Patches
32 files changed · +8 −7
java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/checkDriver.out+4 −4 modified@@ -32,13 +32,13 @@ getUserName() = testuser CURRENT SCHEMA = TESTUSER Expected Exception:08006:DERBY SQL error: SQLCODE: -1, SQLSTATE: 08006, SQLERRMC: Database 'testcreatedb1' shutdown. testClientAttributes() -Connection info for connect(jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace.out, {}) -getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace.out +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]/trace.out, {}) +getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]/trace.out getUserName() = APP CURRENT SCHEMA = APP trace file exists -Connection info for connect(jdbc:derby://localhost:1527/testpropdb, {traceFile=[DERBY_SYSTEM_HOME]\trace2.out}) -getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace2.out +Connection info for connect(jdbc:derby://localhost:1527/testpropdb, {traceFile=[DERBY_SYSTEM_HOME]/trace2.out}) +getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]/trace2.out getUserName() = APP CURRENT SCHEMA = APP trace file exists
java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/checkDriver.java+4 −3 modified@@ -360,12 +360,13 @@ private static void testConnect(Driver driver, String url, Properties info) thro * @return origString with derby.system.home path replaed with [DERBY_SYSTEM_HOME] */ private static String replaceSystemHome(String origString) { - int offset = origString.indexOf(DERBY_SYSTEM_HOME); + String replaceString = DERBY_SYSTEM_HOME + File.separator; + int offset = origString.indexOf(replaceString); if (offset == -1) return origString; else - return origString.substring(0,offset) + "[DERBY_SYSTEM_HOME]"+ - origString.substring(offset + DERBY_SYSTEM_HOME.length()); + return origString.substring(0,offset) + "[DERBY_SYSTEM_HOME]/"+ + origString.substring(offset + replaceString.length()); } } \ No newline at end of file
12 files changed · +447 −96
java/client/org/apache/derby/jdbc/ClientDriver.java+34 −6 modified@@ -20,6 +20,9 @@ package org.apache.derby.jdbc; +import java.util.Enumeration; +import java.util.Properties; + import org.apache.derby.client.am.Configuration; import org.apache.derby.client.am.ResourceUtilities; import org.apache.derby.client.am.SqlException; @@ -92,11 +95,11 @@ public java.sql.Connection connect(String url, port = ClientDataSource.propertyDefault_portNumber; } - // longDatabase is the databaseName and attributes. This will be + // database is the database name and attributes. This will be // sent to network server as the databaseName String database = tokenizeDatabase(urlTokenizer, url); // "database" java.util.Properties augmentedProperties = tokenizeURLProperties(url, properties); - + database = appendDatabaseAttributes(database,augmentedProperties); int traceLevel; try { @@ -129,8 +132,33 @@ public java.sql.Connection connect(String url, return conn; } - public boolean acceptsURL(String url) throws java.sql.SQLException { - java.util.StringTokenizer urlTokenizer = new java.util.StringTokenizer(url, "/:=; \t\n\r\f", true); + /** + * Append attributes to the database name except for user/password + * which are sent as part of the protocol. + * Other attributes will be sent to the server with the database name + * Assumes augmentedProperties is not null + * + * @param database - Short database name + * @param augmentedProperties - Set of properties to append as attributes + * @return databaseName + attributes (e.g. mydb;create=true) + */ + private String appendDatabaseAttributes(String database, Properties augmentedProperties) { + + StringBuffer longDatabase = new StringBuffer(database); + for (Enumeration keys = augmentedProperties.keys(); keys.hasMoreElements() ;) + { + String key = (String) keys.nextElement(); + if (key.equals(ClientDataSource.propertyKey_user) || + key.equals(ClientDataSource.propertyKey_password)) + continue; + longDatabase.append(";" + key + "=" + augmentedProperties.getProperty(key)); + } + return longDatabase.toString(); + } + + public boolean acceptsURL(String url) throws java.sql.SQLException { + java.util.StringTokenizer urlTokenizer = + new java.util.StringTokenizer(url, "/:=; \t\n\r\f", true); int protocol = tokenizeProtocol(url, urlTokenizer); return protocol != 0; } @@ -262,11 +290,11 @@ private static int tokenizeOptionalPortNumber(java.util.StringTokenizer urlToken } } - //return database name and attributes + //return database name private static String tokenizeDatabase(java.util.StringTokenizer urlTokenizer, String url) throws SqlException { try { - String databaseName = urlTokenizer.nextToken(" \t\n\r\f"); + String databaseName = urlTokenizer.nextToken(" \t\n\r\f;"); return databaseName; } catch (java.util.NoSuchElementException e) { // A null log writer is passed, because jdbc 1 sqlexceptions are automatically traced
java/testing/org/apache/derbyTesting/functionTests/master/checkDriver.out+29 −0 modified@@ -1,4 +1,33 @@ +jdbcCompliant() = true +driver.getMajorVersion() = EXPECTED VERSION +driver.getMinorVersion() = EXPECTED VERSION checking acceptsURL(jdbc:derby:wombat;create=true) checking acceptsURL(jdbc:derby://localhost:1527/wombat;create=true) checking acceptsURL(jdbc:derby:net://localhost:1527/wombat;create=true) checking acceptsURL(jdbc:db2j:wombat;create=true) +testEmbeddedAttributes() +Connection info for connect(jdbc:derby:testcreatedb1, {create=true}) +getURL() = jdbc:derby:testcreatedb1 +getUserName() = APP +CURRENT SCHEMA = APP +Connection info for connect(jdbc:derby:testcreatedb2;create=true, null) +getURL() = jdbc:derby:testcreatedb2 +getUserName() = APP +CURRENT SCHEMA = APP +Connection info for connect(jdbc:derby:testpropdb, {user=APP, password=xxxx}) +getURL() = jdbc:derby:testpropdb +getUserName() = APP +CURRENT SCHEMA = APP +Connection info for connect(jdbc:derby:testpropdb;user=testuser;password=testpass, null) +getURL() = jdbc:derby:testpropdb +getUserName() = testuser +CURRENT SCHEMA = TESTUSER +Connection info for connect(jdbc:derby:testpropdb;user=testusr, {password=testpass}) +getURL() = jdbc:derby:testpropdb +getUserName() = testusr +CURRENT SCHEMA = TESTUSR +Connection info for connect(jdbc:derby:testpropdb;user=testuser;password=testpass, null) +getURL() = jdbc:derby:testpropdb +getUserName() = testuser +CURRENT SCHEMA = TESTUSER +Expected Exception:08006:Database 'testcreatedb1' shutdown.
java/testing/org/apache/derbyTesting/functionTests/master/DerbyNet/checkDriver.out+7 −0 added@@ -0,0 +1,7 @@ +jdbcCompliant() = true +driver.getMajorVersion() = EXPECTED VERSION +driver.getMinorVersion() = EXPECTED VERSION +checking acceptsURL(jdbc:derby:wombat;create=true) +checking acceptsURL(jdbc:derby://localhost:1527/wombat;create=true) +checking acceptsURL(jdbc:derby:net://localhost:1527/wombat;create=true) +checking acceptsURL(jdbc:db2j:wombat;create=true)
java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/checkDriver.out+44 −0 added@@ -0,0 +1,44 @@ +jdbcCompliant() = true +driver.getMajorVersion() = EXPECTED VERSION +driver.getMinorVersion() = EXPECTED VERSION +checking acceptsURL(jdbc:derby:wombat;create=true) +checking acceptsURL(jdbc:derby://localhost:1527/wombat;create=true) +checking acceptsURL(jdbc:derby:net://localhost:1527/wombat;create=true) +checking acceptsURL(jdbc:db2j:wombat;create=true) +testEmbeddedAttributes() +Connection info for connect(jdbc:derby://localhost:1527/testcreatedb1, {create=true}) +getURL() = jdbc:derby://localhost:1527/testcreatedb1;create=true +getUserName() = APP +CURRENT SCHEMA = APP +Connection info for connect(jdbc:derby://localhost:1527/testcreatedb2;create=true, null) +getURL() = jdbc:derby://localhost:1527/testcreatedb2;create=true +getUserName() = APP +CURRENT SCHEMA = APP +Connection info for connect(jdbc:derby://localhost:1527/testpropdb, {user=APP, password=xxxx}) +getURL() = jdbc:derby://localhost:1527/testpropdb +getUserName() = APP +CURRENT SCHEMA = APP +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;user=testuser;password=testpass, null) +getURL() = jdbc:derby://localhost:1527/testpropdb +getUserName() = testuser +CURRENT SCHEMA = TESTUSER +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;user=testusr, {password=testpass}) +getURL() = jdbc:derby://localhost:1527/testpropdb +getUserName() = testusr +CURRENT SCHEMA = TESTUSR +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;user=testuser;password=testpass, null) +getURL() = jdbc:derby://localhost:1527/testpropdb +getUserName() = testuser +CURRENT SCHEMA = TESTUSER +Expected Exception:08006:DERBY SQL error: SQLCODE: -1, SQLSTATE: 08006, SQLERRMC: Database 'testcreatedb1' shutdown. +testClientAttributes() +Connection info for connect(jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace.out, {}) +getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace.out +getUserName() = APP +CURRENT SCHEMA = APP + trace file exists +Connection info for connect(jdbc:derby://localhost:1527/testpropdb, {traceFile=[DERBY_SYSTEM_HOME]\trace2.out}) +getURL() = jdbc:derby://localhost:1527/testpropdb;traceFile=[DERBY_SYSTEM_HOME]\trace2.out +getUserName() = APP +CURRENT SCHEMA = APP + trace file exists
java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/secureUsers.out+44 −44 modified@@ -98,11 +98,11 @@ ij(CONNECTION2)> connect 'wombat;user=francois;password=paceesalute'; ij(CONNECTION3)> -- Invalid ones: connect 'wombat;user=Jamie;password=theHooligan'; ij(CONNECTION4)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;create=true;user=kreg;password=IwasBornReady -CONNECTION1 - jdbc:derby://localhost:1527/wombat;user=jeff;password=homeRun -CONNECTION2 - jdbc:derby://localhost:1527/wombat;user=howardR;password=takeItEasy -CONNECTION3 - jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute -CONNECTION4* - jdbc:derby://localhost:1527/wombat;user=Jamie;password=theHooligan +CONNECTION0 - jdbc:derby://localhost:1527/wombat;create=true +CONNECTION1 - jdbc:derby://localhost:1527/wombat +CONNECTION2 - jdbc:derby://localhost:1527/wombat +CONNECTION3 - jdbc:derby://localhost:1527/wombat +CONNECTION4* - jdbc:derby://localhost:1527/wombat * = current connection ij(CONNECTION4)> connect 'guestSchemeDB;user=kreg;password=IwasBornReady'; ij(CONNECTION5)> connect 'guestSchemeDB;user=jeff;password=homeRun'; @@ -111,16 +111,16 @@ ij(CONNECTION7)> connect 'guestSchemeDB;user=francois;password=paceesalute'; ij(CONNECTION8)> -- Invalid ones: connect 'guestSchemeDB;user=Jamie;password=theHooligan'; ij(CONNECTION9)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;create=true;user=kreg;password=IwasBornReady -CONNECTION1 - jdbc:derby://localhost:1527/wombat;user=jeff;password=homeRun -CONNECTION2 - jdbc:derby://localhost:1527/wombat;user=howardR;password=takeItEasy -CONNECTION3 - jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute -CONNECTION4 - jdbc:derby://localhost:1527/wombat;user=Jamie;password=theHooligan -CONNECTION5 - jdbc:derby://localhost:1527/guestSchemeDB;user=kreg;password=IwasBornReady -CONNECTION6 - jdbc:derby://localhost:1527/guestSchemeDB;user=jeff;password=homeRun -CONNECTION7 - jdbc:derby://localhost:1527/guestSchemeDB;user=howardR;password=takeItEasy -CONNECTION8 - jdbc:derby://localhost:1527/guestSchemeDB;user=francois;password=paceesalute -CONNECTION9* - jdbc:derby://localhost:1527/guestSchemeDB;user=Jamie;password=theHooligan +CONNECTION0 - jdbc:derby://localhost:1527/wombat;create=true +CONNECTION1 - jdbc:derby://localhost:1527/wombat +CONNECTION2 - jdbc:derby://localhost:1527/wombat +CONNECTION3 - jdbc:derby://localhost:1527/wombat +CONNECTION4 - jdbc:derby://localhost:1527/wombat +CONNECTION5 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION6 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION7 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION8 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION9* - jdbc:derby://localhost:1527/guestSchemeDB * = current connection ij(CONNECTION9)> connect 'derbySchemeDB;user=mamta;password=ieScape'; ij(CONNECTION10)> connect 'derbySchemeDB;user=dan;password=makeItFaster'; @@ -131,19 +131,19 @@ ERROR (no SQLState): Connection authorization failure occurred. Reason: userid ij(CONNECTION12)> connect 'derbySchemeDB;user=francois;password=paceesalute'; ERROR (no SQLState): Connection authorization failure occurred. Reason: userid invalid. ij(CONNECTION12)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;create=true;user=kreg;password=IwasBornReady -CONNECTION1 - jdbc:derby://localhost:1527/wombat;user=jeff;password=homeRun -CONNECTION10 - jdbc:derby://localhost:1527/derbySchemeDB;user=mamta;password=ieScape -CONNECTION11 - jdbc:derby://localhost:1527/derbySchemeDB;user=dan;password=makeItFaster -CONNECTION12* - jdbc:derby://localhost:1527/derbySchemeDB;user=martin;password=obfuscateIt -CONNECTION2 - jdbc:derby://localhost:1527/wombat;user=howardR;password=takeItEasy -CONNECTION3 - jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute -CONNECTION4 - jdbc:derby://localhost:1527/wombat;user=Jamie;password=theHooligan -CONNECTION5 - jdbc:derby://localhost:1527/guestSchemeDB;user=kreg;password=IwasBornReady -CONNECTION6 - jdbc:derby://localhost:1527/guestSchemeDB;user=jeff;password=homeRun -CONNECTION7 - jdbc:derby://localhost:1527/guestSchemeDB;user=howardR;password=takeItEasy -CONNECTION8 - jdbc:derby://localhost:1527/guestSchemeDB;user=francois;password=paceesalute -CONNECTION9 - jdbc:derby://localhost:1527/guestSchemeDB;user=Jamie;password=theHooligan +CONNECTION0 - jdbc:derby://localhost:1527/wombat;create=true +CONNECTION1 - jdbc:derby://localhost:1527/wombat +CONNECTION10 - jdbc:derby://localhost:1527/derbySchemeDB +CONNECTION11 - jdbc:derby://localhost:1527/derbySchemeDB +CONNECTION12* - jdbc:derby://localhost:1527/derbySchemeDB +CONNECTION2 - jdbc:derby://localhost:1527/wombat +CONNECTION3 - jdbc:derby://localhost:1527/wombat +CONNECTION4 - jdbc:derby://localhost:1527/wombat +CONNECTION5 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION6 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION7 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION8 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION9 - jdbc:derby://localhost:1527/guestSchemeDB * = current connection ij(CONNECTION12)> connect 'simpleSchemeDB;user=jeff;password=homeRun'; ij(CONNECTION13)> connect 'simpleSchemeDB;user=howardR;password=takeItEasy'; @@ -159,22 +159,22 @@ ERROR (no SQLState): Connection authorization failure occurred. Reason: userid ij(CONNECTION15)> connect 'simpleSchemeDB;user=francois;password=corsica'; ERROR (no SQLState): Connection authorization failure occurred. Reason: userid invalid. ij(CONNECTION15)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;create=true;user=kreg;password=IwasBornReady -CONNECTION1 - jdbc:derby://localhost:1527/wombat;user=jeff;password=homeRun -CONNECTION10 - jdbc:derby://localhost:1527/derbySchemeDB;user=mamta;password=ieScape -CONNECTION11 - jdbc:derby://localhost:1527/derbySchemeDB;user=dan;password=makeItFaster -CONNECTION12 - jdbc:derby://localhost:1527/derbySchemeDB;user=martin;password=obfuscateIt -CONNECTION13 - jdbc:derby://localhost:1527/simpleSchemeDB;user=jeff;password=homeRun -CONNECTION14 - jdbc:derby://localhost:1527/simpleSchemeDB;user=howardR;password=takeItEasy -CONNECTION15* - jdbc:derby://localhost:1527/simpleSchemeDB;user=francois;password=paceesalute -CONNECTION2 - jdbc:derby://localhost:1527/wombat;user=howardR;password=takeItEasy -CONNECTION3 - jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute -CONNECTION4 - jdbc:derby://localhost:1527/wombat;user=Jamie;password=theHooligan -CONNECTION5 - jdbc:derby://localhost:1527/guestSchemeDB;user=kreg;password=IwasBornReady -CONNECTION6 - jdbc:derby://localhost:1527/guestSchemeDB;user=jeff;password=homeRun -CONNECTION7 - jdbc:derby://localhost:1527/guestSchemeDB;user=howardR;password=takeItEasy -CONNECTION8 - jdbc:derby://localhost:1527/guestSchemeDB;user=francois;password=paceesalute -CONNECTION9 - jdbc:derby://localhost:1527/guestSchemeDB;user=Jamie;password=theHooligan +CONNECTION0 - jdbc:derby://localhost:1527/wombat;create=true +CONNECTION1 - jdbc:derby://localhost:1527/wombat +CONNECTION10 - jdbc:derby://localhost:1527/derbySchemeDB +CONNECTION11 - jdbc:derby://localhost:1527/derbySchemeDB +CONNECTION12 - jdbc:derby://localhost:1527/derbySchemeDB +CONNECTION13 - jdbc:derby://localhost:1527/simpleSchemeDB +CONNECTION14 - jdbc:derby://localhost:1527/simpleSchemeDB +CONNECTION15* - jdbc:derby://localhost:1527/simpleSchemeDB +CONNECTION2 - jdbc:derby://localhost:1527/wombat +CONNECTION3 - jdbc:derby://localhost:1527/wombat +CONNECTION4 - jdbc:derby://localhost:1527/wombat +CONNECTION5 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION6 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION7 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION8 - jdbc:derby://localhost:1527/guestSchemeDB +CONNECTION9 - jdbc:derby://localhost:1527/guestSchemeDB * = current connection ij(CONNECTION15)> disconnect all; ij> show connections;
java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/users2.out+17 −17 modified@@ -72,12 +72,12 @@ ERROR 25502: An SQL data change is not permitted for a read-only connection, use ij(CONNECTION5)> create table APP.t2(c1 char(30)); ERROR 25503: DDL is not permitted for a read-only connection, user or database. ij(CONNECTION5)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;user=system;password=manager -CONNECTION1 - jdbc:derby://localhost:1527/wombat;user=kreg;password=visualWhat? -CONNECTION2 - jdbc:derby://localhost:1527/wombat;user=jeff;password=HomeRun61 -CONNECTION3 - jdbc:derby://localhost:1527/wombat;user=ames;password=AnyVolunteer? -CONNECTION4 - jdbc:derby://localhost:1527/wombat;user=howardR;password=IamBetterAtTennis -CONNECTION5* - jdbc:derby://localhost:1527/wombat;user=jamie;password=MrNamePlates +CONNECTION0 - jdbc:derby://localhost:1527/wombat +CONNECTION1 - jdbc:derby://localhost:1527/wombat +CONNECTION2 - jdbc:derby://localhost:1527/wombat +CONNECTION3 - jdbc:derby://localhost:1527/wombat +CONNECTION4 - jdbc:derby://localhost:1527/wombat +CONNECTION5* - jdbc:derby://localhost:1527/wombat * = current connection ij(CONNECTION5)> disconnect all; ij> -- check allowed users in myDB db. @@ -169,13 +169,13 @@ FRANCOIS ij(CONNECTION6)> update APP.t1 set c1 = USER; ERROR 23513: The check constraint 'xxxxGENERATED-IDxxxx' was violated while performing an INSERT or UPDATE on table 'APP.T1'. ij(CONNECTION6)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/myDB;user=system;password=manager -CONNECTION1 - jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu -CONNECTION2 - jdbc:derby://localhost:1527/myDB;user=kreg;password=visualWhat? -CONNECTION3 - jdbc:derby://localhost:1527/myDB;user=ames;password=AnyVolunteer? -CONNECTION4 - jdbc:derby://localhost:1527/myDB;user=dan;password=MakeItFaster -CONNECTION5 - jdbc:derby://localhost:1527/myDB;user=francois;password=paceesalute -CONNECTION6* - jdbc:derby://localhost:1527/myDB;user=jamie;password=MrNamePlates +CONNECTION0 - jdbc:derby://localhost:1527/myDB +CONNECTION1 - jdbc:derby://localhost:1527/myDB +CONNECTION2 - jdbc:derby://localhost:1527/myDB +CONNECTION3 - jdbc:derby://localhost:1527/myDB +CONNECTION4 - jdbc:derby://localhost:1527/myDB +CONNECTION5 - jdbc:derby://localhost:1527/myDB +CONNECTION6* - jdbc:derby://localhost:1527/myDB * = current connection ij(CONNECTION6)> disconnect all; ij> -- @@ -201,7 +201,7 @@ ij> connect 'wombat;user=jerry;password=SacreBleu'; ERROR (no SQLState): Connection authorization failure occurred. Reason: userid invalid. ij> connect 'wombat;user=jamie;password=MrNamePlates'; ij> show connections; -CONNECTION0* - jdbc:derby://localhost:1527/wombat;user=jamie;password=MrNamePlates +CONNECTION0* - jdbc:derby://localhost:1527/wombat * = current connection ij> connect 'wombat;user=francois;password=paceesalute'; ij(CONNECTION1)> connect 'myDB;user=jerry;password=SacreBleu'; @@ -213,9 +213,9 @@ ERROR (no SQLState): Connection authorization failure occurred. Reason: userid ij(CONNECTION2)> connect 'wombat;user=jerry;password=SacreBleu;shutdown=true'; ERROR (no SQLState): Connection authorization failure occurred. Reason: userid invalid. ij(CONNECTION2)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;user=jamie;password=MrNamePlates -CONNECTION1 - jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute -CONNECTION2* - jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu +CONNECTION0 - jdbc:derby://localhost:1527/wombat +CONNECTION1 - jdbc:derby://localhost:1527/wombat +CONNECTION2* - jdbc:derby://localhost:1527/myDB * = current connection ij(CONNECTION2)> disconnect all; ij> show connections;
java/testing/org/apache/derbyTesting/functionTests/master/DerbyNetClient/users.out+15 −15 modified@@ -36,11 +36,11 @@ ij(CONNECTION1)> connect 'wombat;user=ames;password=AnyVolunteer?'; ij(CONNECTION2)> connect 'wombat;user=howardR;password=IamBetterAtTennis'; ij(CONNECTION3)> connect 'wombat;user=francois;password=paceesalute'; ij(CONNECTION4)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;user=kreg;password=visualWhat? -CONNECTION1 - jdbc:derby://localhost:1527/wombat;user=jeff;password=HomeRun61 -CONNECTION2 - jdbc:derby://localhost:1527/wombat;user=ames;password=AnyVolunteer? -CONNECTION3 - jdbc:derby://localhost:1527/wombat;user=howardR;password=IamBetterAtTennis -CONNECTION4* - jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute +CONNECTION0 - jdbc:derby://localhost:1527/wombat +CONNECTION1 - jdbc:derby://localhost:1527/wombat +CONNECTION2 - jdbc:derby://localhost:1527/wombat +CONNECTION3 - jdbc:derby://localhost:1527/wombat +CONNECTION4* - jdbc:derby://localhost:1527/wombat * = current connection ij(CONNECTION4)> disconnect all; ij> -- check allowed users in myDB db. @@ -84,12 +84,12 @@ FRANCOIS ij(CONNECTION5)> update APP.t1 set c1 = USER; ERROR 23513: The check constraint 'xxxxGENERATED-IDxxxx' was violated while performing an INSERT or UPDATE on table 'APP.T1'. ij(CONNECTION5)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu -CONNECTION1 - jdbc:derby://localhost:1527/myDB;user=kreg;password=visualWhat? -CONNECTION2 - jdbc:derby://localhost:1527/myDB;user=ames;password=AnyVolunteer? -CONNECTION3 - jdbc:derby://localhost:1527/myDB;user=dan;password=MakeItFaster -CONNECTION4 - jdbc:derby://localhost:1527/myDB;user=francois;password=paceesalute -CONNECTION5* - jdbc:derby://localhost:1527/myDB;user=jamie;password=MrNamePlates +CONNECTION0 - jdbc:derby://localhost:1527/myDB +CONNECTION1 - jdbc:derby://localhost:1527/myDB +CONNECTION2 - jdbc:derby://localhost:1527/myDB +CONNECTION3 - jdbc:derby://localhost:1527/myDB +CONNECTION4 - jdbc:derby://localhost:1527/myDB +CONNECTION5* - jdbc:derby://localhost:1527/myDB * = current connection ij(CONNECTION5)> disconnect all; ij> -- @@ -127,8 +127,8 @@ ERROR (no SQLState): Connection authorization failure occurred. Reason: userid ij(CONNECTION1)> connect 'wombat;user=jerry;password=SacreBleu;shutdown=true'; ERROR 04501: DERBY SQL error: SQLCODE: -1, SQLSTATE: 04501, SQLERRMC: Database connection refused. ij(CONNECTION1)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute -CONNECTION1* - jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu +CONNECTION0 - jdbc:derby://localhost:1527/wombat +CONNECTION1* - jdbc:derby://localhost:1527/myDB * = current connection ij(CONNECTION1)> -- Database shutdown - check user - should succeed ----- beetle 5367 @@ -137,8 +137,8 @@ ERROR 08006: DERBY SQL error: SQLCODE: -1, SQLSTATE: 08006, SQLERRMC: Database ' ij(CONNECTION1)> connect 'myDB;user=jerry;password=SacreBleu;shutdown=true'; ERROR 08006: DERBY SQL error: SQLCODE: -1, SQLSTATE: 08006, SQLERRMC: Database 'myDB' shutdown. ij(CONNECTION1)> show connections; -CONNECTION0 - jdbc:derby://localhost:1527/wombat;user=francois;password=paceesalute -CONNECTION1* - jdbc:derby://localhost:1527/myDB;user=jerry;password=SacreBleu +CONNECTION0 - jdbc:derby://localhost:1527/wombat +CONNECTION1* - jdbc:derby://localhost:1527/myDB * = current connection ij(CONNECTION1)> -- JBMS System shutdown - check user - should fail connect ';user=jamie;password=LetMeIn;shutdown=true';
java/testing/org/apache/derbyTesting/functionTests/suites/jdbcapi.runall+1 −0 modified@@ -1,5 +1,6 @@ jdbcapi/bestrowidentifier.sql jdbcapi/characterStreams.java +jdbcapi/checkDriver.java jdbcapi/nullSQLText.java jdbcapi/prepStmtMetaData.java jdbcapi/resultset.java
java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/checkDriver_app.properties+3 −0 modified@@ -1,4 +1,7 @@ #Exclude for J2ME/Foundation - test requires java.sql.Driver runwithfoundation=false +#Exclude with jdk13 - test call JDBC30 methods +runwithjdk13=false +runwithibm13=false usedefaults=true
java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/checkDriver_derby.properties+20 −0 added@@ -0,0 +1,20 @@ +# +# This properties file is for the 'users' test. +# +# This file is expected to be placed into $WS/systest/out by +# the run script, and expects to be run in an environment where +# the property derby.system.home points to $WS/systest/out. +# +derby.infolog.append=true +#derby.connection.requireAuthentication=true +derby.authentication.provider=BUILTIN +derby.debug.true=AuthenticationTrace + +# +# Users definition +# +derby.user.testuser=testpass +derby.user.APP=xxxx + +# Database users restriction lists +derby.database.users.testpropdb=testuser,APP
java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/checkDriver.java+232 −14 modified@@ -20,17 +20,22 @@ package org.apache.derbyTesting.functionTests.tests.jdbcapi; import org.apache.derbyTesting.functionTests.util.TestUtil; + +import java.io.File; +import java.sql.DatabaseMetaData; import java.sql.Driver; import java.sql.DriverManager; import java.sql.Connection; +import java.sql.ResultSet; import java.sql.SQLException; import java.util.Properties; +import org.apache.derby.tools.JDBCDisplayUtil; /** * @author marsden * * This test tests java.sql.Driver methods. - * Right now it just tests acceptsURL. + * Right now it just tests acceptsURL and some attributes * Tests for getPropertyInfo need to be added. as well as connection attributes * */ @@ -42,6 +47,8 @@ public class checkDriver { private static String JCC_URL = "jdbc:derby:net://localhost:1527/wombat;create=true"; private static String INVALID_URL = "jdbc:db2j:wombat;create=true"; + private static String DERBY_SYSTEM_HOME = System.getProperty("derby.system.home"); + // URLS to check. New urls need to also be added to the acceptsUrl table private static String[] urls = new String[] { @@ -52,7 +59,10 @@ public class checkDriver { }; - + /** + * url prefix for this framework + */ + private static String frameworkPrefix; // The acceptsURLTable uses the frameworkOffset column int he table // to check for valid results for each framework @@ -64,6 +74,7 @@ public class checkDriver { private static int DERBYNET_OFFSET = 2; // JCC static { + frameworkPrefix = TestUtil.getJdbcUrlPrefix(); if (TestUtil.isEmbeddedFramework()) frameworkOffset = EMBEDDED_OFFSET; else if (TestUtil.isDerbyNetClientFramework()) @@ -87,19 +98,149 @@ else if (TestUtil.isJCCFramework()) public static void main(String[] args) { try { - Driver driver = loadAndCheckDriverForFramework(); + Driver driver = loadAndCheckDriverForFramework(); checkAcceptsURL(driver); - } catch (Exception e) + testEmbeddedAttributes(driver); + testClientAttributes(driver); + } + catch (SQLException se) + { + while (se != null) + { + se.printStackTrace(System.out); + se = se.getNextException(); + } + } + catch (Throwable e) { - e.printStackTrace(); + e.printStackTrace(System.out); } + } /** + * Tests that client side attributes cann be specified in either url or info argument to connect. + * DERBY"-530. + * + * TODO: Add more comprehensive client attribute testing and enhance to handle jcc attributes in url. * * @param driver */ + private static void testClientAttributes(Driver driver) throws SQLException + { + if (!TestUtil.isDerbyNetClientFramework()) + return; + + System.out.println("\ntestClientAttributes()"); + Properties info = new Properties(); + + // Note: we have to put the trace file in an absolute path because the + // test harness sets user.dir and this confuses the File api greatly. + // We put it in DERBY_SYSTEM_HOME since that is always available when + // tests are run + String traceDirectory = DERBY_SYSTEM_HOME + + File.separator; + String traceFile= traceDirectory + "trace.out"; + + // traceFile attribute in url + testConnect(driver, frameworkPrefix + "testpropdb;traceFile=" + + traceFile,info); + assertTraceFileExists(traceFile); + + traceFile = traceDirectory + "trace2.out"; + + // traceFile attribute in property + info.setProperty("traceFile",traceFile); + testConnect(driver, frameworkPrefix + "testpropdb",info); + assertTraceFileExists(traceFile); + + } + + + + /** + * Check that trace file exists in <framework> directory + * + * @param filename Name of trace file + */ + private static void assertTraceFileExists(String filename) + { + File traceFile = new File(filename); + //System.out.println("user.dir=" + System.getProperty("user.dir")); + //System.out.println("fullpath = " + traceFile.getAbsolutePath()); + boolean exists = traceFile.exists(); + if (! exists) + new Exception("FAILED trace file: " + filename + " does not exist").printStackTrace(System.out); + else + System.out.println(" trace file exists"); + + } + + + /** + * Tests that embedded attributes can be specified in either url or info argument to connect + * DERBY-530. Only valid for emebedded driver and client. JCC has a different url format for + * embedded attributes + * + * @param driver + */ + private static void testEmbeddedAttributes(Driver driver) throws SQLException + { + // JCC can't take embedded attributes in info or as normal url attributes, + // so not tested here. + if (TestUtil.isJCCFramework()) + return; + + System.out.println("\ntestEmbeddedAttributes()"); + Properties info = new Properties(); + // create attribute as property + info.setProperty("create","true"); + testConnect(driver, frameworkPrefix + "testcreatedb1", info); + + // create attribute in url + testConnect(driver, frameworkPrefix + "testcreatedb2;create=true", null); + + // user/password in properties + // testpropdb was created in load and test driver + info.clear(); + info.setProperty("user","APP"); + info.setProperty("password", "xxxx"); + testConnect(driver, frameworkPrefix + "testpropdb", info); + + // user/password in url + testConnect(driver, frameworkPrefix + "testpropdb;user=testuser;password=testpass", null); + + // user in url, password in property + info.clear(); + info.setProperty("password","testpass"); + testConnect(driver,frameworkPrefix + "testpropdb;user=testusr",info); + + // different users in url and in properties. URL is the winner + info.clear(); + info.setProperty("user","APP"); + info.setProperty("password","xxxx"); + testConnect(driver, frameworkPrefix + "testpropdb;user=testuser;password=testpass", null); + + // shutdown with properties + info.clear(); + info.setProperty("shutdown","true"); + try { + testConnect(driver,frameworkPrefix + "testcreatedb1", info); + } catch (SQLException se) + { + System.out.println("Expected Exception:" + se.getSQLState() + ":" + se.getMessage()); + } + } + + + /** + * Check that drivers accept the correct urls and reject those for other supported drivers. + * + * @param driver driver we are testing. + * + * @throws SQLException + */ private static void checkAcceptsURL(Driver driver) throws SQLException{ for (int u = 0; u < urls.length;u++) { @@ -115,39 +256,116 @@ private static void checkAcceptsURL(Driver driver) throws SQLException{ } + /** + * Load the driver and check java.sql.Driver methods, + * @return + * @throws Exception + */ private static Driver loadAndCheckDriverForFramework() throws Exception { TestUtil.loadDriver(); - - String frameworkURL = TestUtil.getJdbcUrlPrefix() + "wombat;create=true"; - TestUtil.loadDriver(); + String frameworkURL = TestUtil.getJdbcUrlPrefix() + "testpropdb;create=true"; // Test that we loaded the right driver by making a connection Driver driver = DriverManager.getDriver(frameworkURL); Properties props = new Properties(); - props.put("user","APP"); - props.put("password","xxx"); - Connection conn = driver.connect(frameworkURL,props); - //System.out.println("Successfully made connection for " + conn.getMetaData().getDriverName()); + props.put("user","testuser"); + props.put("password","testpass"); + Connection conn = DriverManager.getConnection(frameworkURL, props); + DatabaseMetaData dbmd = conn.getMetaData(); + System.out.println("jdbcCompliant() = " + driver.jdbcCompliant()); + + // Just check versions against database metadata to avoid more master updates. + // Metadata test prints the actual version. + + int majorVersion = driver.getMajorVersion(); + if (majorVersion == dbmd.getDriverMajorVersion()) + System.out.println("driver.getMajorVersion() = EXPECTED VERSION"); + else + new Exception("FAILED: unexpected value for getMajorVersion(): " + + majorVersion).printStackTrace(); + + int minorVersion = driver.getMinorVersion(); + if (minorVersion == dbmd.getDriverMinorVersion()) + System.out.println("driver.getMinorVersion() = EXPECTED VERSION"); + else + new Exception("FAILED: unexpected value for getMinorVersion()" + + minorVersion).printStackTrace(System.out); + conn.close(); - //System.out.println("jdbcCompliant = " + driver.jdbcCompliant()); return driver; } + /** + * Check the actual return value of acceptsURL against the expected value and error and stack + * trace if they don't match + * + * @param url URL that was checked for acceptsURL + * @param expectedAcceptance expected return value + * @param actualAcceptance actual return value + * + */ private static void assertExpectedURLAcceptance(String url, boolean expectedAcceptance, boolean actualAcceptance) { if (actualAcceptance != expectedAcceptance) { - new Exception("FAILED acceptURL check. url = " + url + + new Exception("FAILED acceptsURL check. url = " + url + " expectedAcceptance = " + expectedAcceptance + " actualAcceptance = " + actualAcceptance).printStackTrace(System.out); } } + /** + * Make java.sql.Driver.connect(String url, Properties info call) and print the status of + * the connection. + * + * @param driver driver for framework + * @param url url to pass to Driver.connect() + * @param info properties to pass to Driver.Connect() + * + * @throws SQLException on error. + */ + private static void testConnect(Driver driver, String url, Properties info) throws SQLException + { + String infoString = null; + if (info != null) + infoString = replaceSystemHome(info.toString()); + String urlString = replaceSystemHome(url); + Connection conn = driver.connect(url,info); + + System.out.println("\nConnection info for connect(" + urlString + ", " + infoString +")"); + String getUrlValue = conn.getMetaData().getURL(); + // URL may include path of DERBY_SYSTEM_HOME for traceFile + // filter it out. + getUrlValue = replaceSystemHome(getUrlValue); + System.out.println("getURL() = " + getUrlValue); + System.out.println("getUserName() = " + conn.getMetaData().getUserName()); + // CURRENT SCHEMA should match getUserName() + ResultSet rs = conn.createStatement().executeQuery("VALUES(CURRENT SCHEMA)"); + rs.next(); + System.out.println("CURRENT SCHEMA = " + rs.getString(1)); + conn.close(); + + } + + + /** + * @param origString + * + * @return origString with derby.system.home path replaed with [DERBY_SYSTEM_HOME] + */ + private static String replaceSystemHome(String origString) { + int offset = origString.indexOf(DERBY_SYSTEM_HOME); + if (offset == -1) + return origString; + else + return origString.substring(0,offset) + "[DERBY_SYSTEM_HOME]"+ + origString.substring(offset + DERBY_SYSTEM_HOME.length()); + } } \ No newline at end of file
java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/copyfiles.ant+1 −0 modified@@ -7,6 +7,7 @@ blobclob4BLOB_derby.properties bestrowidentifier.sql bestrowidentifier_app.properties checkDriver_app.properties +checkDriver_derby.properties dbMetaDataJdbc30_app.properties dbMetaDataJdbc30_sed.properties default_app.properties
09a7325f75a4DERBY-561 - Embedded driver jdbcCompliant() method should return true
1 file changed · +1 −1
java/engine/org/apache/derby/jdbc/InternalDriver.java+1 −1 modified@@ -209,7 +209,7 @@ public int getMinorVersion() { } public boolean jdbcCompliant() { - return false; + return true; } /*
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
9- db.apache.org/derby/releases/release-10.1.2.1.htmlnvdPatchWEB
- github.com/advisories/GHSA-rp7r-79rm-2758ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2005-4849ghsaADVISORY
- issues.apache.org/jira/browse/DERBY-530nvdWEB
- issues.apache.org/jira/browse/DERBY-559nvdWEB
- svn.apache.org/viewvcghsaWEB
- github.com/apache/derby/commit/09a7325f75a4f96a7735e46c9723930f88ea2613ghsaWEB
- github.com/apache/derby/commit/82d721fd53e30dbb86d6d742c085030985091968ghsaWEB
- github.com/apache/derby/commit/fd24a7590ff5426bac68303fbeca07dbc5067412ghsaWEB
News mentions
0No linked articles in our index yet.