HugoFara / lwt

Learn languages by reading! A language learning app stemmed from Learning with Texts (LWT).
https://hugofara.github.io/lwt/
The Unlicense
168 stars 19 forks source link

Remove SYSTEM_ADMIN_VARIABLES privilege #167

Open HugoFara opened 9 months ago

HugoFara commented 9 months ago

Originally on discussion on #147 by @ProgramComputer:

LWT does modify server variables, check for "set globals" such as "max_heap_table_size" and "tmp_table_size". These are not being modified at runtime and only after session restart do these changes appear. Not a concern if SQL interactions are handled safely. This line sudo mysql -e "GRANT SYSTEM_VARIABLES_ADMIN ON *.* TO $user@$host" prevents the need to restart the session after a text is parsed. If vulnerability is still a risk, the line can be removed. It resolved my error below when I installed demo db.

Screenshot 2023-12-25 205423

As far as I now, editing MAX_HEAP_SIZE was a quick and dirty way to import longer chunks of data, such as very long texts, backups and new terms. However it may not be the best approach, as it needs a privilege elevation, and may pose security issues at some point.

As temporary tables are already in use, coupling with batch insert can be a workaround. I do not think of using bulk insert due to the previous issues of this method in the past (#20).

HugoFara commented 6 months ago

Update: since 12a90a3, it is no longer necessary for text reparsing. It is still necessary for backup/restore.