Skip to content

Commit ec54302

Browse files
cainejettetz70s
authored andcommitted
Replace whitelist/blacklist terminology with allowlist/denylist (go-sql-driver#1116)
* Replace whitelist/blacklist terminology with allowlist/denylist * Add myself to AUTHORS * PR feedback * Denylist --> denied * Update denied --> rejected
1 parent a21d8ee commit ec54302

File tree

5 files changed

+9
-8
lines changed

5 files changed

+9
-8
lines changed

AUTHORS

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ Arne Hormann <arnehormann at gmail.com>
2121
Ariel Mashraki <ariel at mashraki.co.il>
2222
Asta Xie <xiemengjun at gmail.com>
2323
Bulat Gaifullin <gaifullinbf at gmail.com>
24+
Caine Jette <jette at alum.mit.edu>
2425
Carlos Nieto <jose.carlos at menteslibres.net>
2526
Chris Moos <chris at tech9computers.com>
2627
Craig Wilson <craiggwilson at gmail.com>

README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ A MySQL-Driver for Go's [database/sql](https://golang.org/pkg/database/sql/) pac
3535
* Supports queries larger than 16MB
3636
* Full [`sql.RawBytes`](https://golang.org/pkg/database/sql/#RawBytes) support.
3737
* Intelligent `LONG DATA` handling in prepared statements
38-
* Secure `LOAD DATA LOCAL INFILE` support with file Whitelisting and `io.Reader` support
38+
* Secure `LOAD DATA LOCAL INFILE` support with file allowlisting and `io.Reader` support
3939
* Optional `time.Time` parsing
4040
* Optional placeholder interpolation
4141

@@ -122,7 +122,7 @@ Valid Values: true, false
122122
Default: false
123123
```
124124

125-
`allowAllFiles=true` disables the file Whitelist for `LOAD DATA LOCAL INFILE` and allows *all* files.
125+
`allowAllFiles=true` disables the file allowlist for `LOAD DATA LOCAL INFILE` and allows *all* files.
126126
[*Might be insecure!*](http://dev.mysql.com/doc/refman/5.7/en/load-data-local.html)
127127

128128
##### `allowCleartextPasswords`
@@ -230,7 +230,7 @@ Default: false
230230

231231
If `interpolateParams` is true, placeholders (`?`) in calls to `db.Query()` and `db.Exec()` are interpolated into a single query string with given parameters. This reduces the number of roundtrips, since the driver has to prepare a statement, execute it with given parameters and close the statement again with `interpolateParams=false`.
232232

233-
*This can not be used together with the multibyte encodings BIG5, CP932, GB2312, GBK or SJIS. These are blacklisted as they may [introduce a SQL injection vulnerability](http://stackoverflow.com/a/12118602/3430118)!*
233+
*This can not be used together with the multibyte encodings BIG5, CP932, GB2312, GBK or SJIS. These are rejected as they may [introduce a SQL injection vulnerability](http://stackoverflow.com/a/12118602/3430118)!*
234234

235235
##### `loc`
236236

@@ -445,7 +445,7 @@ For this feature you need direct access to the package. Therefore you must chang
445445
import "github.com/go-sql-driver/mysql"
446446
```
447447

448-
Files must be whitelisted by registering them with `mysql.RegisterLocalFile(filepath)` (recommended) or the Whitelist check must be deactivated by using the DSN parameter `allowAllFiles=true` ([*Might be insecure!*](http://dev.mysql.com/doc/refman/5.7/en/load-data-local.html)).
448+
Files must be explicitly allowed by registering them with `mysql.RegisterLocalFile(filepath)` (recommended) or the allowlist check must be deactivated by using the DSN parameter `allowAllFiles=true` ([*Might be insecure!*](http://dev.mysql.com/doc/refman/5.7/en/load-data-local.html)).
449449

450450
To use a `io.Reader` a handler function must be registered with `mysql.RegisterReaderHandler(name, handler)` which returns a `io.Reader` or `io.ReadCloser`. The Reader is available with the filepath `Reader::<name>` then. Choose different names for different handlers and `DeregisterReaderHandler` when you don't need it anymore.
451451

collations.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ var collations = map[string]byte{
247247
"utf8mb4_0900_ai_ci": 255,
248248
}
249249

250-
// A blacklist of collations which is unsafe to interpolate parameters.
250+
// A denylist of collations which is unsafe to interpolate parameters.
251251
// These multibyte encodings may contains 0x5c (`\`) in their trailing bytes.
252252
var unsafeCollations = map[string]bool{
253253
"big5_chinese_ci": true,

dsn.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -375,7 +375,7 @@ func parseDSNParams(cfg *Config, params string) (err error) {
375375

376376
// cfg params
377377
switch value := param[1]; param[0] {
378-
// Disable INFILE whitelist / enable all files
378+
// Disable INFILE allowlist / enable all files
379379
case "allowAllFiles":
380380
var isBool bool
381381
cfg.AllowAllFiles, isBool = readBool(value)

infile.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ var (
2323
readerRegisterLock sync.RWMutex
2424
)
2525

26-
// RegisterLocalFile adds the given file to the file whitelist,
26+
// RegisterLocalFile adds the given file to the file allowlist,
2727
// so that it can be used by "LOAD DATA LOCAL INFILE <filepath>".
2828
// Alternatively you can allow the use of all local files with
2929
// the DSN parameter 'allowAllFiles=true'
@@ -45,7 +45,7 @@ func RegisterLocalFile(filePath string) {
4545
fileRegisterLock.Unlock()
4646
}
4747

48-
// DeregisterLocalFile removes the given filepath from the whitelist.
48+
// DeregisterLocalFile removes the given filepath from the allowlist.
4949
func DeregisterLocalFile(filePath string) {
5050
fileRegisterLock.Lock()
5151
delete(fileRegister, strings.Trim(filePath, `"`))

0 commit comments

Comments
 (0)