Function validateExtraConnectionParameters

backend/api/v1/instance_service.go:1209–1224

validateExtraConnectionParameters validates extra connection parameters for security risks.

(engine storepb.Engine, params map[string]string)

// validateExtraConnectionParameters validates extra connection parameters for security risks.
func validateExtraConnectionParameters(engine storepb.Engine, params map[string]string) error {
	// Validate MySQL-compatible engines
	switch engine {
	case storepb.Engine_MYSQL, storepb.Engine_MARIADB, storepb.Engine_OCEANBASE, storepb.Engine_TIDB:
		for key := range params {
			normalizedKey := strings.ToLower(strings.TrimSpace(key))
			if normalizedKey == "allowallfiles" {
				// Disables file allowlist for LOAD DATA LOCAL INFILE and allows all files (might be insecure)
				return errors.Errorf("connection parameter %q is not allowed for security reasons. This parameter can allow a malicious database server to read arbitrary files from the client", key)
			}
		}
	default:
		// No validation needed for other engines
	}
	return nil
}