MySQL database management handler for Lita.io.
Add lita-mysql to your Lita instance's Gemfile:
gem "lita-mysql"Attack surfaces:
- MySQL credentials are stored in the Lita Redis instance
- Anyone who can either impersonate or directly connect to your chat system can send limited (but possibly damaging) SQL queries to any MySQL host you configure.
- There could exist a defect in either the plugin, or the stored procedures it uses, that could expose the ability to execute additional SQL statements.
Recommendations:
- Make sure to provide MySQL credentials that are as small in scope as needed. Read-only on a replication slave is a good idea to get comfortable and kick the tires.
- If you don't need to provide backup, clone, drop, restore, and truncate functionality, consider disabling them (see below).
This plugin uses the bot's Redis instance to store host and credential information. You will need to configure at least one database host to use the commands shown in 'Usage'. You can do so by running:
mysql alias add <alias> <fqdn> <username> <password>
NOTE: There is no 'default' MySQL host, once you add more than a single alias. If you have configured more than one database host, you will need to explicitly choose a host for all relevant commands.
NOTE: Table backup, clone, drop, restore, and truncate require , if you don't wish to allow these commands at all, you can disable them in the Lita config:
config.handlers.mysql.enable_stored_procedures = false
mysql [alias] backup <name> - Takes a backup of table <name> on [alias], requires confirmation
mysql [alias] backup-list - Shows all recent table backups on [alias]
mysql [alias] clone <name> - Clones table <name> on [alias], requires confirmation
mysql [alias] drop <name> - Drops table <name> on [alias], requires confirmation
mysql [alias] drop-list - Shows all recent table drops on [alias]
mysql [alias] restore <name> - Restores a backup from the list on [alias], requires confirmation
mysql [alias] table <name> - Shows information for table <name> on [alias]
mysql [alias] tables - Shows all tables on [alias]
mysql [alias] truncate <name> - Truncates table <name> on [alias], requires confirmation
mysql [alias] truncate-list - Shows all recent table truncations on [alias]
mysql [alias] gather -
mysql [alias] digest -
mysql [alias] digest-collect -
mysql [alias] digest-issue -
mysql [alias] explain <query> - Shows explain plan for <query> on [alias]
mysql [alias] profile <query> - Profiles <query> on [alias] and shows results
mysql [alias] cluster -
mysql [alias] innodb - Shows results of "status engine innodb" on [alias]
mysql [alias] kill <pid> - Kills process <pid> on [alias], requires confirmation
mysql [alias] kills - Show all recent process kills on [alias]
mysql [alias] processlist - Show all running processes on [alias]
mysql alias add <alias> <fqdn> <username> <password> - Adds a host with <alias>, <alias> must match [a-zA-Z0-9_-.] (restricted to mysql_admins)
mysql alias remove <alias> - Removes the alias <alias> (restricted to mysql_admins)
mysql alias list - Shows all hosts