Beta - SQL DB Instance With Local Data Loading Enabled

• Query id: 51a2c34d-dfd0-436f-aa34-e8f796e052fd
• Query name: Beta - SQL DB Instance With Local Data Loading Enabled
• Platform: Terraform
• Severity: Medium
• Category: Insecure Defaults
• CWE: 732
• Risk score: 3.0
• URL: Github

Description

All 'google_sql_database_instance' resources based on 'MYSQL' should disable the 'local_infile' flag to prevent unwanted exposure
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "google_sql_database_instance" "positive_1" {
  name             = "mysql-instance-without-flag"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  # Missing 'settings' field
}

resource "google_sql_database_instance" "positive_2" {
  name             = "mysql-instance-without-flag"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  settings {}  # Missing 'database_flags' field
}

resource "google_sql_database_instance" "positive_3" {
  name             = "mysql-instance-without-flag"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  settings {
    database_flags {
      name = "sample_flag1"
      value = "off"
      } # Missing 'local_infile' flag
  }
}

resource "google_sql_database_instance" "positive_4" {
  name             = "mysql-instance-with-flag"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  settings {
    database_flags {
      name = "sample_flag1"
      value = "off"
      }

    database_flags {                                 # Flag is not set to "off"
      name = "local_infile"
      value = "on"
      }

    database_flags {
      name = "sample_flag2"
      value = "off"
      }
  }
}

resource "google_sql_database_instance" "positive_5" { # Single object support test
  name             = "mysql-instance-with-flag"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  settings {
    database_flags {
      name = "local_infile"
      value = "on"
    }  # Flag is not set to "off"
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "google_sql_database_instance" "negative_1" {
  name             = "main-instance"
  database_version = "POSTGRES_15"      # Is not a MYSQL instance
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"
  }
}

resource "google_sql_database_instance" "negative_2" {
  name             = "mysql-instance-with-flag"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"

    database_flags {
      name = "sample_flag1"
      value = "off"
      }

    database_flags {                                  # Has flag set to "off"
      name = "local_infile"
      value = "off"
      }

    database_flags {
      name = "sample_flag2"
      value = "off"
      }
  }
}

resource "google_sql_database_instance" "negative_3" { # Single object support test
  name             = "mysql-instance-with-flag"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"

    database_flags {
      name = "local_infile"
      value = "off"
      }   # Has flag set to "off"
  }
}