server: add CLIENT_LOCAL_FILES to default server capabilities by nzin-alayacare · Pull Request #1163 · go-mysql-org/go-mysql

nzin-alayacare · 2026-07-02T14:05:49Z

Summary

Add mysql.CLIENT_LOCAL_FILES to the capability bitmask in both NewDefaultServer and NewServerWithAuth.

Motivation

A go-mysql server used as a transparent MySQL proxy must advertise CLIENT_LOCAL_FILES in the initial handshake so that connecting clients agree to participate in the LOAD DATA LOCAL INFILE protocol.

Without this flag, even if the client supports LOCAL INFILE, it will never send file packets to the proxy because the capability was not offered during negotiation. This makes LOAD DATA LOCAL INFILE relay impossible in proxy scenarios.

Changes

server/server_conf.go — one line added to each of the two server constructors:

// NewDefaultServer
mysql.CLIENT_MULTI_RESULTS | mysql.CLIENT_PS_MULTI_RESULTS | mysql.CLIENT_LOCAL_FILES,

// NewServerWithAuth
mysql.CLIENT_MULTI_RESULTS | mysql.CLIENT_PS_MULTI_RESULTS | mysql.CLIENT_LOCAL_FILES

Notes

Pure additive change — no breaking API changes, no interface changes.
mysql.CLIENT_LOCAL_FILES is already defined in mysql/const.go.
This complements client: add ExecQueryRelayLocalInfile for proxy-friendly LOAD DATA LOCAL INFILE #1161 (ExecQueryRelayLocalInfile) which provides the client-side relay API needed to complete the proxy pipeline.

Made with Cursor

A go-mysql server acting as a proxy must advertise CLIENT_LOCAL_FILES in the handshake so that connecting clients agree to send file packets for LOAD DATA LOCAL INFILE queries. Without this flag, clients that negotiate CLIENT_LOCAL_FILES will never receive the 0xfb request packet from the proxy-as-server, making it impossible to relay LOAD DATA LOCAL INFILE through a transparent proxy. Closes go-mysql-org#1160 Co-authored-by: Cursor <[email protected]>

nzin-alayacare · 2026-07-02T14:16:13Z

Hi @lance6716 (or other) FYI, these are the last 3 contributions that I need to have "our" proxy application working:

this one: server: add CLIENT_LOCAL_FILES to default server capabilities #1163
client: add ExecQueryRelayLocalInfile for proxy-friendly LOAD DATA LOCAL INFILE #1164
client: add Stmt.ExecuteProcedureMultiResults for multi-result stored procedures #1165

We can work on them, one by one, if you want.

gemini-code-assist · 2026-07-02T14:19:19Z

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.

nzin-alayacare · 2026-07-02T14:25:23Z

/gemini review

Extend server capability assertions to include CLIENT_LOCAL_FILES and add a handshake round-trip test that verifies the flag survives negotiation when requested by the client. Co-authored-by: Cursor <[email protected]>

gemini-code-assist · 2026-07-02T14:37:39Z

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.

nzin-alayacare · 2026-07-02T14:41:11Z

/gemini review

gemini-code-assist

Code Review

This pull request enables the mysql.CLIENT_LOCAL_FILES capability by default in both NewDefaultServer and NewServerWithAuth, and adds a corresponding integration test to verify that the capability is successfully negotiated. The review feedback highlights a security concern: enabling CLIENT_LOCAL_FILES by default can expose servers to unauthorized local file access. Since the capability field is unexported, users currently have no way to disable it. It is recommended to provide exported helper methods, such as SetCapability and UnsetCapability, to allow downstream users to configure these capabilities for security compliance.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Expose Server.Capability, SetCapability, and UnsetCapability so downstream users can opt out of CLIENT_LOCAL_FILES when they do not need LOAD DATA LOCAL INFILE relay support. Add TestLocalFilesCapabilityCanBeDisabled to verify the flag is not negotiated after UnsetCapability. Co-authored-by: Cursor <[email protected]>

nzin-alayacare · 2026-07-02T14:50:16Z

/gemini review

gemini-code-assist · 2026-07-02T14:51:25Z

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.

gemini-code-assist

Code Review

This pull request adds support for the CLIENT_LOCAL_FILES capability in the MySQL server configuration, allowing it to be advertised and negotiated or disabled. It also introduces getter and setter methods (Capability, SetCapability, UnsetCapability) for the server's capability flags. However, because Server is a shared configuration object accessed concurrently, modifying s.capability via SetCapability or UnsetCapability can lead to data races. It is recommended to use atomic operations for accessing and modifying the capability flags.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Remove CLIENT_LOCAL_FILES from default server capabilities so upgrades do not enable LOAD DATA LOCAL INFILE unless explicitly requested via SetCapability. Use atomic operations for Capability, SetCapability, and UnsetCapability to avoid data races on the shared Server config. Update handshake and tests to reflect opt-in behavior. Co-authored-by: Cursor <[email protected]>

nzin-alayacare · 2026-07-02T15:03:42Z

@lance6716 do you see a "simpler" way to do it? (no rush... ;-) )

lance6716

I'd like to review 3 PRs one by one :-)

Will review the rest PRs about 20 hours later.

…ql-org#1163) * server: add CLIENT_LOCAL_FILES to default server capabilities A go-mysql server acting as a proxy must advertise CLIENT_LOCAL_FILES in the handshake so that connecting clients agree to send file packets for LOAD DATA LOCAL INFILE queries. Without this flag, clients that negotiate CLIENT_LOCAL_FILES will never receive the 0xfb request packet from the proxy-as-server, making it impossible to relay LOAD DATA LOCAL INFILE through a transparent proxy. Closes go-mysql-org#1160 Co-authored-by: Cursor <[email protected]> * test: verify CLIENT_LOCAL_FILES advertised and negotiated Extend server capability assertions to include CLIENT_LOCAL_FILES and add a handshake round-trip test that verifies the flag survives negotiation when requested by the client. Co-authored-by: Cursor <[email protected]> * server: add SetCapability and UnsetCapability for handshake flags Expose Server.Capability, SetCapability, and UnsetCapability so downstream users can opt out of CLIENT_LOCAL_FILES when they do not need LOAD DATA LOCAL INFILE relay support. Add TestLocalFilesCapabilityCanBeDisabled to verify the flag is not negotiated after UnsetCapability. Co-authored-by: Cursor <[email protected]> * server: opt-in CLIENT_LOCAL_FILES and use atomic capability flags Remove CLIENT_LOCAL_FILES from default server capabilities so upgrades do not enable LOAD DATA LOCAL INFILE unless explicitly requested via SetCapability. Use atomic operations for Capability, SetCapability, and UnsetCapability to avoid data races on the shared Server config. Update handshake and tests to reflect opt-in behavior. Co-authored-by: Cursor <[email protected]> --------- Co-authored-by: Cursor <[email protected]>

nzin-alayacare mentioned this pull request Jul 2, 2026

client: add ExecQueryRelayLocalInfile for proxy-friendly LOAD DATA LOCAL INFILE #1164

Merged

test: verify CLIENT_LOCAL_FILES advertised and negotiated

02ceed4

Extend server capability assertions to include CLIENT_LOCAL_FILES and add a handshake round-trip test that verifies the flag survives negotiation when requested by the client. Co-authored-by: Cursor <[email protected]>

gemini-code-assist Bot reviewed Jul 2, 2026

View reviewed changes

Comment thread server/server_conf.go Outdated

gemini-code-assist Bot reviewed Jul 2, 2026

View reviewed changes

Comment thread server/server_conf.go

lance6716 approved these changes Jul 2, 2026

View reviewed changes

lance6716 merged commit b1cc553 into go-mysql-org:master Jul 2, 2026
20 checks passed

nzin-alayacare mentioned this pull request Jul 3, 2026

server: fix OK session-track suffix and validate SetCapability #1167

Merged

4 tasks

This was referenced Jul 6, 2026

Update gomod dependencies PeerDB-io/peerdb#4545

Merged

Update gomod dependencies PeerDB-io/peerdb#4546

Closed

nzin-alayacare mentioned this pull request Jul 13, 2026

Release v1.16.0 #1171

Merged

Uh oh!

Conversation

nzin-alayacare commented Jul 2, 2026

Summary

Motivation

Changes

Notes

Uh oh!

nzin-alayacare commented Jul 2, 2026

Uh oh!

gemini-code-assist Bot commented Jul 2, 2026

Uh oh!

nzin-alayacare commented Jul 2, 2026

Uh oh!

gemini-code-assist Bot commented Jul 2, 2026

Uh oh!

nzin-alayacare commented Jul 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

nzin-alayacare commented Jul 2, 2026

Uh oh!

gemini-code-assist Bot commented Jul 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

nzin-alayacare commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lance6716 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nzin-alayacare commented Jul 2, 2026 •

edited

Loading