gate mysql allowAllFiles behind -lfa

[dogancanbakir]

Routes every mysql DSN through a sandbox that drops allowAllFiles unless -lfa is set, matching the fs.ReadFile restriction.

Fixes #7471

Summary by CodeRabbit

• New Features

  • MySQL database connections now enforce sandboxed local file access based on execution settings, with access dynamically restricted or permitted per connection.

• Tests

  • Added test coverage validating file access sandboxing behavior across multiple configuration scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2ea65637-a427-4e09-8abd-08209716bf84

📥 Commits

Reviewing files that changed from the base of the PR and between c041bf2 and 634cecb.

📒 Files selected for processing (3)

• pkg/js/libs/mysql/mysql.go
• pkg/js/libs/mysql/mysql_private.go
• pkg/js/libs/mysql/mysql_private_test.go

---

Walkthrough

Adds a sandboxDSN helper that parses a MySQL DSN and clears the AllowAllFiles flag when local file access is not permitted, and an openDB helper that applies the sandbox before opening a *sql.DB. Both ExecuteQueryWithOpts and connectWithDSN are updated to use openDB instead of calling sql.Open directly.

Changes

MySQL DSN LFA Sandboxing

Layer / File(s)	Summary
sandboxDSN and openDB helpers pkg/js/libs/mysql/mysql_private.go	Adds imports for the MySQL driver, protocolstate, and types; implements sandboxDSN to parse and conditionally clear AllowAllFiles; implements openDB to apply the sandbox before opening a connection.
Call-site wiring and tests pkg/js/libs/mysql/mysql_private.go, pkg/js/libs/mysql/mysql.go, pkg/js/libs/mysql/mysql_private_test.go	Rewires connectWithDSN and ExecuteQueryWithOpts to call openDB instead of sql.Open directly; adds TestSandboxDSN covering strip-when-disabled, preserve-when-enabled, no-op on absent parameter, and invalid DSN error handling.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 A bunny once opened a database door,
But files could sneak through — a troublesome flaw!
So now with a sandbox, the DSN's checked,
allowAllFiles stripped if -lfa is wrecked.
The MySQL gate stands guarded at last! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'gate mysql allowAllFiles behind -lfa' clearly describes the main change: restricting MySQL's allowAllFiles setting based on the -lfa flag.
Linked Issues check	✅ Passed	The PR implements DSN sandboxing that disables allowAllFiles unless -lfa is enabled, directly addressing issue #7471's requirement to enforce -lfa restrictions on MySQL file access.
Out of Scope Changes check	✅ Passed	All changes are focused on implementing MySQL DSN sandboxing for -lfa enforcement; no unrelated modifications are present.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mysql-lfa

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}