MDEV-40159: Complete priv escalation for low priv user upon backup re…

mysql-test/main/symlink.result

@@ -249,3 +249,21 @@ t1	CREATE TABLE `t1` (
   `c3` varchar(100) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci DELAY_KEY_WRITE=1 DATA DIRECTORY='MYSQL_TMP_DIR/' INDEX DIRECTORY='MYSQL_TMP_DIR/'
 drop table t1;
+#
+# MDEV-40159: single quote in DATA DIRECTORY breaks SHOW CREATE TABLE
+#
+CREATE TABLE t1 (a int) data directory="MYSQL_TMP_DIR/o'hara";
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `a` int(11) DEFAULT NULL
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci DATA DIRECTORY='MYSQL_TMP_DIR/o\'hara/'
+DROP TABLE t1;
+CREATE TABLE t1 (a int) index directory="MYSQL_TMP_DIR/o'hara";
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `a` int(11) DEFAULT NULL
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci INDEX DIRECTORY='MYSQL_TMP_DIR/o\'hara/'
+DROP TABLE t1;
+# End of 10.6 tests

mysql-test/main/symlink.test

@@ -346,3 +346,22 @@ drop table t1;
 #
 # End of 10.1 tests
 #
+
+--echo #
+--echo # MDEV-40159: single quote in DATA DIRECTORY breaks SHOW CREATE TABLE
+--echo #
+
+--mkdir $MYSQL_TMP_DIR/o'hara
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+eval CREATE TABLE t1 (a int) data directory="$MYSQL_TMP_DIR/o'hara";
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+SHOW CREATE TABLE t1;
+DROP TABLE t1;
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+eval CREATE TABLE t1 (a int) index directory="$MYSQL_TMP_DIR/o'hara";
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+SHOW CREATE TABLE t1;
+DROP TABLE t1;
+--rmdir $MYSQL_TMP_DIR/o'hara
+
+--echo # End of 10.6 tests

sql/sql_show.cc

@@ -1684,7 +1684,7 @@ static void append_directory(THD *thd, String *packet, LEX_CSTRING *dir_type,
     }
     filename= winfilename;
 #endif
-    packet->append(filename, length);
+    packet->append_for_single_quote(filename, length);
     packet->append('\'');
   }
 }