[tanjiroK-coder]

FeaturesAllowed.SELECT is documented as every SELECT feature "without modification features like selectInto", and Validation with it is a natural gate for only letting read queries through. SelectValidator checks getIntoTables() against Feature.selectInto, but the MySQL/MariaDB INTO OUTFILE / INTO DUMPFILE / INTO @var clause lives in getMySqlSelectIntoClause() and the trailing INTO TEMP table in getIntoTempTable(), and neither was looked at. So SELECT * INTO newtab FROM t is reported as selectInto not allowed, while SELECT a FROM t INTO OUTFILE '/tmp/x', SELECT '<?php ... ?>' INTO DUMPFILE '/var/www/html/s.php' and the same clause inside an IN (...) subquery validate with no errors, although they write files on the database server. I found it by running statements with side effects through Validation.validate(List.of(FeaturesAllowed.SELECT), sql) and comparing which ones came back clean. Both clauses now report selectInto next to the existing INTO-table check, and selectInto is added to MySqlVersion and MariaDbVersion so validating against DatabaseType.MYSQL / MARIADB still accepts their own SELECT ... INTO syntax. The new parameterized case in SelectValidatorTest fails for all five statements before the change, and ./gradlew check passes after it.

[manticore-projects]

Thank you!