-Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:32:53 GMT Content -Type: text/html; charset=utf-8 vttablet for zone1 -0000000102... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:33:01 GMT Content -Type: text/html; charset=utf-8 W0325 11:33:01.932674 16036 main.go:64] W0325 17:33:01.930970 reparent.go:185] json Boolean Output JSON instead of human-readable table options string execute options values as a text encoded proto of the ExecuteOptions structure server string VtGate server to connect to target string

-shards 8 -vschema-file vschema.json -schema-file schema.sql -replication-mode “ROW” -output-mode text -sql “SELECT * from users” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000200... Starting vttablet for zone1 -0000000200... HTTP/1.1 200 OK Date: Thu, 21 May 2020 01:05:31 GMT Content -Type: text/html; charset=utf-8 -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000400... Starting vttablet for zone1 -0000000400... HTTP/1.1 200 OK Date: Thu, 21 May 2020 01:05:40 GMT Content -Type: text/html; charset=utf-8

vschema.json -schema-file schema.sql -ks-shard-map shardmaps.json -replication-mode “ROW” -output-mode text -sql “SELECT FROM users; SELECT FROM users WHERE id IN (10, 17, 42, 1000);” . . . 511 Column List added to the test file. AST The code for the Abstract Syntax Tree lives in the file ast.go. The formatting functions for these structs live in the file ast_format.go. Any additional functions for the AST clone the AST, compare its equality etc. If any change is made to any of the AST structs or their formatting functions, then the following command should be run in the root Vitess directory to update all

-shards 8 -vschema-file vschema.json -schema-file schema.sql -replication-mode “ROW” -output-mode text -sql “SELECT * from users” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Short informative summary of the pull request • #[Issue_ID] • Description: More detailed explanatory text describing the PR for the reviewer Suggested Format: [Category ] [Label] Description #[Ticket_ID] -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:32:53 GMT Content -Type: text/html; charset=utf-8

-shards 8 -vschema-file vschema.json -schema-file schema.sql -replication-mode “ROW” -output-mode text -sql “SELECT * from users” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Short informative summary of the pull request • #[Issue_ID] • Description: More detailed explanatory text describing the PR for the reviewer Suggested Format: [Category ] [Label] Description #[Ticket_ID] -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 17 Feb 2021 13:10:03 GMT Content -Type: text/html; charset=utf-8

Short informative summary of the pull request • #[Issue_ID] • Description: More detailed explanatory text describing the PR for the reviewer Suggested Format: Description #[Ticket_ID] Example: Fix where -Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 17 Feb 2021 13:10:03 GMT Content -Type: text/html; charset=utf-8 vttablet for zone1 -0000000102... HTTP/1.1 200 OK Date: Wed, 17 Feb 2021 13:10:12 GMT Content -Type: text/html; charset=utf-8 W0217 16:10:13.075530 65562 main.go:67] W0217 13:10:13.074510 reparent.go:188]

-Type: text/html; charset=utf-8 Starting MySQL for tablet zone1 -0000000101... Starting vttablet for zone1 -0000000101... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:32:53 GMT Content -Type: text/html; charset=utf-8 vttablet for zone1 -0000000102... HTTP/1.1 200 OK Date: Wed, 25 Mar 2020 17:33:01 GMT Content -Type: text/html; charset=utf-8 W0325 11:33:01.932674 16036 main.go:64] W0325 17:33:01.930970 reparent.go:185] IsUnsigned. DECIMAL 18 DECIMAL specifies a DECIMAL or NUMERIC type. Properties: 18, None. TEXT 6163 TEXT specifies a TEXT type. Properties: 19, IsQuoted, IsText. BLOB 10260 BLOB specifies a BLOB type. Properties:

Comparison of Auth Token allows timing Attacks (Info) VIT-01-002 MySQL: Timing attacks due to plain-text password auth (Low) VIT-01-003 PII: Not all SQL values covered by SQL redaction (Low) Conclusions sha1(sha1(pw))) Server compares: generated_hash == stored_hash In case the password is stored as plain-text, Vitess spares itself the final SHA1 operation on the server-side and compares the client's authentication attacker requires the double SHA1 hash of the password and the server has to store the password as plain-text, attacks where this issue is of relevance are not likely. However, it is recommended to perform

IsUnsigned. DECIMAL 18 DECIMAL specifies a DECIMAL or NUMERIC type. Properties: 18, None. TEXT 6163 TEXT specifies a TEXT type. Properties: 19, IsQuoted, IsText. BLOB 10260 BLOB specifies a BLOB type. Properties: json Boolean Output JSON instead of human-readable table options string execute options values as a text encoded proto of the ExecuteOptions structure server string VtGate server to connect to target string ids (in hex) that will map into shards to send query to options string execute options values as a text encoded proto of the ExecuteOptions structure server string VtGate server to connect to tablet_type

done extensive fuzzing work; It carried out a fuzzing audit in 2020 which added coverage to complex text processing routines. Vitess is integrated into OSS-Fuzz which allows the fuzzers to run continuously authenticator that has not been hardened for security; For example, the actor name is sent in plain text, and there is no minimum length required for the actor name. 17 Vitess Security Audit, 2023 ADA-VIT-SA23-2: 'http://localhost:14200/api/vtctlds' j = 0 for i in range(100000): x = requests.get(url) resp = json.loads(x.text) if resp["result"]["vtctlds"][0]["hostname"] != "localhost:15999": break j+=1 if j != 10000: print("We