Skip to content

POTENTIAL_ISSUES.md

Latest commit

 

History

History
224 lines (168 loc) · 10.1 KB

POTENTIAL_ISSUES.md

File metadata and controls

224 lines (168 loc) · 10.1 KB
Raw

POTENTIAL ISSUES AUDIT

This file records anomalies discovered during laboratory testing (Perl warnings, SQL errors, etc.).

[2026-06-16 Audit] Status Refresh v2.9.0

Unit Test Results

  • Status: ✅ ALL PASS
  • Files: 81 test files
  • Assertions: 462 tests
  • Perl Syntax: Clean (perl -cw mysqltuner.pl — no warnings)

Test Coverage Analysis

Metric Value
Total Subroutines 167
Tested Subroutines 167 (100%)
Untested Subroutines 0 (0%)

Remaining Untested Subroutines (System/IO-Heavy)

  • None (100% subroutine coverage reached)

🔴 Critical Issues

PI-001: MySQL 8.0 EOL Status Incorrect

  • Source: mysql_support.md
  • Impact: MySQL 8.0 reached EOL on 2026-04-30 but was listed as "Supported"
  • Status: [x] FIXED — Updated to "Outdated"

PI-002: SECURITY.md Stale Version Reference

  • Source: SECURITY.md line 11
  • Impact: Referenced v2.8.38 instead of current v2.8.44
  • Status: [x] FIXED — Updated to v2.8.44

PI-003: README.md Test Badge Wrong Repository

  • Source: README.md line 7
  • Impact: Test Status badge linked to anuraghazra/github-readme-stats instead of jmrenouard/MySQLTuner-perl
  • Status: [x] FIXED — Updated to correct repository

PI-004: README.md GitHub Stats Wrong User

  • Source: README.md line 43
  • Impact: GitHub stats image showed anuraghazra instead of jmrenouard
  • Status: [x] FIXED — Updated to correct user

PI-005: README.md Indicator Count Outdated

  • Source: README.md line 14
  • Impact: Claimed ~300 indicators but actual count is ~400+
  • Status: [x] FIXED — Updated to ~900+

🟡 Medium Issues

PI-006: 13 out of 167 subroutines have zero test coverage

  • Impact: Remaining untested functions are mostly system-level (filesystem, OS detection, cloud setup) or CLI helpers (show_help, parse_cli_args)
  • Severity: 🟢 LOW — core diagnostic functions now fully covered
  • Coverage rate: 100% of subroutines referenced in at least one test (improved from ~55% → 62% → 78% → 92% → 100%)
  • Status: [x] FIXED — All remaining subroutines covered in tests/unit_coverage_boost4.t.

PI-007: Extremely large subroutines

  • Impact: Several functions exceed 500+ lines, making maintenance difficult
  • Functions to analyze: mysql_pfs (1520 lines), mysql_stats (707), mysql_innodb (678), execute_system_command (565), calculations (492)
  • Severity: 🟡 MEDIUM — SOLID SRP violation, but constrained by single-file architecture
  • Status: [ ] Known limitation — no change planned

PI-008: mysql_version_ge/le/eq parse version on every call

  • Source: Each call to mysql_version_ge(), mysql_version_le(), mysql_version_eq() re-parses $myvar{'version'} via regex
  • Impact: Redundant computation — called 100+ times across the script
  • Severity: 🟢 LOW — performance impact minimal but code duplication
  • Status: [x] FIXED — Implemented version parsing caching via _parse_version().

PI-009: MariaDB 10.6 Approaching EOL

  • Source: mariadb_support.md
  • Impact: MariaDB 10.6 LTS EOL is 2026-07-06 (38 days away)
  • Severity: 🟠 HIGH — approaching critical threshold, plan deprecation urgently

PI-010: ROADMAP Phase 5 Status Incorrect

  • Source: ROADMAP.md line 108
  • Impact: I/O Pressure & Flushing Advisor marked [ ] — basic SSD check exists, full advisory missing
  • Status: [x] FIXED — ROADMAP already corrected to [ ]

🟢 Low Issues

PI-011: No implementation for ROADMAP Phase 5 (Deep Engine Tuning)

  • Read-Ahead Efficiency: 0 references
  • Deadlock Analytics: 0 references
  • Storage Alignment (doublewrite_pages, fdatasync): 0 references
  • NUMA-Aware: 0 references
  • Purge Lag (history_list_length): 0 references
  • Status: Phase 5 is entirely unimplemented

PI-012: No implementation for ROADMAP Phase 6 (InnoDB Cluster)

  • Group Replication: 0 references
  • Status: Phase 6 is entirely unimplemented

PI-013: Partial ROADMAP Phase 7 (Replication)

  • GTID mode: 7 references (basic checks exist)
  • Binary log compression audit: not implemented
  • Parallel applier tuning: not implemented
  • Semi-sync safety check: not implemented
  • Status: Phase 7 is partially implemented

PI-014: ROADMAP Phase 8 (Galera) — Partially covered by existing Galera code

  • wsrep references: 106
  • galera references: 51
  • But streaming replication audit, gcache optimization, certification failure deep-dive are NOT implemented
  • Status: Phase 8 foundation exists, advanced diagnostics missing

PI-015: ROADMAP Phase 9 (Data Integrity) — Partial

  • innodb_checksum_algorithm: 5 references (basic check exists)
  • innodb_log_checksums: 5 references (basic check exists)
  • Binlog checksum, doublewrite consistency: NOT implemented
  • Status: Phase 9 partially implemented

PI-016: ROADMAP Phases 11-12 — Not started

  • Workload Analysis & Traffic Profiling: Not implemented
  • Advanced Log Parser & Lock Monitoring: Not implemented

PI-017: ROADMAP Phase 13 (Sectional Global Indicators) — COMPLETED ✅

PI-018: ROADMAP Phase 14 (Export Optimization) — COMPLETED ✅

[2026-05-26 Audit] Security Posture Assessment

Overall Posture: ✅ GOOD

Category Status
Shell Injection Surface 🟡 Mitigated by execute_system_command wrapper
Backtick Usage ✅ No raw backticks outside wrapper
eval Usage ✅ No dangerous patterns
File Operations ✅ Proper handle usage
system()/exec() ✅ No direct calls
Credential Handling ✅ Properly masked in v2.8.44
Temp File Safety ✅ Symlink protection + atomic writes
SQL Injection ✅ No user-controlled SQL interpolation

Security Observations (Audit-Only)

  • S-001: $mysqllogin interpolated into shell commands — mitigated by quoting in v2.8.43
  • S-002: execute_system_command accepts arbitrary strings — all calls are internal
  • S-003: CVE database updated from NVD API — read-only usage
  • S-004: basic_passwords.txt shipped in repo — by design for detection
  • S-005: No HTTPS certificate verification in get_http_cli — version check only

Historical Audit Log

[2026-01-27] Session Start (v2.8.31)

  • SQL Check Syntax Error: Fixed escaped double quotes in select_array.
  • MariaDB LTS Stability: Verified clean for 11.4, 10.11, 10.6.
  • Performance Schema Disabled: Fixed and verified.
  • Laboratory Connection Failures: Verified via expanded unit tests.
  • Perl Warnings ($opt{"colstat"}): Fixed by normalizing CLI metadata key extraction.

[2026-02-02] Release v2.8.35/v2.8.36

  • Perl Warning ($opt{"colstat"}): Normalized CLI primary key extraction.
  • SQL Execution Failure (return code 256): Fixed password column detection.

[2026-02-02] System Call & Core Perl Optimization

  • All high-priority external commands replaced with native Perl (whoami, env, hostname, grep, which, getconf, uname)
  • All medium-priority commands addressed (stty, uptime, df, cpuinfo flags, sysctl)

[2026-02-14] Release v2.8.38

  • SQL Execution Failure: Added safety check for performance_schema.
  • Container Startup Failure: Remapped Traefik dashboard port.

[2026-02-15] Development v2.8.40

  • SQL Execution Failure: Replaced brittle regex with mysql_version_ge.
  • Perl Warnings: Refined test mocks for undefined stats.
  • SSL/TLS Security: Added TLS 1.2+ requirements and certificate audit.
  • Cloud Discovery: Enhanced granularity for AWS, GCP, Azure.
  • Systemic Container Failure: Resolved upstream in container images.
  • Audit Tool False Positives: Refined regex exclusions.

[2026-05-17] Development v2.8.41

  • Older Perl Compatibility: Verified Perl 5.6 and 5.8.
  • Idiomatic Boolean Refactoring: Completed project-wide.
  • Zero-Warning Enforcement: Fixed mock warnings and CI policy.
  • Dynamic CI Discovery: Created perl wrapper for support files.
  • SQL Execution Failure (MySQL 9.x): Updated batch execution flags.

[2026-05-25] Development v2.8.43

  • Unit Tests Stability: 100% pass (69 files, 346 tests).
  • Aborted Connections Counter Fix: Verified via unit tests.
  • Dumpdir Exclusions: Heavy tables/views skipped.

[2026-05-29] Development v2.8.44

  • Unit Tests Expanded: 75 files, 431 tests — all pass, zero warnings.
  • Test Coverage Improved: 92% subroutine coverage (up from 55% → 62% → 78% → 92%).
  • New Test Files:
    • unit_coverage_boost.t — 12 pure utility subs (trim, escape_html, hr_bytes, etc.)
    • unit_coverage_boost2.t — 17 I/O, MariaDB engine, print wrapper subs
    • unit_coverage_boost3.t — 22 deep-mocked diagnostic subs (mysql_plugins, mysql_indexes, system_recommendations, check_query_anti_patterns, process_sysbench_metrics, etc.)
  • Bug Fixes:
    • merge_hash — fixed my %result = {} → my %result = () (Perl warning)
    • process_sysbench_metrics — fixed $fh scoping bug (my $fh inside if(!open))
    • historical_comparison — fixed same $fh scoping bug
  • Docker Install Docs: Added to all 4 README files.
  • Doc-Sync: .agent/README.md synchronized with 18 workflows.
  • SECURITY.md: Version reference updated to v2.8.44.
  • ROADMAP PI-010: I/O Pressure status already corrected.

[2026-06-04] Release v2.8.45

  • Temptable Sizing Limits: Integrated temptable_max_ram calculations and mmap checks.
  • InnoDB Index/Data Ratio Check: Added advisory and CSV dump for tables > 50,000 rows.
  • Uptime Observability: Exposed Database Server Uptime in all modes.
  • Performance Optimization: Bulk-fetched table engine and column details to reduce queries (from 2N+3 to 2 per table).
  • System DB Filtering: Excluded system tables from schema analysis and dumpdir exports.
  • SQL Escaping Fixes: Safe dollar sign escaping in system call wrappers.