Language: Go
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
func (u *MysqlService) ChangeAccess(info dto.ChangeDBInfo) error {
	if cmd.CheckIllegal(info.Value) {
		return buserr.New(constant.ErrCmdIllegal)
	}
	var (
		mysql model.DatabaseMysql
		err   error
	)
	if info.ID != 0 {
		mysql, err = mysqlRepo.Get(commonRepo.WithByID(info.ID))
		if err != nil {
			return err
		}
		if info.Value == mysql.Permission {
			return nil
		}
	}
	app, err := appInstallRepo.LoadBaseInfo("mysql", "")
	if err != nil {
		return err
	}
	if info.ID == 0 {
		mysql.Name = "*"
		mysql.Username = "root"
		mysql.Permission = "%"
		mysql.Password = app.Password
	}

	if info.Value != mysql.Permission {
		var userlist []string
		if strings.Contains(mysql.Permission, ",") {
			userlist = strings.Split(mysql.Permission, ",")
		} else {
			userlist = append(userlist, mysql.Permission)
		}
		for _, user := range userlist {
			if len(user) != 0 {
				if strings.HasPrefix(app.Version, "5.6") {
					if err := excuteSql(app.ContainerName, app.Password, fmt.Sprintf("drop user '%s'@'%s'", mysql.Username, user)); err != nil {
						return err
					}
				} else {
					if err := excuteSql(app.ContainerName, app.Password, fmt.Sprintf("drop user if exists '%s'@'%s'", mysql.Username, user)); err != nil {
						return err
					}
				}
			}
		}
		if info.ID == 0 {
			return nil
		}
	}

	if err := u.createUser(app.ContainerName, app.Password, app.Version, dto.MysqlDBCreate{
		Username:   mysql.Username,
		Name:       mysql.Name,
		Permission: info.Value,
		Password:   mysql.Password,
	}); err != nil {
		return err
	}
	if err := excuteSql(app.ContainerName, app.Password, "flush privileges"); err != nil {
		return err
	}
	if info.ID == 0 {
		return nil
	}

	_ = mysqlRepo.Update(mysql.ID, map[string]interface{}{"permission": info.Value})

	return nil
}