Benefits of 'Other - JDBC Driver' instead of MariaDB extension

dev
1

I recently discovered that the MariaDB extension isn’t strictly required to be installed. Alternatively, the driver can simply be ‘Other - JDBC Driver’ with just a little extra manual configuring of each datasource.

The downside is that you’ll have to maintain the Connector/J version of each MariaDB datasource, but you can either automate that with a custom script or simply search/replace with your editor.

The biggest advantage is that you’re not stuck on an outdated version of MariaDB Connector/J when the Forgebox extension is lagging behind, which by the way it recently did for about 11 weeks prior to extension 3.5.10 on Oct 11. Upstream that version was released Jul 29 and it was an important one because it fixed an RCE (CONJ-1342, socketFactory bytecode loading), SQL injection in updatable ResultSets, TLS validation deferral, CONJ-1332 pre-auth OOM, and various other bug fixes.

Even now the extension continues to lag behind the current versions of 3.5.11 with yet more bug fixes and 4.0.0 which features the major change of requiring Java 17+. I’m waiting for at least 4.0.1 in case there are edge case bugs, but I’m looking forward to v4’s improved performance.

How to Reconfigure

First, in Lucee Admin, uninstall the MariaDB driver, then stop Lucee.

Then for each MariaDB datasource in .CFConfig.json (after backing up that file), replace this:

"dbdriver": "MariaDB",

with this:

"dbdriver": "Other",

And under the bundleName line add:

"bundleVersion": "3.5.11",

That’s probably all you need to change, but make sure these also exist:

"class": "org.mariadb.jdbc.Driver",
"bundleName": "mariadb-java-client",

If MariaDB still happens to be in the “extensions” block (“id”: “F2FA5DB2-0C27-499C-B1171D2D812FDAF9”), remove it to avoid NoSuchFileException on restart.

And remove the “org.mariadb.jdbc.Driver” block from “jdbcDrivers” (or simply remove the entire “jdbcDrivers” block if there are no other drivers).

Currently update.lucee.org returns 404 for mariadb-java-client-3.5.11.jar, probably because it still refers to the old BSN org.mariadb.jdbc.

So you’ll need to download that jar from Maven into /opt/lucee/tomcat/lucee-server/bundles and delete any other mariadb files you might have in that folder.

And finally start Lucee again.

If creating datasource via Lucee Admin, for the type choose ‘Other - JDBC Driver’ and at the bottom of the form:

Class: org.mariadb.jdbc.Driver
Connection String: jdbc:mariadb://{host}:{port}/{database}
Bundle Name: mariadb-java-client
Bundle Version: 3.5.11

I’m sure the @GianTschingt AI bot will correct me if I’m mistaken about any of the above. :stuck_out_tongue:

1 Like
2

Thanks Ken, your steps look right to me. Using “Other” with bundleName/bundleVersion is a perfectly valid setup. Point taken on the extension lagging behind. We’ll look at bumping it to 3.5.11 and at tracking Connector/J faster. I’ll also check the update.lucee.org 404 for mariadb-java-client 3.5.11 and report back.

3

Hi Ken, thanks for the report, your guess was close, just the other way round :slightly_smiling_face:

With Connector/J 3.x MariaDB changed the OSGi bundle name from org.mariadb.jdbc (2.x) to mariadb-java-client. update.lucee.org only knew the old 2.x name, so asking for mariadb-java-client 3.x returned a 404.

That’s fixed now (LDEV-6738), and the 3.x versions resolve from update.lucee.org again. Could you give it another try?

Also, the MariaDB extension upgrade to 3.5.11 is up as a PR for Julian: lucee-mariadb#15.

4

Apologies for not keeping up. A while back there was a driver release that introduced new bugs since when I’ve tended to be a bit cautious about jumping on every new version. But I agree that on balance it’s best not to lag behind, for security and performance reasons.

3.5.11 is out now and I’ll look at version 4.0.0. One significant improvement seems to be that it will support unix sockets without the JNA dependency which will reduce the size of the extension.

2 Likes
5

Thanks Julian for putting out 3.5.11, much appreciated!