Skip to content

Commit

Permalink
[INLONG-8603][Manager] Fix the vulnerability to security attacks for …
Browse files Browse the repository at this point in the history 
…the MySQL JDBC URL (#8604)
  • Loading branch information
@fuweng11
fuweng11 authored Jul 31, 2023
1 parent b30161e commit 46c4e96
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 13 deletions.
6 changes: 2 additions & 4 deletions ...er/manager-pojo/src/main/java/org/apache/inlong/manager/pojo/sink/mysql/MySQLSinkDTO.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -245,15 +245,13 @@ public static String filterSensitive(String url) {
String key = StringUtils.substringBefore(param, "=");
String value = StringUtils.substringAfter(param, "=");

if (SENSITIVE_REMOVE_PARAM_MAP.contains(key)) {
if (SENSITIVE_REMOVE_PARAM_MAP.contains(key) || SENSITIVE_REPLACE_PARAM_MAP.containsKey(key)) {
continue;
}

if (SENSITIVE_REPLACE_PARAM_MAP.containsKey(key)) {
value = SENSITIVE_REPLACE_PARAM_MAP.get(key);
}
paramList.add(key + "=" + value);
}
SENSITIVE_REPLACE_PARAM_MAP.forEach((key, value) -> paramList.add(key + "=" + value));

String params = StringUtils.join(paramList, "&");
builder.append(params);
Expand Down
18 changes: 9 additions & 9 deletions ...anager-pojo/src/test/java/org/apache/inlong/manager/pojo/sink/mysql/MySQLSinkDTOTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,24 +33,24 @@ public void testFilterSensitive() throws Exception {
String originUrl = MySQLSinkDTO.filterSensitive(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=TRue&allowLoadLocalInfile = TRue&allowUrlInLocalInfile=TRue&allowLoadLocalInfileInPath=/&autoReconnect=true");
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=false&allowLoadLocalInfile=false&allowUrlInLocalInfile=false&autoReconnect=true",
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);

originUrl = MySQLSinkDTO.filterSensitive(
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize = TRue&allowLoadLocalInfile=TRue&allowUrlInLocalInfile=TRue&allowLoadLocalInfileInPath=/");
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowLoadLocalInfile=false&allowUrlInLocalInfile=false",
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);

originUrl = MySQLSinkDTO.filterSensitive(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=TRue&allowLoadLocalInfile = TRue&autoReconnect=true&allowUrlInLocalInfile=TRue&allowLoadLocalInfileInPath=/");
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=false&allowLoadLocalInfile=false&autoReconnect=true&allowUrlInLocalInfile=false",
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);
originUrl = MySQLSinkDTO.filterSensitive(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=Yes&allowLoadLocalInfile = Yes&autoReconnect=true&allowUrlInLocalInfile=YEs&allowLoadLocalInfileInPath=/");
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=false&allowLoadLocalInfile=false&autoReconnect=true&allowUrlInLocalInfile=false",
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);

// the sensitive params use url code
Expand All @@ -59,37 +59,37 @@ public void testFilterSensitive() throws Exception {
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=TRue&allowLoadLocalInfile = TRue&allowUrlInLocalInfile=TRue&allowLoadLocalInfileInPath=/&autoReconnect=true",
"UTF-8"));
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=false&allowLoadLocalInfile=false&allowUrlInLocalInfile=false&autoReconnect=true",
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);

originUrl = MySQLSinkDTO.filterSensitive(
URLEncoder.encode(
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize = TRue&allowLoadLocalInfile=TRue&allowUrlInLocalInfile=TRue&allowLoadLocalInfileInPath=/",
"UTF-8"));
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowLoadLocalInfile=false&allowUrlInLocalInfile=false",
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);

originUrl = MySQLSinkDTO.filterSensitive(
URLEncoder.encode(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=TRue&allowLoadLocalInfile = TRue&autoReconnect=true&allowUrlInLocalInfile=TRue&allowLoadLocalInfileInPath=/",
"UTF-8"));
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=false&allowLoadLocalInfile=false&autoReconnect=true&allowUrlInLocalInfile=false",
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);

originUrl = MySQLSinkDTO.filterSensitive(
URLEncoder.encode(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=Yes&allowLoadLocalInfile = yes&autoReconnect=true&allowUrlInLocalInfile=YES&allowLoadLocalInfileInPath=/",
"UTF-8"));
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=false&allowLoadLocalInfile=false&autoReconnect=true&allowUrlInLocalInfile=false",
"jdbc:mysql://127.0.0.1:3306?autoReconnect=true&autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);

originUrl = MySQLSinkDTO.filterSensitive(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=%59%65%73&allowLoadLocalInfile = yes&allowUrlInLocalInfil%65+=%74%72%75%45&allowLoadLocalInfileInPath=%2F");
Assertions.assertEquals(
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=false&allowLoadLocalInfile=false&allowUrlInLocalInfile=false",
"jdbc:mysql://127.0.0.1:3306?autoDeserialize=false&allowUrlInLocalInfile=false&allowLoadLocalInfile=false",
originUrl);
}

Expand Down

0 comments on commit 46c4e96

Please sign in to comment.