SbloodyS commented on PR #18398:
URL:
https://github.com/apache/dolphinscheduler/pull/18398#issuecomment-4998377216
The local string escaping is not safe across the supported database dialects.
`quoteSqlString()` only doubles single quotes. In MySQL's default mode,
backslash is also an escape character. For example, a value such as:
```text
\'; DROP TABLE audit_log; --
```markdown
`render()` returns immediately when `paramsMap` is null or empty.
Consequently, SQL such as:
```sql
select * from t where id = ${missing}
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
