qiuyanjun888 commented on PR #18398:
URL:
https://github.com/apache/dolphinscheduler/pull/18398#issuecomment-5019500607
> The local string escaping is not safe across the supported database
dialects.
>
> `quoteSqlString()` only doubles single quotes. In MySQL's default mode,
backslash is also an escape character. For example, a value such as:
>
> ```
> \'; DROP TABLE audit_log; --
> ```
>
> ```
> `render()` returns immediately when `paramsMap` is null or empty.
Consequently, SQL such as:
>
> ```sql
> select * from t where id = ${missing}
> ```
Removed the dialect-independent automatic quoting, escaping, type
conversion, list rendering, and identifier-context inference. Both ${...} and
!{...} now perform a single-pass textual replacement, so datasource-specific
quoting remains in the SQL or parameter value.
Removed the null/empty parameter-map bypass. Missing parameters and unclosed
source placeholders now fail with TaskException before the SQL reaches JDBC
execution.
Kept replacement values non-recursive: placeholder-like text introduced by a
value is not scanned again.
Updated the English and Chinese SQL Task documentation with the
textual-replacement and trusted-input contract.
Commit:
https://github.com/apache/dolphinscheduler/commit/de866c7d7c3d17ec850cf04c687351204a53223c
Validation: SqlTaskTest — 31 tests, 0 failures/errors/skips; targeted
Spotless check passed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
