jihoonson opened a new pull request #11063:
URL: https://github.com/apache/druid/pull/11063


   ### Description
   
   A follow-up to https://github.com/apache/druid/pull/11047. This PR changes 
the default to enforce the allow list for JDBC connection properties. 
`allowUnknownJdbcUrlFormat` still remains as true by default because, at least 
the known security vulnerability can be exploitable only with MySQL which Druid 
will always enforce the allow list once it's enabled regardless of 
`allowUnknownJdbcUrlFormat`.
   
   <hr>
   
   <!-- Check the items by putting "x" in the brackets for the done things. Not 
all of these items apply to every PR. Remove the items which are not done or 
not relevant to the PR. None of the items from the checklist below are strictly 
necessary, but it would be very helpful if you at least self-review the PR. -->
   
   This PR has:
   - [x] been self-reviewed.
   - [x] added documentation for new or modified features or behaviors.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
[email protected]



---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to