JandyTenedora opened a new pull request, #11780:
URL: https://github.com/apache/gravitino/pull/11780
### What changes were proposed in this pull request?
Add `validateBacktickQuotedIdentifier()` in `JdbcDatabaseOperations` to
reject database names containing SQL metacharacters before they are embedded in
backtick-quoted SQL. Applied to all JDBC catalog overrides
that use backtick quoting (MySQL, OceanBase, Doris, StarRocks, ClickHouse).
### Why are the changes needed?
`generateDropDatabaseSql` builds SQL via string formatting with backtick
quoting. A name containing backticks can break out of the identifier and inject
arbitrary SQL. The upstream `SchemaNormalizeDispatcher`
validates names today, but calling `JdbcDatabaseOperations.delete()`
directly bypasses that validation.
Fix: #4211
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Added unit tests in `TestJdbcDatabaseOperations` and
`TestClickHouseDatabaseOperations` covering valid names, null, empty, SQL
injection strings, spaces, and overlength names.
```bash
./gradlew :catalogs:catalog-jdbc-common:test
./gradlew :catalogs:catalog-jdbc-common:spotlessApply
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
