JoegenUSTC opened a new pull request, #11840:
URL: https://github.com/apache/gravitino/pull/11840
### What changes were proposed in this pull request?
- Override `generateDatabaseExistSql` in `ClickHouseDatabaseOperations` to
query `system.databases` with proper single-quote escaping via
`escapeSingleQuotes`. The inherited default targets
`information_schema.SCHEMATA` which ClickHouse does not support.
- Escape `databaseName` and `tableName` in
`ClickHouseTableOperations.getIndexes()` before interpolating into
`QUERY_INDEXES_SQL`.
- Add unit tests for `generateDatabaseExistSql` covering normal names and
names containing single quotes.
### Why are the changes needed?
Both code paths interpolate user-provided names into SQL string literals
without escaping single quotes, creating SQL injection vulnerabilities.
ClickHouse's JDBC driver does not support `PreparedStatement` parameterization
for `system`-table queries, so string escaping (single-quote doubling) is the
correct and only viable mitigation. The fix reuses the existing
`ClickHouseClusterUtils.escapeSingleQuotes()` utility already used by
`generateCreateDatabaseSql`, `generateAlterTableSql`, and other methods in the
same module.
Fix: #11839
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
- `./gradlew :catalogs-contrib:catalog-jdbc-clickhouse:spotlessApply` —
passes
- `./gradlew :catalogs-contrib:catalog-jdbc-clickhouse:build` — passes
- `./gradlew :catalogs-contrib:catalog-jdbc-clickhouse:test` — all tests
pass, including new tests:
- `testGenerateDatabaseExistSqlNormalName` — verifies normal name produces
correct SQL
- `testGenerateDatabaseExistSqlSingleQuoteEscaped` — verifies `test'db` →
`test''db`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
