(inlong) branch master updated: [INLONG-12135][Manager] Enhance the verification against SQL injection (#12136)

[dockerzhang]

This is an automated email from the ASF dual-hosted git repository.

dockerzhang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/inlong.git


The following commit(s) were added to refs/heads/master by this push:
     new 3af0ea97e8 [INLONG-12135][Manager] Enhance the verification against 
SQL injection (#12136)
3af0ea97e8 is described below

commit 3af0ea97e88d1e91c364db829bc19a689fc4af6c
Author: fuweng11 <76141879+fuwen...@users.noreply.github.com>
AuthorDate: Wed Jun 3 19:28:16 2026 +0800

    [INLONG-12135][Manager] Enhance the verification against SQL injection 
(#12136)
    
    Co-authored-by: wakefu <wak...@tencent.com>
---
 .../service/resource/sink/greenplum/GreenplumSqlBuilder.java        | 6 ++++++
 .../service/resource/sink/postgresql/PostgreSQLSqlBuilder.java      | 6 ++++++
 .../service/resource/sink/sqlserver/SQLServerSqlBuilder.java        | 3 +++
 3 files changed, 15 insertions(+)

diff --git 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/greenplum/GreenplumSqlBuilder.java
 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/greenplum/GreenplumSqlBuilder.java
index 3bff3c2c8f..a9646df0e8 100644
--- 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/greenplum/GreenplumSqlBuilder.java
+++ 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/greenplum/GreenplumSqlBuilder.java
@@ -74,6 +74,12 @@ public class GreenplumSqlBuilder {
      * @return SQL String
      */
     public static String buildCreateSchema(final String schemaName, final 
String user) {
+        if (!schemaName.matches("^[a-zA-Z0-9._]+$")) {
+            throw new IllegalArgumentException("Invalid schema name");
+        }
+        if (!user.matches("^[a-zA-Z0-9._]+$")) {
+            throw new IllegalArgumentException("Invalid user name");
+        }
         return new StringBuilder()
                 .append(" CREATE SCHEMA \"")
                 .append(schemaName)
diff --git 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/postgresql/PostgreSQLSqlBuilder.java
 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/postgresql/PostgreSQLSqlBuilder.java
index f6bc6caf8c..eae13ffa30 100644
--- 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/postgresql/PostgreSQLSqlBuilder.java
+++ 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/postgresql/PostgreSQLSqlBuilder.java
@@ -115,6 +115,12 @@ public class PostgreSQLSqlBuilder {
      * @return SQL String
      */
     public static String buildCreateSchema(final String schemaName, final 
String user) {
+        if (!schemaName.matches("^[a-zA-Z0-9._]+$")) {
+            throw new IllegalArgumentException("Invalid schema name");
+        }
+        if (!user.matches("^[a-zA-Z0-9._]+$")) {
+            throw new IllegalArgumentException("Invalid user name");
+        }
         return new StringBuilder()
                 .append(" CREATE SCHEMA \"")
                 .append(schemaName)
diff --git 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/sqlserver/SQLServerSqlBuilder.java
 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/sqlserver/SQLServerSqlBuilder.java
index c999ea0536..18b1a85a83 100644
--- 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/sqlserver/SQLServerSqlBuilder.java
+++ 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/resource/sink/sqlserver/SQLServerSqlBuilder.java
@@ -98,6 +98,9 @@ public class SQLServerSqlBuilder {
      * @return
      */
     public static String buildCreateSchemaSql(String schemaName) {
+        if (!schemaName.matches("^[a-zA-Z0-9._]+$")) {
+            throw new IllegalArgumentException("Invalid schema name");
+        }
         return new StringBuilder()
                 .append("CREATE SCHEMA \"")
                 .append(schemaName)