smolnar82 opened a new pull request, #1383: URL: https://github.com/apache/knox/pull/1383
[KNOX-3442](https://issues.apache.org/jira/browse/KNOX-3442) - Harden H2 JDBC URL construction against injection ## What changes were proposed in this pull request? `H2DataSourceFactory` built the JDBC URL by concatenating `gateway.database.name` verbatim. H2 URLs can carry connection settings (`INIT`, `RUNSCRIPT`, `CREATE ALIAS`) that execute arbitrary code, so a malicious/misconfigured name was a latent RCE sink. The factory now rejects `INIT`/`RUNSCRIPT`/`ALIAS` tokens in the settings portion (after the first `;`, whole-word, case-insensitive) with a clear `SQLException` before the URL is built. The embedded path and valid settings (`DB_CLOSE_DELAY`, `AUTO_SERVER`, `CIPHER`, ...) are unaffected. ## How was this patch tested? Added unit tests in `DataSourceProviderTest` covering a valid `mem:knox;DB_CLOSE_DELAY=-1` name, a rejected `;INIT=RUNSCRIPT FROM 'http://…'`, and a rejected `;init=CREATE ALIAS …`. Full suite: `Tests run: 23, Failures: 0, Errors: 0`. ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
