The GitHub Actions job "Java CI with Maven" on stormcrawler.git/fix/sql-indexer-identifier-injection has succeeded. Run started by GitHub user rzo1 (triggered by rzo1).
Head commit for run: 9d987aea5faa66d6cb7d1a5bf193ab691e4dc295 / Richard Zowalla <[email protected]> SQL IndexerBolt: only plain identifiers may be used as column names, fixes #2096 buildQuery() joined the metadata labels straight into the column list and into the ON DUPLICATE KEY UPDATE clause. Values are bound, but identifiers cannot be, and with a glob mapping (an indexer.md.mapping entry ending in *) the label is the raw metadata key - which crawled content mints: the Tika ParserBolt copies every <meta name="..."> of a page to parse.<name>, and response header names are stored the same way. Labels are now checked against ^[A-Za-z0-9_]+$ and dropped when they do not match, with a warning logged once per distinct label and an unusable_column_name metric. Dropping loses nothing that worked before: any label outside that pattern already produced a broken unquoted identifier and a guaranteed SQLException. That also ends a replay loop, since execute() fails the tuple without emitting to the status stream, so an ordinary dotted label such as parse.title - which MySQL reads as table.column - previously failed the same tuple for the life of the topology. A dropped label is arbitrary crawled content and is written to a log line, so it is rendered as printable ASCII first. A \p{Cntrl} blacklist would not do: it is ASCII-only and leaves U+0085, U+00A0, U+2028 and U+2029 in place, three of which break the line for a log reader. Alias mappings (parse.title=title) remain the supported way to index a dotted key. The table name and the URL field are operator-owned topology config and are left as they are. Report URL: https://github.com/apache/stormcrawler/actions/runs/34386674896 With regards, GitHub Actions via GitBox
