github-actions[bot] commented on issue #18217: URL: https://github.com/apache/dolphinscheduler/issues/18217#issuecomment-4385606205
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/dolphinscheduler/issues?q=is%3Aissue) and found no similar issues. ### What happened When the DolphinScheduler DataX task plug-in generates a Shell command, variable values containing single quotes are not escaped, causing the quotes to be confused during shell parsing, and 10:59:09 is executed as the Java main class name. This is [1778036486909.log](https://github.com/user-attachments/files/27426592/1778036486909.log) 'AND create_data > '2026-05-06 10:59:09'' ### What you expected to happen `src/main/java/org/apache/dolphinscheduler/plugin/task/datax/DataxTask.java The add parameter method of this class does not translate quotes ` ```java private StringBuilder addCustomParameters(Map<String, Property> paramsMap) { if (paramsMap == null || paramsMap.size() == 0) { return new StringBuilder(); } StringBuilder customParameters = new StringBuilder("-p \""); for (Map.Entry<String, Property> entry : paramsMap.entrySet()) { customParameters.append(String.format(CUSTOM_PARAM, entry.getKey(), entry.getValue().getValue())); } customParameters.replace(4, 5, ""); customParameters.append("\""); return customParameters; } ``` Change to the code below and add translation ```java private StringBuilder addCustomParameters(Map<String, Property> paramsMap) { if (paramsMap == null || paramsMap.size() == 0) { return new StringBuilder(); } StringBuilder customParameters = new StringBuilder("-p \""); for (Map.Entry<String, Property> entry : paramsMap.entrySet()) { String value = entry.getValue().getValue(); // Escape single quotes for shell safety: ' -> '\'' (bash standard escape) // Prevents shell quoting conflicts when value contains single quotes, e.g. // "AND create_data > '2026-05-06 10:59:09'" -> "AND create_data > '\''2026-05-06 10:59:09'\''" String escapedValue = value.replace("'", "'\\''"); customParameters.append(String.format(CUSTOM_PARAM, entry.getKey(), escapedValue)); } customParameters.replace(4, 5, ""); customParameters.append("\""); return customParameters; } ``` ### How to reproduce ```java → Generate ds_incr_condition = "AND create_data > '2026-05-06 10:59:09'" (including single quotes) → DolphinScheduler varPool passed → Single quote nesting conflict when DS DataX plug-in generates Shell command ← Failure point → JVM received bad parameter ``` ### Anything else _No response_ ### Version 3.4.0 ### Are you willing to submit PR? - [x] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
