LuciferYang opened a new issue, #12024: URL: https://github.com/apache/gravitino/issues/12024
### What would you like to be improved? `JdbcUrlUtils.validateJdbcConfig` rejects dangerous JDBC connection parameters (MySQL `autoDeserialize`, `queryInterceptors`, `allowLoadLocalInfile`, …; PostgreSQL `socketFactory`, …) that can lead to RCE when a catalog is created/altered. The current check has two gaps on the catalog datasource path (`DataSourceUtils` → DBCP2 `BasicDataSourceFactory`): 1. **It inspects config *values*, not *names*.** `containsValueIgnoreCase` matches a param name against config values, but the map *keys* are never checked. An unsafe parameter supplied as a config key is not detected. 2. **It ignores DBCP2's `connectionProperties`.** DBCP2 recognizes a `connectionProperties` key whose value is a `;`-delimited list of `name=value` pairs that it forwards verbatim to the JDBC driver. A user can reach it via `gravitino.bypass.connectionProperties=autoDeserialize=true` (the `gravitino.bypass.` prefix is stripped before the map reaches the datasource), smuggling an unsafe parameter straight to the driver and fully bypassing the check. The URL substring check `lowerUrl.contains(lowerParam)` is also locale-sensitive (`toLowerCase()` without `Locale.ROOT`). ### How should we improve? - Inspect the parameter **names** the driver actually receives: every config **key**, plus each name embedded in the `connectionProperties` value. - Parse `connectionProperties` **exactly as DBCP2 does** (`Properties.load` after replacing `;`→`\n`) so escape/newline/`\uXXXX` parser-differential smuggling can't slip through; reject a malformed value fail-closed. - Use `Locale.ROOT` for all case folding. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
