LuciferYang opened a new pull request, #12025: URL: https://github.com/apache/gravitino/pull/12025
### What changes were proposed in this pull request? - Replace the config-**value** scan in `JdbcUrlUtils` with a config-**name** scan: every config key, plus each parameter name embedded in DBCP2's `connectionProperties` value. - Parse `connectionProperties` exactly as DBCP2 does (`Properties.load` after replacing `;`→`\n`); reject a malformed value fail-closed. - Use `Locale.ROOT` for all case folding. ### Why are the changes needed? `JdbcUrlUtils.validateJdbcConfig` guards against dangerous JDBC parameters (e.g. MySQL `autoDeserialize`, an RCE enabler) but only matched config *values* and never inspected DBCP2's `connectionProperties`. An unsafe parameter could be smuggled to the driver as a config key, or inside `connectionProperties` (reachable via `gravitino.bypass.connectionProperties=autoDeserialize=true`, whose prefix is stripped before the map reaches the datasource), fully bypassing the check. Fix: #12024 ### Does this PR introduce _any_ user-facing change? No. A configuration that was already unsafe is now rejected earlier with a clear error. The exception message wording changes from "...detected in JDBC URL" to "...detected in JDBC configuration" to reflect that config keys/`connectionProperties` are inspected too, not only the URL. ### How was this patch tested? New unit tests in `TestJdbcUrlUtils` (connectionProperties for MySQL/MariaDB/PostgreSQL, config-key detection, newline / `\uXXXX` / double-URL-encoding smuggling, whole-name-vs-substring and value-vs-name negative controls, Turkish-locale folding, malformed-value rejection) and an end-to-end `TestDataSourceUrlValidation` case through `DataSourceUtils.createDataSource`. `./gradlew :common:test :catalogs:catalog-jdbc-common:test -PskipITs` and spotless pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
