LuciferYang opened a new pull request, #12036: URL: https://github.com/apache/gravitino/pull/12036
### What changes were proposed in this pull request? Add `rejectUnsafePoolProperties` in `DataSourceUtils`, rejecting the DBCP2 pool properties `connectionFactoryClassName`, `evictionPolicyClassName`, `driverClassName`, and `initialSize` (case-insensitive whole-key match) before the config map is handed to `BasicDataSourceFactory`. ### Why are the changes needed? DBCP2's factory loads and instantiates the class named by the first three via reflection (`Class.forName` + `newInstance`), and `initialSize` > 0 forces an eager connection — triggering that driver load — during `createDataSource`, before Gravitino's explicit `setDriverClassName` override. Reachable via `gravitino.bypass.<key>=...`, this lets a catalog creator run arbitrary classes on the server (RCE). Fix: #12035 ### Does this PR introduce _any_ user-facing change? No. These properties are never used by a legitimate Gravitino JDBC catalog (the driver comes from `jdbc-driver`; pool sizing from `jdbc.pool.*`). Supplying one now fails fast with a clear message. ### How was this patch tested? New unit tests in `TestDataSourceUrlValidation` covering each rejected property (including case-insensitive variants) and a whole-key negative control proving a similarly-named legitimate property still builds. `./gradlew :catalogs:catalog-jdbc-common:test -PskipITs` and spotless pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
