LuciferYang opened a new pull request, #13239: URL: https://github.com/apache/gravitino/pull/13239
### What changes were proposed in this pull request? Decoding now falls back to the last fully decoded form instead of throwing, and the unsafe-parameter scan (and the `jdbc:mysql`/`mariadb`/`postgresql`/`h2` prefix gates) additionally scans a sanitized form in which malformed percent escapes are treated as a literal `%`. `DataSourceUtils`'s duplicate throwing decode is removed and its H2 check now uses the shared helper. ### Why are the changes needed? The throwing decode rejected legal JDBC URLs with a literal `%` or a once-encoded `%25`. The second, sanitized scan form is required for security: MySQL Connector/J decodes query tokens independently and ignores the URL fragment, so a malformed escape in the fragment must not stop the scan from revealing an encoded unsafe parameter name in the query (e.g. `?%61utoDeserialize=true#%zz`). Fix: #13238 ### Does this PR introduce _any_ user-facing change? No API change. Legal JDBC URLs containing a literal `%` (e.g. `password=100%`) or a once-encoded `%25` are now accepted instead of rejected. The unsafe-parameter scan is not weakened. ### How was this patch tested? Extended `TestJdbcUrlUtils`: the added literal-percent acceptance cases (URLs with a literal `%` and a once-encoded `%25`) fail on the pre-fix tree and pass after the fix, while the existing unsafe-parameter cases (raw, single- and double-encoded, `connectionProperties` smuggling, and fragment poison) still reject the unsafe inputs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
