LuciferYang commented on PR #13239: URL: https://github.com/apache/gravitino/pull/13239#issuecomment-5698310983
Good catch, and my earlier assessment was wrong: the bypass is real. Verified empirically that `jdbc:mysql://h/db?%2561utoDeserialize=true#%zz` was accepted before the fix. The discriminating case hides the first letter (`%2561utoDeserialize` decodes `%2561` to `%61` to `a`, yielding `autoDeserialize`), and the poisoned `#%zz` fragment halted decoding before that token resolved. Fixed in 70786a0d3 by re-sanitizing malformed percent escapes before every decode pass, so a poisoned fragment can no longer stop a legitimately multi-encoded token from decoding. Added a regression test covering the mysql/mariadb and no-fragment variants; all existing unsafe-parameter rejections and the literal-percent acceptances still hold. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
