liyang created KYLIN-6124:
-----------------------------
Summary: Potential JDBC validation gap in query pushdown
configuration
Key: KYLIN-6124
URL: https://issues.apache.org/jira/browse/KYLIN-6124
Project: Kylin
Issue Type: Bug
Affects Versions: 5.0.5
Reporter: liyang
Assignee: liyang
Fix For: 5.0.6
Project-level query pushdown configuration accepts JDBC URL, driver, and runner
class values without applying the validation used for source JDBC connections.
A project administrator can cause pushed-down queries to load a chosen JDBC
driver and connect to an arbitrary URL.
Fix direction: apply the existing JDBC URL and driver allowlist to query
pushdown connection properties, and restrict project-level pushdown runner
classes to supported implementations.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
