public/dataease
1
0
Fork 0
mirror of https://github.com/dataease/dataease.git synced 2026-06-16 19:33:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: SQL Injection via Stacked Queries

Browse Source
This commit is contained in:
junjun
2026-04-08 14:31:56 +08:00
parent 2a28372fa4
commit dfc4089cc1
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java
View File

@@ -15,7 +15,7 @@ import java.util.List;
public class Mysql extends DatasourceConfiguration {
private String driver = "com.mysql.cj.jdbc.Driver";
private String extraParams = "characterEncoding=UTF-8&connectTimeout=5000&useSSL=false&allowPublicKeyRetrieval=true&zeroDateTimeBehavior=convertToNull";
private List<String> illegalParameters = Arrays.asList("maxAllowedPacket", "autoDeserialize", "queryInterceptors", "statementInterceptors", "detectCustomCollations", "allowloadlocalinfile", "allowUrlInLocalInfile", "allowLoadLocalInfileInPath");
private List<String> illegalParameters = Arrays.asList("maxAllowedPacket", "autoDeserialize", "queryInterceptors", "statementInterceptors", "detectCustomCollations", "allowloadlocalinfile", "allowUrlInLocalInfile", "allowLoadLocalInfileInPath", "allowMultiQueries");
private List<String> showTableSqls = Arrays.asList("show tables");
public String getJdbc() {
@@ -32,12 +32,12 @@ public class Mysql extends DatasourceConfiguration {
}
String jdbcUrl = "";
if (StringUtils.isEmpty(extraParams.trim())) {
jdbcUrl = "jdbc:mysql://HOSTNAME:PORT/DATABASE"
jdbcUrl = "jdbc:mysql://HOSTNAME:PORT/DATABASE"
.replace("HOSTNAME", getLHost().trim())
.replace("PORT", getLPort().toString().trim())
.replace("DATABASE", getDataBase().trim());
} else {
jdbcUrl = "jdbc:mysql://HOSTNAME:PORT/DATABASE?EXTRA_PARAMS"
jdbcUrl = "jdbc:mysql://HOSTNAME:PORT/DATABASE?EXTRA_PARAMS"
.replace("HOSTNAME", getLHost().trim())
.replace("PORT", getLPort().toString().trim())
.replace("DATABASE", getDataBase().trim())