You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "lvyanquan (via GitHub)" <gi...@apache.org> on 2025/09/18 01:49:20 UTC
[PR] [minor] Fix potential sql connection statement issue. [flink-cdc]
lvyanquan opened a new pull request, #4123:
URL: https://github.com/apache/flink-cdc/pull/4123
Fix potential sql connection statement issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [minor] Fix potential sql connection statement issue. [flink-cdc]
Posted by "leonardBang (via GitHub)" <gi...@apache.org>.
leonardBang commented on code in PR #4123:
URL: https://github.com/apache/flink-cdc/pull/4123#discussion_r2357874015
##########
flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/test/java/org/apache/flink/cdc/connectors/oceanbase/sink/OceanBaseMetadataApplierTest.java:
##########
@@ -145,6 +145,30 @@ void testCreateTable() {
.build();
assertThat(actualTable).isEqualTo(expectTable);
+
+ tableId = TableId.tableId("nonexistent' OR '1'='1", "tabl1");
+ metadataApplier.applySchemaChange(new CreateTableEvent(tableId, schema));
+ actualTable =
+ catalog.getTable(tableId.getSchemaName(), tableId.getTableName()).orElse(null);
+ assertThat(actualTable).isNotNull();
Review Comment:
What's the purpose of these piece code? check an invalid `TableId`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [minor] Fix potential sql connection statement issue. [flink-cdc]
Posted by "lvyanquan (via GitHub)" <gi...@apache.org>.
lvyanquan merged PR #4123:
URL: https://github.com/apache/flink-cdc/pull/4123
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [minor] Fix potential sql connection statement issue. [flink-cdc]
Posted by "lvyanquan (via GitHub)" <gi...@apache.org>.
lvyanquan commented on PR #4123:
URL: https://github.com/apache/flink-cdc/pull/4123#issuecomment-3305791383
Hi @leonardBang PTAL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [minor] Fix potential sql connection statement issue. [flink-cdc]
Posted by "lvyanquan (via GitHub)" <gi...@apache.org>.
lvyanquan commented on code in PR #4123:
URL: https://github.com/apache/flink-cdc/pull/4123#discussion_r2357938192
##########
flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/test/java/org/apache/flink/cdc/connectors/oceanbase/sink/OceanBaseMetadataApplierTest.java:
##########
@@ -145,6 +145,30 @@ void testCreateTable() {
.build();
assertThat(actualTable).isEqualTo(expectTable);
+
+ tableId = TableId.tableId("nonexistent' OR '1'='1", "tabl1");
+ metadataApplier.applySchemaChange(new CreateTableEvent(tableId, schema));
+ actualTable =
+ catalog.getTable(tableId.getSchemaName(), tableId.getTableName()).orElse(null);
+ assertThat(actualTable).isNotNull();
Review Comment:
They are valid database/table names, but it may be truncated to the wrong database/table names without processing SQL injection.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [minor] Fix potential sql connection statement issue. [flink-cdc]
Posted by "lvyanquan (via GitHub)" <gi...@apache.org>.
lvyanquan commented on code in PR #4123:
URL: https://github.com/apache/flink-cdc/pull/4123#discussion_r2357938192
##########
flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/test/java/org/apache/flink/cdc/connectors/oceanbase/sink/OceanBaseMetadataApplierTest.java:
##########
@@ -145,6 +145,30 @@ void testCreateTable() {
.build();
assertThat(actualTable).isEqualTo(expectTable);
+
+ tableId = TableId.tableId("nonexistent' OR '1'='1", "tabl1");
+ metadataApplier.applySchemaChange(new CreateTableEvent(tableId, schema));
+ actualTable =
+ catalog.getTable(tableId.getSchemaName(), tableId.getTableName()).orElse(null);
+ assertThat(actualTable).isNotNull();
Review Comment:
They are valid database/table names, but it may be truncated to the wrong database/table names if we don't process correctly to avoid SQL injection.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org