Skip to content

#AI COMMIT# Fix JDBC URL encoding bypass and unsafe deserialization v… #5438

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
casionone merged 1 commit into from
Jun 11, 2026
Merged

#AI COMMIT# Fix JDBC URL encoding bypass and unsafe deserialization v… #5438

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions linkis-commons/linkis-common/src/main/java/org/apache/linkis/common/utils/SecurityUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,12 +272,18 @@ private static void checkParams(Map<String, Object> paramsMap) {
return;
}

// deal with url encode
// deal with url encode - loop until stable to prevent double-encoding bypass
String paramUrl = parseParamsMapToMysqlParamUrl(paramsMap);
try {
paramUrl = URLDecoder.decode(paramUrl, "UTF-8");
while (paramUrl.contains("%")) {
String decodedParamUrl = URLDecoder.decode(paramUrl, "UTF-8");
if (decodedParamUrl.equals(paramUrl)) {
break;
}
paramUrl = decodedParamUrl;
}
} catch (UnsupportedEncodingException e) {
throw new LinkisSecurityException(35000, "mysql connection cul decode error: " + e);
throw new LinkisSecurityException(35000, "mysql connection url decode error: " + e);
}

Map<String, Object> newParamsMap = parseMysqlUrlParamsToMap(paramUrl);
Expand Down
23 changes: 13 additions & 10 deletions ...vice/jdbc/src/main/java/org/apache/linkis/metadata/query/service/mysql/SqlConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@
import java.io.IOException;
import java.sql.*;
import java.util.*;
import java.util.stream.Collectors;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
Expand Down Expand Up @@ -214,19 +213,23 @@ public void close() throws IOException {
*/
private Connection getDBConnection(ConnectMessage connectMessage, String database)
throws ClassNotFoundException, SQLException {
String extraParamString =
connectMessage.extraParams.entrySet().stream()
.map(e -> String.join("=", e.getKey(), String.valueOf(e.getValue())))
.collect(Collectors.joining("&"));
Class.forName(SQL_DRIVER_CLASS.getValue());
String url =
String baseUrl =
String.format(
SQL_CONNECT_URL.getValue(), connectMessage.host, connectMessage.port, database);
if (!connectMessage.extraParams.isEmpty()) {
url += "?" + extraParamString;

// Use Properties-based connection to enforce security params override.
// Per MySQL Connector/J docs, Properties override URL query params on conflict.
Properties props = SecurityUtils.getMysqlSecurityParams();
props.setProperty("user", connectMessage.username);
props.setProperty("password", AESUtils.isDecryptByConf(connectMessage.password));
for (Map.Entry<String, Object> entry : connectMessage.extraParams.entrySet()) {
if (!props.containsKey(entry.getKey())) {
props.setProperty(entry.getKey(), String.valueOf(entry.getValue()));
}
}
return DriverManager.getConnection(
url, connectMessage.username, AESUtils.isDecryptByConf(connectMessage.password));
LOG.info("jdbc connection url: {}", baseUrl);
return DriverManager.getConnection(baseUrl, props);
}

/** Connect message */
Expand Down
23 changes: 13 additions & 10 deletions .../jdbc/src/main/java/org/apache/linkis/metadata/query/service/starrocks/SqlConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@
import java.io.IOException;
import java.sql.*;
import java.util.*;
import java.util.stream.Collectors;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
Expand Down Expand Up @@ -206,19 +205,23 @@ public void close() throws IOException {
*/
private Connection getDBConnection(ConnectMessage connectMessage, String database)
throws ClassNotFoundException, SQLException {
String extraParamString =
connectMessage.extraParams.entrySet().stream()
.map(e -> String.join("=", e.getKey(), String.valueOf(e.getValue())))
.collect(Collectors.joining("&"));
Class.forName(SQL_DRIVER_CLASS.getValue());
String url =
String baseUrl =
String.format(
SQL_CONNECT_URL.getValue(), connectMessage.host, connectMessage.port, database);
if (!connectMessage.extraParams.isEmpty()) {
url += "?" + extraParamString;

// Use Properties-based connection to enforce security params override.
// Per MySQL Connector/J docs, Properties override URL query params on conflict.
Properties props = SecurityUtils.getMysqlSecurityParams();
props.setProperty("user", connectMessage.username);
props.setProperty("password", AESUtils.isDecryptByConf(connectMessage.password));
for (Map.Entry<String, Object> entry : connectMessage.extraParams.entrySet()) {
if (!props.containsKey(entry.getKey())) {
props.setProperty(entry.getKey(), String.valueOf(entry.getValue()));
}
}
return DriverManager.getConnection(
url, connectMessage.username, AESUtils.isDecryptByConf(connectMessage.password));
LOG.info("starrocks jdbc connection url: {}", baseUrl);
return DriverManager.getConnection(baseUrl, props);
}

/** Connect message */
Expand Down
24 changes: 14 additions & 10 deletions ...vice/jdbc/src/main/java/org/apache/linkis/metadata/query/service/mysql/SqlConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,23 +193,27 @@ public void close() throws IOException {
*/
private Connection getDBConnection(ConnectMessage connectMessage, String database)
throws ClassNotFoundException, SQLException {
String extraParamString =
connectMessage.extraParams.entrySet().stream()
.map(e -> String.join("=", e.getKey(), String.valueOf(e.getValue())))
.collect(Collectors.joining("&"));
Class.forName(SQL_DRIVER_CLASS.getValue());
String url =
String baseUrl =
String.format(
SQL_CONNECT_URL.getValue(), connectMessage.host, connectMessage.port, database);
// deal with empty database
if (StringUtils.isBlank(database)) {
url = url.substring(0, url.length() - 1);
baseUrl = baseUrl.substring(0, baseUrl.length() - 1);
}
if (!connectMessage.extraParams.isEmpty()) {
url += "?" + extraParamString;

// Use Properties-based connection to enforce security params override.
// Per MySQL Connector/J docs, Properties override URL query params on conflict.
Properties props = SecurityUtils.getMysqlSecurityParams();
props.setProperty("user", connectMessage.username);
props.setProperty("password", connectMessage.password);
for (Map.Entry<String, Object> entry : connectMessage.extraParams.entrySet()) {
if (!props.containsKey(entry.getKey())) {
props.setProperty(entry.getKey(), String.valueOf(entry.getValue()));
}
}
LOG.info("jdbc connection url: {}", url);
return DriverManager.getConnection(url, connectMessage.username, connectMessage.password);
LOG.info("jdbc connection url: {}", baseUrl);
return DriverManager.getConnection(baseUrl, props);
}

/** Connect message */
Expand Down
22 changes: 13 additions & 9 deletions .../jdbc/src/main/java/org/apache/linkis/metadata/query/service/starrocks/SqlConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,19 +206,23 @@ public void close() throws IOException {
*/
private Connection getDBConnection(ConnectMessage connectMessage, String database)
throws ClassNotFoundException, SQLException {
String extraParamString =
connectMessage.extraParams.entrySet().stream()
.map(e -> String.join("=", e.getKey(), String.valueOf(e.getValue())))
.collect(Collectors.joining("&"));
Class.forName(SQL_DRIVER_CLASS.getValue());
String url =
String baseUrl =
String.format(
SQL_CONNECT_URL.getValue(), connectMessage.host, connectMessage.port, database);
if (!connectMessage.extraParams.isEmpty()) {
url += "?" + extraParamString;

// Use Properties-based connection to enforce security params override.
// Per MySQL Connector/J docs, Properties override URL query params on conflict.
Properties props = SecurityUtils.getMysqlSecurityParams();
props.setProperty("user", connectMessage.username);
props.setProperty("password", AESUtils.isDecryptByConf(connectMessage.password));
for (Map.Entry<String, Object> entry : connectMessage.extraParams.entrySet()) {
if (!props.containsKey(entry.getKey())) {
props.setProperty(entry.getKey(), String.valueOf(entry.getValue()));
}
}
return DriverManager.getConnection(
url, connectMessage.username, AESUtils.isDecryptByConf(connectMessage.password));
LOG.info("starrocks jdbc connection url: {}", baseUrl);
return DriverManager.getConnection(baseUrl, props);
}

/** Connect message */
Expand Down
15 changes: 14 additions & 1 deletion ...pes-common/src/main/java/org/apache/linkis/datasourcemanager/common/util/CryptoUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,10 @@
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InvalidClassException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.ObjectStreamClass;
import java.io.Serializable;
import java.security.MessageDigest;

Expand Down Expand Up @@ -62,7 +64,18 @@ public static String object2String(Serializable o) {
public static Object string2Object(String str) {
try {
ByteArrayInputStream bis = new ByteArrayInputStream(new Base64().decode(str.getBytes()));
ObjectInputStream ois = new ObjectInputStream(bis);
ObjectInputStream ois =
new ObjectInputStream(bis) {
@Override
protected Class<?> resolveClass(ObjectStreamClass desc)
throws IOException, ClassNotFoundException {
if (!desc.getName().equals("java.lang.String")) {
throw new InvalidClassException(
"Unauthorized deserialization attempt", desc.getName());
}
return super.resolveClass(desc);
}
};
Object o = ois.readObject();
bis.close();
ois.close();
Expand Down
Loading