Skip to content

更新代码#1

Open
llyJava wants to merge 4241 commits into
llyJava:masterfrom
apache:master
Open

更新代码#1
llyJava wants to merge 4241 commits into
llyJava:masterfrom
apache:master

Conversation

@llyJava

@llyJava llyJava commented Dec 13, 2019

Copy link
Copy Markdown
Owner

更新代码

@llyJava

llyJava commented Dec 13, 2019

Copy link
Copy Markdown
Owner Author

更新代码

mayinrain and others added 29 commits November 28, 2023 17:58
* chore: add new pages to linkis-web and fix bugs of web

* upd: update version

* web router fix
* fix db2 connect issue

* code format
[Bug][1.5.0] Spark scala task error should print task log
* Fix flink-1.16 ClassNotFoundException bug

* Fix flink-1.16 ClassNotFoundException bug
…on yml configuration (#5020)

* add template_required column to linkis_ps_configuration_config_key close #5018

* Fix Local Debug cannot read application ymal
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 4.4.9 to 4.4.12.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v4.4.12/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v4.4.12/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* flink load default configuration

* fix gc log bug

* code format
Bumps org.apache.avro:avro from 1.11.0 to 1.11.3.

---
updated-dependencies:
- dependency-name: org.apache.avro:avro
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* sql field comment semicolon with escape

* add junit test

* 1.format source code
 2.add code comment
* Fix repl get task result bug

* Fix repl get task result bug
* Fix flink getJobStatus bug

* Fix flink sql kill yarn application and getJobStatus fail
dependabot Bot and others added 30 commits April 7, 2026 19:40
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.1 to 6.4.2.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 6.4.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ase types (#5412)

* #AI COMMIT# fix: Add DB2 validation query support for JDBC engine connection pool

- Add DB2-specific validation query "SELECT 1 FROM SYSIBM.SYSDUMMY1"
- Same pattern as existing Oracle validation query handling
- Fixes DB2 connection pool validation error when using datasource name

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* #AI COMMIT# fix: Exclude conflicting jars from JDBC plugin assembly

- Exclude Jetty jars to avoid version conflicts with public-module
- Exclude SLF4J bindings to prevent multiple binding errors
- Exclude Hadoop jars to use shared public-module versions

These exclusions prevent class loading conflicts when JDBC engine
starts and uses jars from both plugin lib and public-module.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* #AI COMMIT# refactor: Make validation query configurable for different database types

- Add configuration parameter 'wds.linkis.jdbc.validation.query.mapping'
- Default mapping: oracle:SELECT 1 FROM DUAL,db2:SELECT 1 FROM SYSIBM.SYSDUMMY1
- Remove hardcoded database-specific validation query logic
- To add new database type, just update configuration, no code change needed

Benefits:
- Configuration-driven approach for extensibility
- Easy to add support for new databases without modifying source code
- Default values work for most common databases

Usage example:
  Add to linkis-engineconn.properties:
  wds.linkis.jdbc.validation.query.mapping=oracle:SELECT 1 FROM DUAL,db2:SELECT 1 FROM SYSIBM.SYSDUMMY1,postgresql:SELECT 1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Bumps [axios](https://github.com/axios/axios) from 1.13.5 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.15.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [axios](https://github.com/axios/axios) from 1.13.5 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.15.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.15.2.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.15.2)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [qs](https://github.com/ljharb/qs) from 6.14.2 to 6.15.2.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.2...v6.15.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.16.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.16.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.4.21 to 8.5.10.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.21...8.5.10)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps org.thymeleaf:thymeleaf-spring5 from 3.1.2.RELEASE to 3.1.5.RELEASE.

---
updated-dependencies:
- dependency-name: org.thymeleaf:thymeleaf-spring5
  dependency-version: 3.1.5.RELEASE
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…5423)

Bumps org.thymeleaf:thymeleaf from 3.1.2.RELEASE to 3.1.5.RELEASE.

---
updated-dependencies:
- dependency-name: org.thymeleaf:thymeleaf
  dependency-version: 3.1.5.RELEASE
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5431)

Bumps [org.apache.thrift:libthrift](https://github.com/apache/thrift) from 0.15.0 to 0.23.0.
- [Release notes](https://github.com/apache/thrift/releases)
- [Changelog](https://github.com/apache/thrift/blob/master/CHANGES.md)
- [Commits](apache/thrift@v0.15.0...v0.23.0)

---
updated-dependencies:
- dependency-name: org.apache.thrift:libthrift
  dependency-version: 0.23.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [qs](https://github.com/ljharb/qs) from 6.14.2 to 6.15.2.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.2...v6.15.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.16.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.2...v1.16.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.3 to 8.5.15.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.3...8.5.15)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…5435)

Bumps [org.apache.thrift:libthrift](https://github.com/apache/thrift) from 0.15.0 to 0.23.0.
- [Release notes](https://github.com/apache/thrift/releases)
- [Changelog](https://github.com/apache/thrift/blob/master/CHANGES.md)
- [Commits](apache/thrift@v0.15.0...v0.23.0)

---
updated-dependencies:
- dependency-name: org.apache.thrift:libthrift
  dependency-version: 0.23.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…idation (#5436)

Add S3_SCHEMA to StorageUtils.getFsPath() schema detection and
PathValidator.checkPath() validation to support s3:// storage paths.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* #AI COMMIT# Support Eureka authentication with configurable switch

Add Spring Security support for Eureka server, controlled by
linkis.eureka.auth.enable configuration (default: false).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* #AI COMMIT# Add logging for Eureka auth enable/disable status

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
…ulnerabilities (#5438)

1. SecurityUtils.checkParams: Replace single URL decode with while-loop
   decode (consistent with checkJdbcConnParams) to prevent double-encoding
   bypass that allows attackers to smuggle sensitive params like
   allowLoadLocalInfile past the blacklist.

2. SqlConnection (4 files): Replace DriverManager.getConnection(url,user,pwd)
   with getConnection(baseUrl, Properties). Security params are set first
   via SecurityUtils.getMysqlSecurityParams() and cannot be overridden by
   user-supplied extra params, providing defense-in-depth against URL
   parameter injection.

3. CryptoUtils.string2Object: Add resolveClass whitelist allowing only
   java.lang.String, blocking all gadget chain deserialization attacks
   (CWE-502) while maintaining backward compatibility since passwords
   are stored as String objects.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
…t SQL instead of invalid command (#5409) (#5440)

- Fix getAllDatabases() method in DB2 SqlConnection classes
- Replace invalid "list database directory" command with proper SQL query
- Add configurable schema query SQL with default filtering system schemas
- Query SYSCAT.SCHEMATA to get actual schema list from DB2

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Dependabot has raised PRs (#5426, #5427) that upgrade Flink dependencies
from 1.16.2 to 1.20.4 inside flink-shims-1.16.2. This is incorrect
because shims modules are version-specific compatibility layers — the
module name must match the supported engine version. Upgrading the
dependency in-place would break the shims contract and likely cause
compilation or runtime failures across 4 major Flink versions.

The correct approach to support a newer Flink version is to create a
new shims module (e.g. flink-shims-1.20.4) following the existing
pattern, rather than modifying the existing flink-shims-1.16.2 module.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Removes [esbuild](https://github.com/evanw/esbuild). It's no longer used after updating ancestor dependencies [esbuild](https://github.com/evanw/esbuild), [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). These dependencies need to be updated together.


Removes `esbuild`

Updates `@vitejs/plugin-vue` from 5.2.1 to 6.0.7
- [Release notes](https://github.com/vitejs/vite-plugin-vue/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.7/packages/plugin-vue)

Updates `vite` from 6.4.2 to 8.0.16
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version:
  dependency-type: indirect
- dependency-name: "@vitejs/plugin-vue"
  dependency-version: 6.0.7
  dependency-type: direct:production
- dependency-name: vite
  dependency-version: 8.0.16
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… cleanup (#5443)

To clean sensitive information (internal IPs, passwords, internal domains)
from historical commits per security ticket, master branch needs to be
force-pushable. The cleanup is required for:

* Internal IPs (e.g., 10.x.x.x, 172.21.x.x) -> 127.0.0.1
* Database passwords (e.g., bdpVsbi@2019) -> default
* Internal domains (e.g., weoa.com) -> localhost
* Database names (e.g., vsbi_gz_bdap_sit_01) -> default_db

The protection rule will be restored in a follow-up PR after the cleanup.
This is the same mechanism used previously (see commits 9d8fd03, 831d80b,
613c3b8 for reference).
…5444)

Keep all existing branch protection rules intact (required_status_checks,
required_pull_request_reviews) but add allow_force_pushes: true so that
historical commits containing leaked corporate sensitive information can be
rewritten via git-filter-repo + force-push.

This line will be removed in a follow-up PR once the cleanup is complete.
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6.
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

---
updated-dependencies:
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…nsitive dependency issues (#5447)

* fix: 修复 snakeyaml 被错误排除导致服务启动失败

问题: linkis-module 和 linkis-eureka 的 pom.xml 中排除了 snakeyaml,
导致 Spring Boot 无法解析 application-eureka.yml 和 application-linkis.yml,
所有服务启动失败。

修复: 在两个模块中添加 snakeyaml 为显式 compile 依赖,覆盖排除策略。

关联部署问题: jackson-module-scala 和 hadoop-hdfs 版本问题由增量构建时
profile 混用导致,-Papache profile 配置正确,干净编译即可解决。

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix: 排除错误的传递依赖 jackson-module-scala_2.11 和 hadoop-hdfs-2.7.2

问题: Maven 传递依赖解析时,scala.binary.version property 在 linkis-common
的依赖声明中未正确传递到 linkis-dist,导致 jackson-module-scala_2.11 (应为 2.12)
和 hadoop-hdfs:2.7.2 (应为 hadoop-hdfs-client:3.3.4) 被错误打包。

修复: 在 linkis-dist/pom.xml 中显式排除这两个错误版本并引入正确版本。

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* #AI COMMIT# fix: 补全 Spring Boot 2.7 部署兼容性配置

- linkis-dist/pom.xml: 显式引入 commons-lang 2.6 (Eureka Client 依赖其
  ExceptionUtils, 但 spring-cloud-netflix 传递依赖未带入)
- application-engineconn.yml: 补全 spring.main.allow-circular-references +
  spring.mvc.pathmatch.matching-strategy (ant_path_matcher) +
  spring.mvc.servlet.path + spring.cloud.loadbalancer.cache.enabled=false

  eureka.yml 和 linkis.yml 已在 master 上含相关配置,但 engineconn.yml
  遗漏了。缺失会导致 RPC POST /rpc/receiveAndReply 返回 404,引擎启动失败。

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* #AI COMMIT# fix: 修复 impala 引擎编译失败 (slf4j-api 缺失)

impala 模块编译报错 "Symbol 'type org.slf4j.Logger' is missing from the
classpath",根因是 slf4j-api 不在 impala 编译 classpath 中:

- linkis-common 标记为 <scope>provided</scope>,不传递 slf4j-api
- impala-frontend / impala-minimal-hive-exec 用 <exclusions>*</exclusions>
  排除所有传递依赖,slf4j-api 也被一并排除

Logging.logger 和 Utils.tryAndWarn 隐式参数都依赖 org.slf4j.Logger,
必须显式引入 slf4j-api 才能编译通过。

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.2.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: hutiefang <hutiefang@qq.com>
…JDBC drivers (#5449)

The CVE-2023-49566 fix shipped earlier only protected the MySQL/StarRocks
SqlConnection implementations. The eight other JDBC driver families used by
the metadata-query / datasource-manager modules (PostgreSQL, Oracle, SQL
Server, ClickHouse, KingBase, Greenplum, DM, DB2) still streamed user-
supplied extraParams straight onto the JDBC URL with no allowlist/denylist,
so any authenticated user could inject driver-specific dangerous properties:

  * PG/Greenplum/KingBase: socketFactory + socketFactoryArg -> RCE on
    drivers below 42.2.25 / 42.3.2
  * DB2: clientRerouteServerListJNDIName -> JNDI injection (the original
    CVE-2023-49566 sink)
  * Oracle: oracle.net.tns_admin / javax.net.ssl.trustStore -> TLS/TNS
    hijack
  * SQL Server: jaasConfigurationName -> JAAS lookup

Fix extends the MySQL-only SecurityUtils path to every driver family:

  * Add JdbcDriverType enum + per-driver denylist/force-params config in
    SecurityUtils (checkJdbcConnParams(JdbcDriverType, ...) and
    buildSecureProperties).
  * All 16 SqlConnection implementations (8 drivers x 2 modules) now call
    SecurityUtils.checkJdbcConnParams and route through Properties-based
    DriverManager.getConnection, never URL concatenation.
  * Add 10 unit tests covering each driver denylist, URL-encoded bypass,
    host injection, and force-params-wins semantics.

Files:
  linkis-commons/linkis-common/.../utils/JdbcDriverType.java   (new)
  linkis-commons/linkis-common/.../utils/SecurityUtils.java
  linkis-commons/linkis-common/.../utils/SecurityUtilsTest.java
  linkis-public-enhancements/linkis-datasource/linkis-datasource-manager/
    service/jdbc/.../AbstractSqlConnection.java
  linkis-public-enhancements/linkis-datasource/linkis-{metadata-query,
    datasource-manager}/service/jdbc/.../{postgres,oracle,sqlserver,
    clickhouse,kingbase,greenplum,dm,db2}/SqlConnection.java

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
…ce/database field (#5450)

The DB2 SqlConnection classes interpolate the user-supplied instance
value directly into the JDBC URL via String.format("jdbc:db2://%s:%s/%s", ...).
A value containing URL option separators (e.g. "SAMPLE:traceLevel=1;")
becomes "jdbc:db2://host:port/SAMPLE:traceLevel=1;", letting the database
segment toggle DB2 driver options (traceLevel/traceFile/traceDirectory/
traceFileAppend) that bypass the Properties denylist. Same class of issue
affects SQL Server (';' separator), Oracle (service-name slot), and the
mysql:// family.

Adds four layers of defense:

1. SecurityUtils.checkDatabaseIsSafe(JdbcDriverType, database) rejects
   URL-option separators per driver family:
     DB2 -> : ; ? # &
     SQLSERVER -> ; ? # &
     ORACLE -> ? # &
     PG/MySQL/CK/DM/etc -> ? # & /

2. Expand JDBC_DB2_BLOCKED_PARAMS with traceLevel/traceFile/
   traceDirectory/traceFileAppend so Properties-based injection of the
   same logging options is also blocked (defense in depth).

3. Backfill value_regex for the `instance` field of every JDBC data
   source in linkis_dml.sql. RegExpParameterValidateStrategy skips
   validation when value_regex is NULL, so the previous schema offered
   no first-line defense. New regex: ^[A-Za-z0-9_.-]+$

4. Same regex backfilled via UPDATE in the 1.9.0 upgrade script for
   existing installs.

5. 6 new unit tests covering the DB2 database segment, the SQL Server
   and MySQL variants, benign-database sanity, and the expanded DB2
   denylist. All 24 tests in SecurityUtilsTest pass.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.