fix fuzzy query sql injection (#4970)

apache · Jun 26, 2020 · fb7912c · fb7912c
1 parent cc9ea27
commit fb7912c
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 5 deletions.
diff --git a/...ain/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2AlarmQueryDAO.java b/...ain/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2AlarmQueryDAO.java
@@ -61,7 +61,8 @@ public Alarms getAlarm(Integer scopeId, String keyword, int limit, int from, lon
         }
 
         if (!Strings.isNullOrEmpty(keyword)) {
-            sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like '%").append(keyword).append("%' ");
+            sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like concat('%',?,'%') ");
+            parameters.add(keyword);
         }
         sql.append(" order by ").append(AlarmRecord.START_TIME).append(" desc ");
 

diff --git a/.../java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2MetadataQueryDAO.java b/.../java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2MetadataQueryDAO.java
@@ -125,7 +125,8 @@ public List<Service> searchServices(long startTimestamp, long endTimestamp, Stri
         sql.append(ServiceTraffic.NODE_TYPE).append("=?");
         condition.add(NodeType.Normal.value());
         if (!Strings.isNullOrEmpty(keyword)) {
-            sql.append(" and ").append(ServiceTraffic.NAME).append(" like \"%").append(keyword).append("%\"");
+            sql.append(" and ").append(ServiceTraffic.NAME).append(" like concat('%',?,'%')");
+            condition.add(keyword);
         }
         sql.append(" limit ").append(metadataQueryMaxSize);
 
@@ -175,7 +176,8 @@ public List<Endpoint> searchEndpoint(String keyword, String serviceId, int limit
         sql.append(EndpointTraffic.SERVICE_ID).append("=?");
         condition.add(serviceId);
         if (!Strings.isNullOrEmpty(keyword)) {
-            sql.append(" and ").append(EndpointTraffic.NAME).append(" like '%").append(keyword).append("%' ");
+            sql.append(" and ").append(EndpointTraffic.NAME).append(" like concat('%',?,'%') ");
+            condition.add(keyword);
         }
         sql.append(" limit ").append(limit);
 

diff --git a/...ain/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2TraceQueryDAO.java b/...ain/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2TraceQueryDAO.java
@@ -82,7 +82,8 @@ public TraceBrief queryBasicTraces(long startSecondTB,
             }
         }
         if (!Strings.isNullOrEmpty(endpointName)) {
-            sql.append(" and ").append(SegmentRecord.ENDPOINT_NAME).append(" like '%" + endpointName + "%'");
+            sql.append(" and ").append(SegmentRecord.ENDPOINT_NAME).append(" like concat('%',?,'%')");
+            parameters.add(endpointName);
         }
         if (StringUtil.isNotEmpty(serviceId)) {
             sql.append(" and ").append(SegmentRecord.SERVICE_ID).append(" = ?");

diff --git a/...n/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/mysql/MySQLAlarmQueryDAO.java b/...n/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/mysql/MySQLAlarmQueryDAO.java
@@ -61,7 +61,8 @@ public Alarms getAlarm(Integer scopeId, String keyword, int limit, int from, lon
         }
 
         if (!Strings.isNullOrEmpty(keyword)) {
-            sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like '%").append(keyword).append("%' ");
+            sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like concat('%',?,'%') ");
+            parameters.add(keyword);
         }
         sql.append(" order by ").append(AlarmRecord.START_TIME).append(" desc ");