Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE] Fix SQL Injection vulnerability in H2/MySQL implementation. #4639

Merged
merged 1 commit into from
Apr 12, 2020
Merged

[CVE] Fix SQL Injection vulnerability in H2/MySQL implementation. #4639

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 32 additions & 23 deletions ...n/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2MetricsQueryDAO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,20 +109,24 @@ public IntValues getValues(String tableName, DownSampling downsampling, long sta
@Override
public IntValues getLinearIntValues(String tableName, DownSampling downsampling, List<String> ids,
String valueCName) throws IOException {
StringBuilder idValues = new StringBuilder();
for (int valueIdx = 0; valueIdx < ids.size(); valueIdx++) {
if (valueIdx != 0) {
idValues.append(",");
StringBuilder sql = new StringBuilder("select id, " + valueCName + " from " + tableName + " where id in (");
List<Object> parameters = new ArrayList();
for (int i = 0; i < ids.size(); i++) {
if (i == 0) {
sql.append("?");
} else {
sql.append(",?");
}
idValues.append("'").append(ids.get(valueIdx)).append("'");
parameters.add(ids.get(i));
}
sql.append(")");

IntValues intValues = new IntValues();

try (Connection connection = h2Client.getConnection()) {

try (ResultSet resultSet = h2Client.executeQuery(
connection, "select id, " + valueCName + " from " + tableName + " where id in (" + idValues
.toString() + ")")) {
connection, sql.toString(), parameters.toArray(new Object[0]))) {
while (resultSet.next()) {
KVInt kv = new KVInt();
kv.setId(resultSet.getString("id"));
Expand All @@ -143,13 +147,17 @@ public IntValues[] getMultipleLinearIntValues(String tableName,
List<String> ids,
final List<Integer> linearIndex,
String valueCName) throws IOException {
StringBuilder idValues = new StringBuilder();
for (int valueIdx = 0; valueIdx < ids.size(); valueIdx++) {
if (valueIdx != 0) {
idValues.append(",");
StringBuilder sql = new StringBuilder("select id, " + valueCName + " from " + tableName + " where id in (");
List<Object> parameters = new ArrayList();
for (int i = 0; i < ids.size(); i++) {
if (i == 0) {
sql.append("?");
} else {
sql.append(",?");
}
idValues.append("'").append(ids.get(valueIdx)).append("'");
parameters.add(ids.get(i));
}
sql.append(")");

IntValues[] intValuesArray = new IntValues[linearIndex.size()];
for (int i = 0; i < intValuesArray.length; i++) {
Expand All @@ -158,8 +166,7 @@ public IntValues[] getMultipleLinearIntValues(String tableName,

try (Connection connection = h2Client.getConnection()) {
try (ResultSet resultSet = h2Client.executeQuery(
connection, "select id, " + valueCName + " from " + tableName + " where id in (" + idValues
.toString() + ")")) {
connection, sql.toString(), parameters.toArray(new Object[0]))) {
while (resultSet.next()) {
String id = resultSet.getString("id");

Expand Down Expand Up @@ -211,13 +218,18 @@ private IntValues[] orderWithDefault0(IntValues[] origin, List<String> expectedO
@Override
public Thermodynamic getThermodynamic(String tableName, DownSampling downsampling, List<String> ids,
String valueCName) throws IOException {
StringBuilder idValues = new StringBuilder();
for (int valueIdx = 0; valueIdx < ids.size(); valueIdx++) {
if (valueIdx != 0) {
idValues.append(",");
StringBuilder sql = new StringBuilder(
"select " + ThermodynamicMetrics.STEP + " step, " + ThermodynamicMetrics.NUM_OF_STEPS + " num_of_steps, " + ThermodynamicMetrics.DETAIL_GROUP + " detail_group, " + "id " + " from " + tableName + " where id in (");
List<Object> parameters = new ArrayList();
for (int i = 0; i < ids.size(); i++) {
if (i == 0) {
sql.append("?");
} else {
sql.append(",?");
}
idValues.append("'").append(ids.get(valueIdx)).append("'");
parameters.add(ids.get(i));
}
sql.append(")");

List<List<Long>> thermodynamicValueCollection = new ArrayList<>();
Map<String, List<Long>> thermodynamicValueMatrix = new HashMap<>();
Expand All @@ -227,10 +239,7 @@ public Thermodynamic getThermodynamic(String tableName, DownSampling downsamplin
int numOfSteps = 0;
int axisYStep = 0;
try (ResultSet resultSet = h2Client.executeQuery(
connection,
"select " + ThermodynamicMetrics.STEP + " step, " + ThermodynamicMetrics.NUM_OF_STEPS + " num_of_steps, " + ThermodynamicMetrics.DETAIL_GROUP + " detail_group, " + "id " + " from " + tableName + " where id in (" + idValues
.toString() + ")"
)) {
connection, sql.toString(), parameters.toArray(new Object[0]))) {

while (resultSet.next()) {
axisYStep = resultSet.getInt("step");
Expand Down