fix: validate application config file reads

NOTICE

@@ -1,5 +1,5 @@
 Apache StreamPark
-Copyright 2022-2025 The Apache Software Foundation
+Copyright 2022-2026 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).

build.sh

@@ -116,7 +116,7 @@ print_logo() {
   printf '      %s  ___/ / /_/ /  /  __/ /_/ / / / / / / /_/ / /_/ / /  / ,<        %s\n'          $PRIMARY $RESET
   printf '      %s /____/\__/_/   \___/\__,_/_/ /_/ /_/ ____/\__,_/_/  /_/|_|       %s\n'          $PRIMARY $RESET
   printf '      %s                                   /_/                            %s\n\n'        $PRIMARY $RESET
-  printf '      %s   Version:  2.1.7 %s\n'                                                $BLUE   $RESET
+  printf '      %s   Version:  2.1.8 %s\n'                                                $BLUE   $RESET
   printf '      %s   WebSite:  https://streampark.apache.org%s\n'                                  $BLUE   $RESET
   printf '      %s   GitHub :  http://github.com/apache/streampark%s\n\n'                          $BLUE   $RESET
   printf '      %s   ──────── Apache StreamPark, Make stream processing easier ô~ô!%s\n\n'         $PRIMARY  $RESET

dist-material/release-docs/NOTICE

@@ -1,5 +1,5 @@
 Apache StreamPark
-Copyright 2022-2025 The Apache Software Foundation
+Copyright 2022-2026 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).

docker/README.md

@@ -7,7 +7,7 @@ The latest image tag will be written to [docker-compose.yaml](./docker-compose.y
 version: '3.8'
 services:
     streampark:
-        image: apache/streampark:2.1.7
+        image: apache/streampark:2.1.8
 ```
 
 ### 2. docker-compose up

docker/docker-compose.yaml

@@ -18,7 +18,7 @@ version: '3.8'
 
 services:
   streampark:
-    image: apache/streampark:2.1.7
+    image: apache/streampark:2.1.8
     ports:
       - "10000:10000"
     environment:

helm/streampark/Chart.yaml

@@ -20,5 +20,5 @@ description: A Helm chart for the Apache StreamPark
 home: https://streampark.apache.org
 icon: https://streampark.apache.org/image/logo_name.png
 type: application
-version: 2.1.7
-appVersion: 2.1.7
+version: 2.1.8
+appVersion: 2.1.8

helm/streampark/values.yaml

@@ -18,7 +18,7 @@
 image:
   repository: "apache/streampark"
   pullPolicy: "IfNotPresent"
-  tag: "2.1.7"
+  tag: "2.1.8"
   pullSecret: ""
 
 rbac:

pom.xml

@@ -26,7 +26,7 @@
 
     <groupId>org.apache.streampark</groupId>
     <artifactId>streampark</artifactId>
-    <version>2.1.7</version>
+    <version>2.1.8</version>
     <packaging>pom</packaging>
     <name>StreamPark Project Parent POM</name>
 

streampark-common/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.apache.streampark</groupId>
         <artifactId>streampark</artifactId>
-        <version>2.1.7</version>
+        <version>2.1.8</version>
     </parent>
 
     <artifactId>streampark-common_${scala.binary.version}</artifactId>

streampark-common/src/main/scala/org/apache/streampark/common/conf/ConfigConst.scala

@@ -203,7 +203,7 @@ object ConfigConst {
     println("      ___/ / /_/ /  /  __/ /_/ / / / / / / /_/ / /_/ / /  / ,<        ")
     println("     /____/\\__/_/   \\___/\\__,_/_/ /_/ /_/ ____/\\__,_/_/  /_/|_|   ")
     println("                                       /_/                        \n\n")
-    println("    Version:  2.1.7                                          ")
+    println("    Version:  2.1.8                                          ")
     println("    WebSite:  https://streampark.apache.org                           ")
     println("    GitHub :  https://github.com/apache/streampark                    ")
     println(s"    Info   :  $info                                 ")

streampark-console/pom.xml

@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.streampark</groupId>
         <artifactId>streampark</artifactId>
-        <version>2.1.7</version>
+        <version>2.1.8</version>
     </parent>
 
     <artifactId>streampark-console</artifactId>

streampark-console/streampark-console-service/pom.xml

@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.apache.streampark</groupId>
         <artifactId>streampark-console</artifactId>
-        <version>2.1.7</version>
+        <version>2.1.8</version>
     </parent>
 
     <artifactId>streampark-console-service</artifactId>

streampark-console/streampark-console-service/src/main/assembly/bin/streampark.sh

@@ -297,7 +297,7 @@ print_logo() {
   printf '      %s  ___/ / /_/ /  /  __/ /_/ / / / / / / /_/ / /_/ / /  / ,<        %s\n'          $PRIMARY $RESET
   printf '      %s /____/\__/_/   \___/\__,_/_/ /_/ /_/ ____/\__,_/_/  /_/|_|       %s\n'          $PRIMARY $RESET
   printf '      %s                                   /_/                            %s\n\n'        $PRIMARY $RESET
-  printf '      %s   Version:  2.1.7 %s\n'                                                         $BLUE    $RESET
+  printf '      %s   Version:  2.1.8 %s\n'                                                         $BLUE    $RESET
   printf '      %s   WebSite:  https://streampark.apache.org%s\n'                                  $BLUE    $RESET
   printf '      %s   GitHub :  http://github.com/apache/streampark%s\n\n'                          $BLUE    $RESET
   printf '      %s   ──────── Apache StreamPark, Make stream processing easier ô~ô!%s\n\n'         $PRIMARY $RESET

streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/base/mybatis/pager/MybatisPager.java

@@ -28,13 +28,16 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.regex.Pattern;
 
 @SuppressWarnings("unchecked")
 public final class MybatisPager {
 
+  private static final Pattern SORT_FIELD_PATTERN = Pattern.compile("^[A-Za-z][A-Za-z0-9_]*$");
+
   public static <T> Page<T> getPage(RestRequest request) {
-    boolean invalid = request.getSortField().trim().split("\\s+").length > 1;
-    if (invalid) {
+    String sortField = WebUtils.camelToUnderscore(StringUtils.trimToEmpty(request.getSortField()));
+    if (!SORT_FIELD_PATTERN.matcher(sortField).matches()) {
       throw new IllegalArgumentException(
           String.format("Invalid argument sortField: %s", request.getSortField()));
     }
@@ -48,7 +51,6 @@
     page.setSize(request.getPageSize());
 
     List<OrderItem> orderItems = new ArrayList<>(2);
-    String sortField = WebUtils.camelToUnderscore(request.getSortField());
     if (StringUtils.equalsIgnoreCase(request.getSortOrder(), Constant.ORDER_DESC)) {
       orderItems.add(OrderItem.desc(sortField));
     } else if (StringUtils.equalsIgnoreCase(request.getSortOrder(), Constant.ORDER_ASC)) {

streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/core/controller/ApplicationController.java

@@ -177,7 +177,7 @@ public RestResponse yarn() {
 
   @PostMapping("name")
   @PermissionScope(app = "#app.id", team = "#app.teamId")
-  public RestResponse yarnName(Application app) {
+  public RestResponse yarnName(Application app) throws IOException {
     String yarnName = applicationService.getYarnName(app);
     return RestResponse.success(yarnName);
   }
@@ -190,8 +190,9 @@ public RestResponse checkName(Application app) {
   }
 
   @PostMapping("readConf")
-  public RestResponse readConf(String config) throws IOException {
-    String content = applicationService.readConf(config);
+  @PermissionScope(team = "#app.teamId")
+  public RestResponse readConf(Application app) throws IOException {
+    String content = applicationService.readConf(app);
     return RestResponse.success(content);
   }
 

streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/core/service/ApplicationService.java

@@ -54,7 +54,7 @@ public interface ApplicationService extends IService<Application> {
 
   void restart(Application application) throws Exception;
 
-  String getYarnName(Application app);
+  String getYarnName(Application app) throws IOException;
 
   AppExistsState checkExists(Application app);
 
@@ -66,7 +66,7 @@ public interface ApplicationService extends IService<Application> {
 
   void clean(Application app);
 
-  String readConf(String config) throws IOException;
+  String readConf(Application application) throws IOException;
 
   Application getApp(Application application);
 

streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/core/service/impl/ApplicationServiceImpl.java

@@ -699,10 +699,11 @@
   }
 
   @Override
-  public String getYarnName(Application appParam) {
+  public String getYarnName(Application appParam) throws IOException {
+    File file = getReadableConfFile(appParam);
     String[] args = new String[2];
     args[0] = "--name";
-    args[1] = appParam.getConfig();
+    args[1] = file.getAbsolutePath();
     return ParameterCli.read(args);
   }
 
@@ -1213,12 +1214,62 @@
   }
 
   @Override
-  public String readConf(String config) throws IOException {
-    File file = new File(config);
+  public String readConf(Application application) throws IOException {
+    File file = getReadableConfFile(application);
     String conf = FileUtils.readFileToString(file, StandardCharsets.UTF_8);
     return Base64.getEncoder().encodeToString(conf.getBytes());
   }
 
+  @VisibleForTesting
+  File getReadableConfFile(Application application) throws IOException {
+    ApiAlertException.throwIfNull(application, "Invalid application.");
+    ApiAlertException.throwIfNull(application.getProjectId(), "Invalid project.");
+    ApiAlertException.throwIfNull(application.getTeamId(), "Invalid team.");
+    ApiAlertException.throwIfTrue(StringUtils.isBlank(application.getModule()), "Invalid module.");
+    ApiAlertException.throwIfTrue(
+        StringUtils.containsAny(application.getModule(), '/', '\\'), "Invalid module.");
+    ApiAlertException.throwIfTrue(StringUtils.isBlank(application.getConfig()), "Invalid config.");
+
+    Project project = projectService.getById(application.getProjectId());
+    ApiAlertException.throwIfNull(project, "Invalid project.");
+    ApiAlertException.throwIfFalse(
+        application.getTeamId().equals(project.getTeamId()), "Invalid project.");
+
+    File projectDistHome = project.getDistHome().getCanonicalFile();
+    ApiAlertException.throwIfFalse(projectDistHome.isDirectory(), "Invalid project.");
+
+    File moduleArchive = new File(projectDistHome, application.getModule()).getCanonicalFile();
+    File moduleHome =
+        new File(StringUtils.removeEnd(moduleArchive.getAbsolutePath(), ".tar.gz"))
+            .getCanonicalFile();
+    ApiAlertException.throwIfFalse(
+        isDirectChildPath(projectDistHome, moduleArchive), "Invalid module.");
+    ApiAlertException.throwIfFalse(
+        isDirectChildPath(projectDistHome, moduleHome), "Invalid module.");
+    ApiAlertException.throwIfFalse(moduleHome.isDirectory(), "Invalid module.");
+
+    File confHome = new File(moduleHome, "conf").getCanonicalFile();
+    ApiAlertException.throwIfFalse(isDescendantPath(moduleHome, confHome), "Invalid config.");
+    ApiAlertException.throwIfFalse(confHome.isDirectory(), "Invalid config.");
+
+    File configFile = new File(application.getConfig()).getCanonicalFile();
+
+    ApiAlertException.throwIfFalse(configFile.isFile(), "Invalid config.");
+    ApiAlertException.throwIfFalse(isDescendantPath(confHome, configFile), "Invalid config.");
+    return configFile;
+  }
+
+  private boolean isDescendantPath(File parent, File child) throws IOException {
+    String parentPath = parent.getCanonicalPath();
+    String childPath = child.getCanonicalPath();
+    return childPath.startsWith(parentPath.concat(File.separator));
+  }
+
+  private boolean isDirectChildPath(File parent, File child) throws IOException {
+    File childParent = child.getCanonicalFile().getParentFile();
+    return childParent != null && parent.getCanonicalFile().equals(childParent.getCanonicalFile());
+  }
+
   @Override
   public Application getApp(Application appParam) {
     Application application = this.baseMapper.getApp(appParam);

streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/runner/StartedUpRunner.java

@@ -47,7 +47,7 @@
       System.out.println("      ___/ / /_/ /  /  __/ /_/ / / / / / / /_/ / /_/ / /  / ,<        ");
       System.out.println("     /____/\\__/_/   \\___/\\__,_/_/ /_/ /_/ ____/\\__,_/_/  /_/|_|   ");
       System.out.println("                                       /_/                        \n\n");
-      System.out.println("    Version:  2.1.7                                                   ");
+      System.out.println("    Version:  2.1.8                                                   ");
       System.out.println("    WebSite:  https://streampark.apache.org                           ");
       System.out.println("    GitHub :  https://github.com/apache/streampark          ");
       System.out.println("    Info   :  streampark-console start successful                     ");

streampark-console/streampark-console-service/src/test/java/org/apache/streampark/console/base/mybatis/pager/MybatisPagerTest.java

@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.streampark.console.base.mybatis.pager;
+
+import org.apache.streampark.console.base.domain.RestRequest;
+
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import org.junit.jupiter.api.Test;
+
+import java.util.Arrays;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class MybatisPagerTest {
+
+  @Test
+  void getPageShouldRejectSqlExpressionSortField() {
+    Arrays.asList(
+            "create_time,CEIL(VARIANT)--",
+            "create_time,SLEEP(10)--",
+            "create_time,PG_SLEEP(10)",
+            "create_time;select 1",
+            "create_time desc",
+            "user.name",
+            "`create_time`",
+            "create_time'--",
+            "create_time/**/desc")
+        .forEach(
+            sortField -> {
+              RestRequest request = new RestRequest();
+              request.setSortField(sortField);
+
+              assertThatThrownBy(() -> MybatisPager.getPage(request))
+                  .isInstanceOf(IllegalArgumentException.class)
+                  .hasMessageContaining("Invalid argument sortField");
+            });
+  }
+
+  @Test
+  void getPageShouldAcceptColumnNameSortField() {
+    RestRequest request = new RestRequest();
+    request.setSortField("createTime");
+
+    Page<?> page = MybatisPager.getPage(request);
+
+    assertThat(page.orders()).hasSize(1);
+    assertThat(page.orders().get(0).getColumn()).isEqualTo("create_time");
+  }
+}