kazusa
/
skywalking-java
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix fuzzy query sql injection (#4970)

This commit is contained in:
yangy 2020-06-26 10:08:10 +08:00 committed by GitHub
parent cc9ea271a7
commit fb7912c6bd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
oap-server/server-storage-plugin/storage-jdbc-hikaricp-plugin/src/main/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2AlarmQueryDAO.java
View File

@ -61,7 +61,8 @@ public class H2AlarmQueryDAO implements IAlarmQueryDAO {
}
if (!Strings.isNullOrEmpty(keyword)) {
sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like '%").append(keyword).append("%' ");
sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like concat('%',?,'%') ");
parameters.add(keyword);
}
sql.append(" order by ").append(AlarmRecord.START_TIME).append(" desc ");

6
oap-server/server-storage-plugin/storage-jdbc-hikaricp-plugin/src/main/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2MetadataQueryDAO.java
View File

@ -125,7 +125,8 @@ public class H2MetadataQueryDAO implements IMetadataQueryDAO {
sql.append(ServiceTraffic.NODE_TYPE).append("=?");
condition.add(NodeType.Normal.value());
if (!Strings.isNullOrEmpty(keyword)) {
sql.append(" and ").append(ServiceTraffic.NAME).append(" like \"%").append(keyword).append("%\"");
sql.append(" and ").append(ServiceTraffic.NAME).append(" like concat('%',?,'%')");
condition.add(keyword);
}
sql.append(" limit ").append(metadataQueryMaxSize);
@ -175,7 +176,8 @@ public class H2MetadataQueryDAO implements IMetadataQueryDAO {
sql.append(EndpointTraffic.SERVICE_ID).append("=?");
condition.add(serviceId);
if (!Strings.isNullOrEmpty(keyword)) {
sql.append(" and ").append(EndpointTraffic.NAME).append(" like '%").append(keyword).append("%' ");
sql.append(" and ").append(EndpointTraffic.NAME).append(" like concat('%',?,'%') ");
condition.add(keyword);
}
sql.append(" limit ").append(limit);

3
oap-server/server-storage-plugin/storage-jdbc-hikaricp-plugin/src/main/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2TraceQueryDAO.java
View File

@ -82,7 +82,8 @@ public class H2TraceQueryDAO implements ITraceQueryDAO {
}
}
if (!Strings.isNullOrEmpty(endpointName)) {
sql.append(" and ").append(SegmentRecord.ENDPOINT_NAME).append(" like '%" + endpointName + "%'");
sql.append(" and ").append(SegmentRecord.ENDPOINT_NAME).append(" like concat('%',?,'%')");
parameters.add(endpointName);
}
if (StringUtil.isNotEmpty(serviceId)) {
sql.append(" and ").append(SegmentRecord.SERVICE_ID).append(" = ?");

3
oap-server/server-storage-plugin/storage-jdbc-hikaricp-plugin/src/main/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/mysql/MySQLAlarmQueryDAO.java
View File

@ -61,7 +61,8 @@ public class MySQLAlarmQueryDAO implements IAlarmQueryDAO {
}
if (!Strings.isNullOrEmpty(keyword)) {
sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like '%").append(keyword).append("%' ");
sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like concat('%',?,'%') ");
parameters.add(keyword);
}
sql.append(" order by ").append(AlarmRecord.START_TIME).append(" desc ");