sachinnn99 commented on issue #11805: URL: https://github.com/apache/gravitino/issues/11805#issuecomment-5622113981
I'd like to work on this. I've confirmed the current state on `main`: all three converters return `catalogString()` unvalidated — `MysqlTypeConverter.java:163`, `PostgreSqlTypeConverter.java:160`, and `DorisTypeConverter` — and the base `JdbcTypeConverter` has no validation hook to build on. Proposed approach, following the first option in the description: add a shared validation helper in `JdbcTypeConverter` that rejects `catalogString()` values which aren't a well-formed single-token type name, and call it from `fromGravitino` in the MySQL, PostgreSQL, and Doris converters, with unit tests in each module. Two questions before I start: 1. Validation shape — is a strict positive pattern (identifier characters, plus the parentheses/commas needed for parameterized names like `numeric(10,2)` and `array<int>`) preferable to blocklisting SQL metacharacters? A positive pattern fails closed, but it risks rejecting legitimate exotic type names, so I'd rather confirm the preference than guess. 2. Rejection point — should this throw from `fromGravitino` at DDL-construction time, or would you rather it be validated earlier, when the `ExternalType` is first accepted through the API? Happy to go with the per-catalog allowlist instead if that's the direction you'd prefer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
