Duansg opened a new pull request, #4299: URL: https://github.com/apache/hertzbeat/pull/4299
## What's changed? The JDBC URL blacklist added in #3250 only guards the `url` a user types in. When `url` is empty the collector falls back to concatenating `host`, `port` and `database` into the connection URL, and `database` is a free-form text parameter — no validator constrains it and `JdbcProtocol.isInvalid()` skips it. A value such as `db allowLoadLocalInfile=true&autoDeserialize=true&z=` therefore reaches the driver with exactly the properties the blacklist exists to reject, turning a monitor pointed at a hostile MySQL server into local file disclosure on the collector. ## Checklist - [x] I have read the [Contributing Guide](https://hertzbeat.apache.org/docs/community/code_style_and_quality_guide) - [ ] I have written the necessary doc or comment. - [x] I have added the necessary unit tests and all cases have passed. ## Add or update API - [ ] I have added the necessary [e2e tests](https://github.com/apache/hertzbeat/tree/master/e2e) and all cases have passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
