手动拼接sql参数存在SQL注入风险

[ztycool]

版本1.3.1
方法：

1. com.alibaba.nacos.config.server.service.repository.embedded.EmbeddedStoragePersistServiceImpl#configInfoCount(java.lang.String)
2. com.alibaba.nacos.config.server.service.repository.extrnal.ExternalStoragePersistServiceImpl#configInfoCount(java.lang.String)
   

[KomachiSion]

Yes, it is. But I think we have pre-check for the tenant and namesapceId, it can't include special characters except -,_.

[chuntaojun]

Yes, it is. But I think we have pre-check for the tenant and namesapceId, it can't include special characters except -,_.

and use PrepareStatement is better

[ztycool]

@KomachiSion
api接口：com.alibaba.nacos.console.controller.NamespaceController#getNamespace
在这个接口上可以接收任意参数，恶意注入风险还是存在的