[Improvement] Possible SQL injection in MysqlDatabaseOperations.java and JdbcDatabaseOperations.java

[justinmclean]

What would you like to be improved?

The database name should be validated before but used to construct an SQL to show tables. (Search for "SHOW TABLES IN".) Note that the SQL strings are also built in different ways in each file and probably should be built the same way.

How should we improve?

Validate the name or use query parameters.

[lw-yang]

i will fix it, could you assign it to me ?

[shaofengshi]

Pls go ahead, lw-yang!

[justinmclean]

@lw-yang do you still want to work on this?

[lw-yang]

Yes, i will complete it this week.

[lw-yang]

@justinmclean It has been validated by

gravitino/core/src/main/java/org/apache/gravitino/catalog/SchemaNormalizeDispatcher.java

Line 89 in 4c4f15a

return applyCapabilities(schemaIdent, Capability.Scope.SCHEMA, capabilities);

[YuanG0319tt]

Was this ticket still open?