database/doris
2
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

[Enhancement](jdbc catalog) Add security check on driver when creating Jdbc Catalog (#31153)

Browse Source
This commit is contained in:
zy-kkk
2024-02-21 12:07:31 +08:00
committed by yiguolei
parent a4f9eec810
commit c27692fb3b
6 changed files with 99 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
fe/fe-core/src/main/java/org/apache/doris/catalog/JdbcResource.java
View File

@ -42,6 +42,7 @@ import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.time.LocalDateTime;
import java.time.ZoneId;
import java.util.Arrays;
import java.util.Map;
@ -277,14 +278,28 @@ public class JdbcResource extends Resource {
}
}
public static String getFullDriverUrl(String driverUrl) {
public static String getFullDriverUrl(String driverUrl) throws IllegalArgumentException {
try {
URI uri = new URI(driverUrl);
String schema = uri.getScheme();
if (schema == null && !driverUrl.startsWith("/")) {
return "file://" + Config.jdbc_drivers_dir + "/" + driverUrl;
} else {
if ("*".equals(Config.jdbc_driver_secure_path)) {
return driverUrl;
} else if (Config.jdbc_driver_secure_path.trim().isEmpty()) {
throw new IllegalArgumentException(
"jdbc_driver_secure_path is set to empty, disallowing all driver URLs.");
} else {
boolean isAllowed = Arrays.stream(Config.jdbc_driver_secure_path.split(";"))
.anyMatch(allowedPath -> driverUrl.startsWith(allowedPath.trim()));
if (!isAllowed) {
throw new IllegalArgumentException("Driver URL does not match any allowed paths: " + driverUrl);
} else {
return driverUrl;
}
}
}
return driverUrl;
} catch (URISyntaxException e) {
LOG.warn("invalid jdbc driver url: " + driverUrl);
return driverUrl;

24
fe/fe-core/src/main/java/org/apache/doris/datasource/jdbc/JdbcExternalCatalog.java
View File

@ -119,11 +119,6 @@ public class JdbcExternalCatalog extends ExternalCatalog {
jdbcUrl = JdbcResource.handleJdbcUrl(jdbcUrl);
properties.put(JdbcResource.JDBC_URL, jdbcUrl);
}
if (properties.containsKey(JdbcResource.DRIVER_URL) && !properties.containsKey(JdbcResource.CHECK_SUM)) {
properties.put(JdbcResource.CHECK_SUM,
JdbcResource.computeObjectChecksum(properties.get(JdbcResource.DRIVER_URL)));
}
return properties;
}
@ -246,10 +241,21 @@ public class JdbcExternalCatalog extends ExternalCatalog {
if (isReplay) {
return;
}
Map<String, String> properties = Maps.newHashMap();
if (properties.containsKey(JdbcResource.DRIVER_URL) && !properties.containsKey(JdbcResource.CHECK_SUM)) {
properties.put(JdbcResource.CHECK_SUM,
JdbcResource.computeObjectChecksum(properties.get(JdbcResource.DRIVER_URL)));
Map<String, String> properties = catalogProperty.getProperties();
if (properties.containsKey(JdbcResource.DRIVER_URL)) {
String computedChecksum = JdbcResource.computeObjectChecksum(properties.get(JdbcResource.DRIVER_URL));
if (properties.containsKey(JdbcResource.CHECK_SUM)) {
String providedChecksum = properties.get(JdbcResource.CHECK_SUM);
if (!providedChecksum.equals(computedChecksum)) {
throw new DdlException(
"The provided checksum (" + providedChecksum
+ ") does not match the computed checksum (" + computedChecksum
+ ") for the driver_url."
);
}
} else {
catalogProperty.addProperty(JdbcResource.CHECK_SUM, computedChecksum);
}
}
}