alibaba / alibaba/druid

MySQL5.7 SQL文件执行到“Begin;”,报SQL注入

Open
#4,331 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
28.2k
Forks
8.6k
PR merge metrics
No merged PRs in 30d

Description

一执行到开启事务的begin语句,就会报异常,知道怎么解决吗?
druid版本:1.1.18
简要异常信息:
Caused by: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'BEGIN', expect END, actual EOF pos 5, line 1, column 6, token EOF : BEGIN
at com.alibaba.druid.wall.WallFilter.checkInternal(WallFilter.java:806)
at com.alibaba.druid.wall.WallFilter.check(WallFilter.java:788)

Contributor guide

Open the contributing guide

Research direction

Start with the reported failure in com.alibaba.druid.wall.WallFilter at WallFilter.java:806 and the surrounding check path at line 788. Reproduce the BEGIN statement with Druid 1.1.18 against MySQL 5.7 and inspect how it is parsed. Done means a transaction-opening BEGIN is accepted without a SQL injection violation, with regression coverage for the case.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, mysql
Domain
databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.