MySQL5.7 SQL文件执行到“Begin;”,报SQL注入
- Dominant language
- Java
- Stars
- 28.2k
- Forks
- 8.6k
- PR merge metrics
- No merged PRs in 30d
Description
一执行到开启事务的begin语句,就会报异常,知道怎么解决吗?
druid版本:1.1.18
简要异常信息:
Caused by: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'BEGIN', expect END, actual EOF pos 5, line 1, column 6, token EOF : BEGIN
at com.alibaba.druid.wall.WallFilter.checkInternal(WallFilter.java:806)
at com.alibaba.druid.wall.WallFilter.check(WallFilter.java:788)
Contributor guide
Research direction
Start with the reported failure in com.alibaba.druid.wall.WallFilter at WallFilter.java:806 and the surrounding check path at line 788. Reproduce the BEGIN statement with Druid 1.1.18 against MySQL 5.7 and inspect how it is parsed. Done means a transaction-opening BEGIN is accepted without a SQL injection violation, with regression coverage for the case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, mysql
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100