[Improvement] Possible SQL injection in MysqlDatabaseOperations.java
Open
good first issue
improvement
- Dominant language
- Java
- Stars
- 3.2k
- Forks
- 935
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 315
Description
### What would you like to be improved?
databaseName in generateDropDatabaseSql is not validated for any potential SQL issues.
### How should we improve?
Validate databaseName
Contributor guide
Research direction
Start in MysqlDatabaseOperations.java at generateDropDatabaseSql and trace how databaseName reaches the generated statement. Review the existing SQL validation conventions there, then verify that unsafe database names are rejected before SQL is produced and that valid names still work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, mysql
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 54/100