Elgato_dark/zeppelin
1
0
Fork 0
mirror of https://github.com/apache/zeppelin synced 2026-05-24 09:38:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Prevent SQL injection for GetUserList.getUserList.

Browse source
This commit is contained in:
Yanbo Liang 2017-07-12 15:25:05 +08:00
parent 985b86e4d2
commit d1a7ff9be8
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
zeppelin-server/src/main/java/org/apache/zeppelin/rest/GetUserList.java
View file

@ -231,7 +231,7 @@ public class GetUserList {
return userlist;
}
userquery = "select " + username + " from " + tablename;
userquery = "select ? from ?";
} catch (IllegalAccessException e) {
LOG.error("Error while accessing dataSource for JDBC Realm", e);
@ -241,6 +241,8 @@ public class GetUserList {
try {
Connection con = dataSource.getConnection();
ps = con.prepareStatement(userquery);
ps.setString(1, username);
ps.setString(2, tablename);
rs = ps.executeQuery();
while (rs.next()) {
userlist.add(rs.getString(1).trim());