Merge pull request #185 from jumpserver/pr@dev@fix_jdbc_injection

fix: validate database identifier before JDBC URL interpolation

Author: Zxc4wonder

backend/framework/src/main/java/org/jumpserver/chen/framework/datasource/base/BaseConnectionManager.java

@@ -10,6 +10,7 @@
 import org.jumpserver.chen.framework.driver.DriverClassLoader;
 import org.jumpserver.chen.framework.driver.DriverManager;
 import org.jumpserver.chen.framework.i18n.MessageUtils;
+import org.jumpserver.chen.framework.utils.SqlIdentifierUtils;
 
 import java.lang.reflect.InvocationTargetException;
 import java.sql.Connection;
@@ -120,6 +121,9 @@ public DruidDataSource getOrInitDataSource(String database) throws SQLException
         if (StringUtils.isEmpty(database)) {
             database = this.connectInfo.getDb();
         }
+        // Reject URL metacharacters before interpolation into the JDBC URL,
+        // preventing injection of driver connection properties.
+        SqlIdentifierUtils.validateDatabaseName(database);
         if (this.dataSourceMap.containsKey(database)) {
             return this.dataSourceMap.get(database);
         }

backend/framework/src/main/java/org/jumpserver/chen/framework/utils/SqlIdentifierUtils.java

@@ -0,0 +1,40 @@
+package org.jumpserver.chen.framework.utils;
+
+import lombok.extern.slf4j.Slf4j;
+
+import java.sql.SQLException;
+
+/**
+ * Validates runtime database identifiers before they are interpolated into a
+ * JDBC URL, so that URL/property metacharacters in a database name cannot
+ * inject driver connection properties (e.g. PostgreSQL socketFactory/loggerFile,
+ * SQLServer ";prop=val").
+ */
+@Slf4j
+public final class SqlIdentifierUtils {
+
+    // Characters that act as delimiters in at least one supported JDBC URL form.
+    // Rejecting them keeps a database name from escaping its ${db} placeholder.
+    private static final String FORBIDDEN_CHARS = "?&/:@#\\;= \t\r\n";
+
+    private SqlIdentifierUtils() {
+    }
+
+    /**
+     * Reject database names containing URL/property metacharacters or control
+     * characters. Blank values are allowed; callers fall back to the configured db.
+     */
+    public static void validateDatabaseName(String name) throws SQLException {
+        if (name == null || name.isEmpty()) {
+            return;
+        }
+        for (int i = 0; i < name.length(); i++) {
+            char c = name.charAt(i);
+            if (c < 0x20 || FORBIDDEN_CHARS.indexOf(c) >= 0) {
+                // Do not echo the value: it may contain log-forging characters.
+                log.warn("Rejected database name containing URL metacharacter");
+                throw new SQLException("Invalid database identifier");
+            }
+        }
+    }
+}

backend/modules/src/main/java/org.jumpserver.chen.modules/postgresql/PostgresqlSQLHintsHandler.java

@@ -6,6 +6,7 @@
 import org.jumpserver.chen.framework.datasource.entity.resource.Field;
 import org.jumpserver.chen.framework.datasource.entity.resource.Table;
 import org.jumpserver.chen.framework.datasource.sql.SQL;
+import org.jumpserver.chen.framework.utils.SqlIdentifierUtils;
 import org.jumpserver.chen.framework.utils.TreeUtils;
 
 import java.sql.SQLException;
@@ -46,6 +47,9 @@ public Map<String, List<String>> getHints(String nodeKey, String context) throws
 
         var db = TreeUtils.getValue(nodeKey, "database");
         if (StringUtils.isNotEmpty(db)) {
+            // nodeKey is client-controlled; reject URL metacharacters before it
+            // reaches the JDBC URL via setDatabaseContext.
+            SqlIdentifierUtils.validateDatabaseName(db);
             this.connectionManager.setDatabaseContext(db);
         }