Details
-
Bug
-
Status: Done
-
Major
-
Resolution: Fixed
-
None
-
-
All
-
Small
Description
Wen creating a dataset via a JDBC connection with an input query, it is executed in this method.
Before executing the query, one check is performed via a method named isNotReadOnlySQLQuery(). This method use a regex pattern to ensure that the query starts with a "SELECT" and is readonly
The issue here is that this regex will allow to chain several queries separated with a ';', meaning that you can perform any operation after the first SELECT.
For instance, the following query will be considered as readonly and be executed by the component:
SELECT * FROM my_table; DROP TABLE my_table;
However it is obviously NOT readonly, as the table will be dropped. Tested with ypiel on AT.