Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review infoConfiguration used: Organization UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (5)
WalkthroughThe changes implement deterministic per-URL JDBC connection pool management using SHA-256-based pool naming, add per-statement URL validation with optional dynamic URL override capabilities, and enhance validation request/response structures to support JDBC URL handling. WebSocket initialization configuration is also updated. Changes
Sequence Diagram(s)sequenceDiagram
participant Executor
participant JDBCInterpreter
participant ValidationAPI as Validation API
participant PoolManager as Pool Manager
participant Database
Executor->>JDBCInterpreter: executeSql(statement)
JDBCInterpreter->>ValidationAPI: POST ValidationRequest(query, user, url)
ValidationAPI-->>JDBCInterpreter: ValidationResponse(newJdbcUrl)
alt URL Changed
JDBCInterpreter->>PoolManager: closeConnection(oldUrl)
JDBCInterpreter->>PoolManager: buildPoolName(user, newUrl)
else URL Unchanged
JDBCInterpreter->>PoolManager: buildPoolName(user, originalUrl)
end
PoolManager->>PoolManager: Check isConnectionInDBDriverPool(poolName)
alt Pool Exists
PoolManager-->>JDBCInterpreter: getConnectionFromPool(poolName)
else Pool Missing
PoolManager->>PoolManager: createConnectionPool(poolName)
PoolManager-->>JDBCInterpreter: newConnection
end
JDBCInterpreter->>Database: execute(statement)
Database-->>JDBCInterpreter: result
JDBCInterpreter->>PoolManager: commitTransaction()
JDBCInterpreter-->>Executor: result
Comment |
|
Semgrep found 1 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L451 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 451] url</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L456 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 456] urlHash</a>"]
v3["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L454 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 454] hex</a>"]
v4["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L451 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 451] hash</a>"]
v5["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L466 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 466] buildPoolName</a>"]
v6["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L645 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 645] getJDBCDriverName</a>"]
v7["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L645 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 645] jdbcDriver</a>"]
v8["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L707 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 707] getConnectionFromPool</a>"]
v9["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L707 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 707] connection</a>"]
v10["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L982 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 982] getConnection</a>"]
v11["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L982 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 982] connection</a>"]
v12["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L1005 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1005] statement</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
v6 --> v7
v7 --> v8
v8 --> v9
v9 --> v10
v10 --> v11
v11 --> v12
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/Meesho/zeppelin/blob/2d10fdec29d21b77cad030d0ebdd10e0f5a0fb50/jdbc/src/main/java/org/apache/zeppelin/jdbc/JDBCInterpreter.java#L1026 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1026] statement.execute(statementPrecode)</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
|
What is this PR for?
A few sentences describing the overall goals of the pull request's commits.
First time? Check out the contributing guide - https://zeppelin.apache.org/contribution/contributions.html
What type of PR is it?
Bug Fix
Improvement
Feature
Documentation
Hot Fix
Refactoring
Please leave your type of PR only
Todos
What is the Jira issue?
How should this be tested?
Screenshots (if appropriate)
Questions:
Summary by CodeRabbit
Release Notes
New Features
Improvements