[Fix-18074][Task-Plugin] Fix SQL task parameter passing and unsafe regex replacement

[leocook]

Was this PR generated or assisted by AI?

YES, Opus 4.7

Purpose of the pull request

close #18074

Brief change log

When an upstream SQL task outputs parameter p1 and the downstream task references it via a different parameter name p2 (with value ${p1}), the workflow fails with:

java.lang.IllegalArgumentException: No group with name {p1}
    at java.util.regex.Matcher.appendReplacement(Matcher.java:849)
    at org.apache.dolphinscheduler.plugin.task.sql.SqlTask.replaceOriginalValue(SqlTask.java:496)

Two root causes:

1. VarPool not injected: CuringParamsServiceImpl.paramParsingPreparation() step 6 only overrides parameters with the same name. Since the downstream task only has p2 and not p1, the upstream VarPool value (p1=111) gets dropped, causing ${p1} to remain unresolved.

2. Unsafe regex replacement: SqlTask.replaceOriginalValue() uses Matcher.replaceFirst(paramValue) directly, which treats $ as a regex group reference. When the unresolved placeholder ${p1} contains $, it causes the regex engine to crash.

Changes:

• CuringParamsServiceImpl: Inject VarPool parameters that don't exist in prepareParamsMap for downstream placeholder resolution
• SqlTask: Use Matcher.quoteReplacement() to safely handle $ in parameter values, and add null safety check

Verify this pull request

This pull request is covered by new unit tests:

• CuringParamsServiceImplTest.testParamParsingPreparation_varPoolInjectionWhenParamNameNotInLocalParams — verifies upstream VarPool parameter p1 is injected and downstream p2=${p1} is resolved to 111
• SqlTaskTest.testReplaceOriginalValue_withSpecialCharacters — verifies $, \ characters in values are safely replaced
• SqlTaskTest.testReplaceOriginalValue_paramNotFound_keepsOriginalText — verifies original text is preserved when parameter is not found
• SqlTaskTest.testReplaceOriginalValue_paramValueNull_keepsOriginalText — verifies original text is preserved when parameter value is null

Screenshots

Before fix:

After fix:

Pull Request Notice

Pull Request Notice

If your pull request contains incompatible change, you should also add it to docs/docs/en/guide/upgrade/incompatible.md

[ruanwenjun]

Varpool only be announced as a in parameter then it can be used, we shouldn't directly put varpool as key.

[leocook]

Varpool only be announced as a in parameter then it can be used, we shouldn't directly put varpool as key.

Thanks for the review. Fixed — when injecting a varPool parameter that doesn't exist in local params, a new Property with Direct.IN is now created instead of directly putting the OUT-direction varPool.

[leocook]

@ruanwenjun Hi, the changes you requested have been addressed. Could you please re-review when you get a chance? Thanks!

[leocook]

@ruanwenjun @SbloodyS Hi, could you please set a milestone for this PR? The CI milestone-label check is failing because of the missing milestone.

[SbloodyS]

You should check failed UT. @leocook

[leocook]

You should check failed UT. @leocook

Hi @SbloodyS, the failed CI is not caused by my code (this PR only changes 4 Java files) :

1. dead-link — repo-wide issue, dev is also red. Not mine.
2. milestone-label-check — need maintainer help: please set a milestone + add bug label, I have no permission. Thanks!
3. Unit Test — just a summary gate, will turn green after Support Oracle,CLICKHOUSE #4.
4. Unit-Test (master | Java 11) — a flaky test WorkflowStartTimeoutTestCase.testStartWorkflow_withTimeoutKillTask, nothing to do with my change. I checked locally: the case itself needs ~75s but the await window is only 90s, so under CI load it easily times out (Java 8 passed, Java 11 failed, same code). I'll push an empty commit to re-trigger.

This flaky already exists on dev. Do you want me to open a separate issue + PR to fix it? Or just re-run is fine?

Also the change you requested is already done — could you re-review to remove CHANGES_REQUESTED? Thanks a lot 🙏 @ruanwenjun