apache/dolphinscheduler · warning · IllegalArgumentException

Other params include possible malicious keys.

Error message

Other params include possible malicious keys.

What it means

checkOther rejects 'other params' (extra JDBC connect properties) whose keys intersect POSSIBLE_MALICIOUS_KEYS (keys like passwords/user names that could inject connection settings) with 'Other params include possible malicious keys.'

Source

Thrown at dolphinscheduler-datasource-plugin/dolphinscheduler-datasource-api/src/main/java/org/apache/dolphinscheduler/plugin/datasource/api/datasource/AbstractDataSourceProcessor.java:100

     */
    protected void checkDatabasePatter(String database) {
        if (!DATABASE_PATTER.matcher(database).matches()) {
            throw new IllegalArgumentException("database name illegal");
        }
    }

    /**
     * check other is valid
     *
     * @param other other
     */
    protected void checkOther(Map<String, String> other) {
        if (MapUtils.isEmpty(other)) {
            return;
        }

        if (!Sets.intersection(other.keySet(), POSSIBLE_MALICIOUS_KEYS).isEmpty()) {
            throw new IllegalArgumentException("Other params include possible malicious keys.");
        }

        for (Map.Entry<String, String> entry : other.entrySet()) {
            if (!PARAMS_PATTER.matcher(entry.getKey()).matches()) {
                throw new IllegalArgumentException("datasource other params: " + entry.getKey() + " illegal");
            }
        }
    }

    protected Map<String, String> transformOtherParamToMap(String other) {
        if (StringUtils.isBlank(other)) {
            return Collections.emptyMap();
        }
        return JSONUtils.parseObject(other, new TypeReference<Map<String, String>>() {
        });
    }

    @Override

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Remove credential/malicious keys from other params and supply them via the dedicated username/password fields
2. Review POSSIBLE_MALICIOUS_KEYS to see which keys are blocked
3. Pass extra tuning params only (e.g. connectTimeout)

Example fix

// before
otherParams = {"password":"secret", "ssl":"true"}
// after
param.setUserName("user"); param.setPassword("secret");
otherParams = {"ssl":"true"}

Set<String> blocked = Set.of("user","password"); boolean malicious = other != null && !Collections.disjoint(other.keySet(), blocked);

try { processor.checkDatasourceParam(dto); } catch (IllegalArgumentException e) { /* remove offending key from other params */ }

When it happens

Trigger: Supplying an other-params JSON whose keys include sensitive/injection-prone keys such as 'user', 'password', or driver-altering properties.

Common situations: Users copying JDBC connection properties including user/password into the other params box; security-hardened configs forbidding autoDeserialize/typeName-style keys.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• datasource other params: + entry.getKey() + illegal
• url can not be null
• 10001
• namespace %s does not exist in k8s cluster, please create na
• ID token is missing required claims

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/9e72fcfedec58854. Report an issue: GitHub.