{"record":{"id":"9e72fcfedec58854","repo":"apache/dolphinscheduler","slug":"other-params-include-possible-malicious-keys","errorCode":null,"errorMessage":"Other params include possible malicious keys.","messagePattern":"Other params include possible malicious keys\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"dolphinscheduler-datasource-plugin/dolphinscheduler-datasource-api/src/main/java/org/apache/dolphinscheduler/plugin/datasource/api/datasource/AbstractDataSourceProcessor.java","lineNumber":100,"sourceCode":"     */\n    protected void checkDatabasePatter(String database) {\n        if (!DATABASE_PATTER.matcher(database).matches()) {\n            throw new IllegalArgumentException(\"database name illegal\");\n        }\n    }\n\n    /**\n     * check other is valid\n     *\n     * @param other other\n     */\n    protected void checkOther(Map<String, String> other) {\n        if (MapUtils.isEmpty(other)) {\n            return;\n        }\n\n        if (!Sets.intersection(other.keySet(), POSSIBLE_MALICIOUS_KEYS).isEmpty()) {\n            throw new IllegalArgumentException(\"Other params include possible malicious keys.\");\n        }\n\n        for (Map.Entry<String, String> entry : other.entrySet()) {\n            if (!PARAMS_PATTER.matcher(entry.getKey()).matches()) {\n                throw new IllegalArgumentException(\"datasource other params: \" + entry.getKey() + \" illegal\");\n            }\n        }\n    }\n\n    protected Map<String, String> transformOtherParamToMap(String other) {\n        if (StringUtils.isBlank(other)) {\n            return Collections.emptyMap();\n        }\n        return JSONUtils.parseObject(other, new TypeReference<Map<String, String>>() {\n        });\n    }\n\n    @Override","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-datasource-plugin/dolphinscheduler-datasource-api/src/main/java/org/apache/dolphinscheduler/plugin/datasource/api/datasource/AbstractDataSourceProcessor.java#L82-L118","documentation":"checkOther rejects 'other params' (extra JDBC connect properties) whose keys intersect POSSIBLE_MALICIOUS_KEYS (keys like passwords/user names that could inject connection settings) with 'Other params include possible malicious keys.'","triggerScenarios":"Supplying an other-params JSON whose keys include sensitive/injection-prone keys such as 'user', 'password', or driver-altering properties.","commonSituations":"Users copying JDBC connection properties including user/password into the other params box; security-hardened configs forbidding autoDeserialize/typeName-style keys.","solutions":["Remove credential/malicious keys from other params and supply them via the dedicated username/password fields","Review POSSIBLE_MALICIOUS_KEYS to see which keys are blocked","Pass extra tuning params only (e.g. connectTimeout)"],"exampleFix":"// before\notherParams = {\"password\":\"secret\", \"ssl\":\"true\"}\n// after\nparam.setUserName(\"user\"); param.setPassword(\"secret\");\notherParams = {\"ssl\":\"true\"}","handlingStrategy":"validation","validationCode":"Set<String> blocked = Set.of(\"user\",\"password\"); boolean malicious = other != null && !Collections.disjoint(other.keySet(), blocked);","typeGuard":null,"tryCatchPattern":"try { processor.checkDatasourceParam(dto); } catch (IllegalArgumentException e) { /* remove offending key from other params */ }","preventionTips":["Put credentials in dedicated username/password fields","Audit other-param keys against POSSIBLE_MALICIOUS_KEYS before submit","Only pass tuning flags in other params"],"tags":["security","validation","jdbc"],"backgroundTag":"invalid-config-value","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}