[HIVE-20607] TxnHandler should use PreparedStatement to execute direct SQL queries.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.0, 4.0.0
• Fix Version/s: 3.2.0, 4.0.0-alpha-1
• Component/s: Standalone Metastore, Transactions
• Labels: ACID pull-request-available
• Assignee: Sankar Hariappan Assign to me
• Reporter: Sankar Hariappan
• Created: 20/Sep/18 05:08
• Updated: 17/Nov/22 08:55
• Resolved: 25/Oct/18 04:59

Description

TxnHandler uses direct SQL queries to operate on Txn related databases/tables in Hive metastore RDBMS.
Most of the methods are direct calls from Metastore api which should be directly append input string arguments to the SQL string.
Need to use parameterised PreparedStatement object to set these arguments.

Issue Links

• is related to: HIVE-22073 SQL Injection in TxnHandler#enqueueLockWithRetry
• links to: GitHub Pull Request #434