mirror of https://gitee.com/pnoker/iot-dc3.git synced 2026-10-31 18:21:58 +08:00

Files

T

pnoker 9aa5a6bdb9 security(driver): bind jdbc write value as a parameter to prevent sql injection

The shared JDBC driver base interpolated the point value into the write SQL via
writeQuery.replace("${value}", ...), allowing a crafted write command value to
alter the statement. Bind the value with PreparedStatement#setString against a
single ? placeholder instead. Update the mysql/oracle/postgresql/sqlserver
writeQuery attribute docs to the ? convention and add the module's first test.

2026-06-22 17:59:50 +08:00

3.4 KiB

Raw Permalink Blame History

DC3 Driver SQL Server

Overview

dc3-driver-sqlserver is the Microsoft SQL Server database driver of the IoT DC3 platform. It connects to a SQL Server instance via JDBC, reads point values by executing configured SQL SELECT queries on a schedule, and writes / executes SQL for write commands. It builds on the shared AbstractJdbcDriverCustomService from dc3-common-sql, which constructs the JDBC URL jdbc:sqlserver://<host>:<port>;databaseName=<database>;encrypt=<encrypt>;trustServerCertificate=<...>; using the com.microsoft.sqlserver.jdbc.SQLServerDriver.

Module Information

Group ID: io.github.pnoker
Artifact ID: dc3-driver-sqlserver
Version: 2026.5.22
Driver Name: SQL Server Driver

Driver Attributes (Device-level)

Attribute	Code	Type	Default	Description
Host	host	STRING	localhost	SQL Server host
Port	port	INT	1433	SQL Server port
Database	database	STRING		SQL Server database name
Username	username	STRING	root	SQL Server username
Password	password	STRING		SQL Server password
Query Timeout	queryTimeout	INT	30	SQL query timeout in seconds
Encrypt	encrypt	STRING	false	SQL Server encrypt connection
Trust Server Certificate	trustServerCertificate	STRING	true	SQL Server trust server certificate

Point Attributes

Attribute	Code	Type	Description
Read Query	readQuery	STRING	SQL SELECT query for reading point value
Write Query	writeQuery	STRING	SQL UPDATE/INSERT using a single `?` placeholder for the value (bound as a parameter)

Command Attributes (write)

Attribute	Code	Type	Description
Execute Query	executeQuery	STRING	SQL query to execute for command

Prerequisites

A reachable Microsoft SQL Server instance. The connection URL, credentials, encryption flags, and the SQL queries to run are all supplied through the driver and point attributes above — nothing is hardcoded.

Running Locally

1. Start Infrastructure and Center Services

podman compose -f dc3/docker-compose-db.yml up -d
java -jar dc3-center/dc3-center-manager/target/dc3-center-manager.jar

2. Build and Run

mvn -s .mvn/settings.xml clean package
java -jar dc3-driver/dc3-driver-sqlserver/target/dc3-driver-sqlserver.jar

dc3-common-driver — Driver SDK for registration, scheduling, and RabbitMQ integration
dc3-common-sql — AbstractJdbcDriverCustomService base class providing JDBC read/write logic

License

Licensed under the GNU Affero General Public License v3.0 (AGPL 3.0)

3.4 KiB Raw Permalink Blame History