alibaba / druid

阿里云计算平台DataWorks(https://help.aliyun.com/document_detail/137663.html) 团队出品,为监控而生的数据库连接池
https://github.com/alibaba/druid/wiki
Apache License 2.0
27.95k stars 8.58k forks source link

Join cte result as temp table on druid 1.2.20 #5626

Closed unique-fun closed 10 months ago

unique-fun commented 10 months ago

druid version 1.2.20
MySQL 8.0.23

create table table1 (id varchar(10), unit_id varchar(10));
create table unit   (id varchar(10), pid varchar(10), device_sn varchar(10))
SELECT ua.id
        FROM table1 ua
                 JOIN (WITH RECURSIVE cte_name (id, pid,device_sn)
                                          AS (SELECT id, pid, device_sn
                                              FROM unit
                                              WHERE id IN  ('1000')
                                              UNION ALL
                                              SELECT
                                                  c.id, c.pid, r.device_sn
                                              FROM cte_name AS r
                                                       JOIN unit c ON r.id = c.pid
            )
                       SELECT id, pid, device_sn FROM cte_name
        ) us on us.id = ua.unit_id

SQL works in mysql , if fails in druid ,errors below:

 ### Error querying database.  Cause: java.sql.SQLException: sql injection violation, dbType mysql, , druid-version 1.2.20, syntax error: syntax error, error in :'          JOIN (WITH RECURSIVE cte_name (id, pid,device_sn)
 ', expect ), actual null, pos 82, line 3, column 40, token IDENTIFIER cte_name : SELECT ua.id
        FROM table1 ua
                 JOIN (WITH RECURSIVE cte_name (id, pid,device_sn)
                                          AS (SELECT id, pid, device_sn
                                              FROM unit
                                              WHERE id IN  ('1000')
                                              UNION ALL
                                              SELECT
                                                  c.id, c.pid, r.device_sn
                                              FROM cte_name AS r
                                                       JOIN unit c ON r.id = c.pid
            )
                       SELECT id, pid, device_sn FROM cte_name
        ) us on us.id = ua.unit_id
lizongbo commented 10 months ago

  @Test
    public void test_error_sql2() {
        String sql3 = "SELECT ua.id\n"
            + "        FROM table1 ua\n"
            + "                 JOIN (WITH RECURSIVE cte_name (id, pid,device_sn)\n"
            + "                                          AS (SELECT id, pid, device_sn\n"
            + "                                              FROM unit\n"
            + "                                              WHERE id IN  ('1000')\n"
            + "                                              UNION ALL\n"
            + "                                              SELECT\n"
            + "                                                  c.id, c.pid, r.device_sn\n"
            + "                                              FROM cte_name AS r\n"
            + "                                                       JOIN unit c ON r.id = c.pid\n"
            + "            )\n"
            + "                       SELECT id, pid, device_sn FROM cte_name\n"
            + "        ) us on us.id = ua.unit_id";
            List<SQLStatement> parseStatements = SQLUtils.parseStatements(sql3, DbType.mysql);
            System.out.println(parseStatements);
    }

run ok:

[SELECT ua.id
FROM table1 ua
    JOIN (
        WITH RECURSIVE cte_name (id, pid, device_sn) AS (
                SELECT id, pid, device_sn
                FROM unit
                WHERE id IN ('1000')
                UNION ALL
                SELECT c.id, c.pid, r.device_sn
                FROM cte_name r
                    JOIN unit c ON r.id = c.pid
            )
        SELECT id, pid, device_sn
        FROM cte_name
    ) us
    ON us.id = ua.unit_id]

进程已结束,退出代码为 0

wait for 1.2.21 version