Apache Spark:在SparkSql中,sql易受Sql注入攻击

Question

场景:

假设Hive中有一个表,并在Apache Spark中使用下面的SparkSql进行查询,其中表名作为参数传递并连接到查询.

在非分布式系统的情况下,我对SQL注入漏洞有基本的了解,并且在JDBC的上下文中理解了在这种场景中createStatement/preparedStatement的用法.

但是在sparksql的情况下,这个代码很容易受到攻击吗？任何见解？

def main(args: Array[String]) {

    val sconf = new SparkConf().setAppName("TestApp")
    val sparkContext = new SparkContext(sconf)
    val hiveSqlContext = new org.apache.spark.sql.hive.HiveContext(sparkContext)

    val tableName = args(0)    // passed as an argument

    val tableData  =  hiveSqlContext.sql("select IdNUm, Name from hiveSchemaName." + tableName + " where IdNum <> '' ")
                                        .map( x => (x.getString(0), x.getString(1)) ).collectAsMap()


    ................
    ...............

}

Answer 1

您可以在 Spark 2.0 中尝试以下操作：

def main(args: Array[String]) {
val conf = new SparkConf()

val sparkSession = SparkSession
  .builder()
  .appName("TestApp")
  .config(conf)
  .enableHiveSupport()
  .getOrCreate()

val tableName = args(0)    // passed as an argument

val tableData  =  sparkSession
.table(tableName)
.select($"IdNum", $"Name")
.filter($"IdNum" =!= "")
.map( x => (x.getString(0), x.getString(1)) ).collectAsMap()


................
...............

}`