Potential arbitrary file write vulnerability

[Fushuling]

In the current code, if debug=true in the JDBC URL, the logfile parameter is directly created as a file path and opened as a FileWriter. The log content contains the raw bytes returned by the server (which can be partially controlled by the attacker).

This means that if an attacker can control the JDBC URL, they can now write arbitrary files to any file path.

import java.sql.SQLException;

public class test {
    public static void main(String[] args) throws SQLException {
        String url = "jdbc:monetdb://127.0.0.1:50000/?debug=true&logfile=D:/test/aaa/1.jsp";
        java.sql.DriverManager.getConnection(url);
    }
}

Modern JDBC drivers such as db2 and PostgreSQL have implemented measures to protect against this issue, for example, by restricting file extensions to .log. Therefore, I believe it is essential to restrict filenames to prevent attacks.