From d4e2d0d9fb5562921f4224ff47b8ff3ec68bd13c Mon Sep 17 00:00:00 2001
From: Jixiang <75556346+Jixiangup@users.noreply.github.com>
Date: Mon, 15 Jul 2024 11:13:28 +0800
Subject: [PATCH] Fixed SQL Injection Vulnerabilities (#1184)

Fixed API `/taier/api/console/listNames` SQL Injection Vulnerabilities (#1184)
---
 taier-dao/src/main/resources/sqlmap/ScheduleJobCacheMapper.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/taier-dao/src/main/resources/sqlmap/ScheduleJobCacheMapper.xml b/taier-dao/src/main/resources/sqlmap/ScheduleJobCacheMapper.xml
index 1f4dd358c8..83134f6ddf 100644
--- a/taier-dao/src/main/resources/sqlmap/ScheduleJobCacheMapper.xml
+++ b/taier-dao/src/main/resources/sqlmap/ScheduleJobCacheMapper.xml
@@ -21,7 +21,7 @@
     <select id="listNames" resultType="java.lang.String">
         select job_name
         from schedule_job_cache
-        where job_name like '%${jobName}%'
+        where job_name like concat('%', #{jobName}, '%')
           and is_deleted = 0;
     </select>