Department

The issue is related to insufficient protection of service data when handling the `allowLoadLocalInfile` parameter with a value of true in the MySQL Connector/J component of Apache Linkis. This could allow a remote attacker to read arbitrary local files by connecting a rogue MySQL server and adding `allowLoadLocalInfile` to true in the JDBC parameter. The parameters in the JDBC URL should be blacklisted to prevent exploitation.

A deserialization vulnerability exists in Apache Linkis when used with the MySQL Connector/J, allowing for possible remote code execution impact. This occurs when an attacker has write access to a database and configures a new datasource with a MySQL data source and malicious parameters. The parameters in the jdbc url should be blacklisted to prevent exploitation.