[SECURITY] Block JDBC URL-option injection via DB2 instance field

[aiceflower]

What is the purpose of the change

Follow-up to #5449 that closes a remaining JDBC URL-option injection sink reported separately against the DB2 instance field. The DB2 SqlConnection classes interpolate the user-supplied instance value directly into the URL via String.format(\"jdbc:db2://%s:%s/%s\", ...), so a malicious value like SAMPLE:traceLevel=1; becomes jdbc:db2://host:port/SAMPLE:traceLevel=1;. The CVE-2023-49566 fix in #5449 denylisted clientRerouteServerListJNDIName etc. when they arrive via Properties, but a value smuggled through the URL database segment bypasses Properties entirely and reaches driver options like traceLevel/traceFile/traceDirectory/traceFileAppend that allow arbitrary file writes.

Same class of issue affects SQL Server (; separator), Oracle (service-name slot), and the jdbc:mysql:// family (?/&).

This PR adds four layers of defense:

1. Runtime validation (primary fix). New SecurityUtils.checkDatabaseIsSafe(JdbcDriverType, database) rejects URL-option separators per driver family. Called from the generic checkJdbcConnParams path used by every non-MySQL SqlConnection.

   • DB2 → : ; ? # & (matches the advisory's PoC)
   • SQLSERVER → ; ? # &
   • ORACLE → ? # &
   • PG/MySQL/ClickHouse/DM/etc → ? # & /

2. Expanded DB2 denylist. JDBC_DB2_BLOCKED_PARAMS now also includes traceLevel, traceFile, traceDirectory, traceFileAppend so Properties-based injection of the same logging options is blocked too.

3. Schema-layer validation. Backfill value_regex for the instance field of every JDBC data source in linkis_dml.sql. RegExpParameterValidateStrategy skips validation when value_regex is NULL, so the existing schema offered no first-line defense. New regex ^[A-Za-z0-9_.-]+$.

4. Upgrade SQL. Same regex backfilled via UPDATE ... WHERE key='instance' AND value_regex IS NULL in the 1.9.0 upgrade script for existing installs.

Tests

• 6 new unit tests covering: the DB2 PoC (SAMPLE:traceLevel=1; and SAMPLE:traceFile=/tmp/evil;), the single-character variants for each forbidden char, the SQL Server and MySQL variants, benign-database sanity across all driver families, and the expanded DB2 denylist.
• All 24 tests in SecurityUtilsTest pass.

Relation to prior work

• [SECURITY][DS] Complete CVE-2023-49566 fix for non-MySQL JDBC drivers #5449 closed the CVE-2023-49566 incomplete-fix report by adding the generic JDBC denylist/Properties layer. This PR builds on top of [SECURITY][DS] Complete CVE-2023-49566 fix for non-MySQL JDBC drivers #5449 (same files, same SecurityUtils generic API). If reviewers prefer to land both together, this PR can be rebased onto [SECURITY][DS] Complete CVE-2023-49566 fix for non-MySQL JDBC drivers #5449 instead of master.

🤖 Generated with Claude Code

[casionone]

LGTM.