bugfix: bypass modify the primary key (#4953)

apache · Sep 29, 2022 · d0f324c · d0f324c
1 parent 5f2acb5
commit d0f324c
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 2 deletions.
diff --git a/changes/en-us/develop.md b/changes/en-us/develop.md
@@ -19,7 +19,7 @@ Add changes here for all PR submitted to the develop branch.
 - [[#4915](https://github.com/seata/seata/pull/4915)] fix failed to get server recovery properties
 - [[#4919](https://github.com/seata/seata/pull/4919)] fix XID port  and  address null:0 before coordinator.init
 - [[#4928](https://github.com/seata/seata/pull/4928)] fix rpcContext.getClientRMHolderMap NPE 
-
+- [[#4953](https://github.com/seata/seata/pull/4953)] fix InsertOnDuplicateUpdate bypass modify pk
 
 ### optimize:
 - [[#4774](https://github.com/seata/seata/pull/4774)] optimize mysql8 dependencies for seataio/seata-server image

diff --git a/changes/zh-cn/develop.md b/changes/zh-cn/develop.md
@@ -19,6 +19,7 @@
 - [[#4915](https://github.com/seata/seata/pull/4915)] 修复获取不到ServerRecoveryProperties属性的问题
 - [[#4919](https://github.com/seata/seata/pull/4919)] 修复XID的port和address出现null:0的情况
 - [[#4928](https://github.com/seata/seata/pull/4928)] 修复 rpcContext.getClientRMHolderMap NPE 问题
+- [[#4953](https://github.com/seata/seata/pull/4953)] 修复InsertOnDuplicateUpdate可绕过修改主键的问题
 
 ### optimize：
 - [[#4774](https://github.com/seata/seata/pull/4774)] 优化 seataio/seata-server 镜像中的 mysql8 依赖

diff --git a/...src/main/java/io/seata/rm/datasource/exec/mysql/MySQLInsertOnDuplicateUpdateExecutor.java b/...src/main/java/io/seata/rm/datasource/exec/mysql/MySQLInsertOnDuplicateUpdateExecutor.java
@@ -24,6 +24,7 @@
 import java.util.Map;
 import java.util.Collections;
 import java.util.StringJoiner;
+import java.util.stream.Collectors;
 
 import com.google.common.base.Joiner;
 import io.seata.common.exception.NotSupportYetException;
@@ -346,10 +347,12 @@ public String buildImageSQL(TableMeta tableMeta) {
     public Map<String, ArrayList<Object>> buildImageParameters(SQLInsertRecognizer recognizer) {
         List<String> duplicateKeyUpdateColumns = recognizer.getDuplicateKeyUpdate();
         if (CollectionUtils.isNotEmpty(duplicateKeyUpdateColumns)) {
+            List<String> duplicateKeyUpdateLowerCaseColumns =
+                duplicateKeyUpdateColumns.parallelStream().map(String::toLowerCase).collect(Collectors.toList());
             getTableMeta().getAllIndexes().forEach((k, v) -> {
                 if ("PRIMARY".equalsIgnoreCase(k)) {
                     for (ColumnMeta m : v.getValues()) {
-                        if (duplicateKeyUpdateColumns.contains(m.getColumnName())) {
+                        if (duplicateKeyUpdateLowerCaseColumns.contains(m.getColumnName().toLowerCase())) {
                             throw new ShouldNeverHappenException("update pk value is not supported!");
                         }
                     }