入侵mysql数据库_SQL注入漏洞

系统症状：

某个功能报错：

但是数据库链接并没有用完。重启一下tomcat就好了，但是过十几分钟又报错，如此反复。

怀疑是数据库连接泄露。于是加入下面的配置进行调查：

……

查到报错信息：

[ERROR] com.alibaba.druid.pool.DruidDataSource.removeAbandoned(DruidDataSource.java:2664):Druid-ConnectionPool-Destroy-1730184957 – abandon connection, owner thread: http-apr-8181-exec-186, connected at : 1560136511767, open stackTrace

at java.lang.Thread.getStackTrace(Thread.java:1559)

at com.alibaba.druid.pool.DruidDataSource.getConnectionDirect(DruidDataSource.java:1311)

at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:1233)

at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:1223)

at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:90)

at org.springframework.jdbc.datasource.DataSourceTransactionManager.doBegin(DataSourceTransactionManager.java:246)

at org.springframework.transaction.support.AbstractPlatformTransactionManager.getTransaction(AbstractPlatformTransactionManager.java:377)

at org.springframework.transaction.interceptor.TransactionAspectSupport.createTransactionIfNecessary(TransactionAspectSupport.java:461)

at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:277)

at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)

at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673)

atcom.xxxx.controller.FileController.getxxxxjrxx(FileController.java:382)

……

ownerThread current state is BLOCKED, current stackTrace

at java.lang.Throwable.printStackTrace(Throwable.java:655)

at java.lang.Throwable.printStackTrace(Throwable.java:643)

at java.lang.Throwable.printStackTrace(Throwable.java:634)

at com.xxx.service.xxxServiceImpl.getxxx(Btjc01ServiceImpl.java:544)

at com.xxx.service.xxxServiceImpl$$FastClassBySpringCGLIB$$5df1f982.invoke()

最后查到是线程被某个外部接口给 BLOCKED，导致其持有的数据库连接无法释放，从而导致数据库连接泄露，从而导致该问题。

其实就是 数据库连接 的 onwerThread 被 blocked了。