fix fuzzy query sql injection (#4970)

oap-server/server-storage-plugin/storage-jdbc-hikaricp-plugin/src/main/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2AlarmQueryDAO.java

@@ -61,7 +61,8 @@ public class H2AlarmQueryDAO implements IAlarmQueryDAO {
         }
 
         if (!Strings.isNullOrEmpty(keyword)) {
-            sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like '%").append(keyword).append("%' ");
+            sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like concat('%',?,'%') ");
+            parameters.add(keyword);
         }
         sql.append(" order by ").append(AlarmRecord.START_TIME).append(" desc ");
 

oap-server/server-storage-plugin/storage-jdbc-hikaricp-plugin/src/main/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2MetadataQueryDAO.java

@@ -125,7 +125,8 @@ public class H2MetadataQueryDAO implements IMetadataQueryDAO {
         sql.append(ServiceTraffic.NODE_TYPE).append("=?");
         condition.add(NodeType.Normal.value());
         if (!Strings.isNullOrEmpty(keyword)) {
-            sql.append(" and ").append(ServiceTraffic.NAME).append(" like \"%").append(keyword).append("%\"");
+            sql.append(" and ").append(ServiceTraffic.NAME).append(" like concat('%',?,'%')");
+            condition.add(keyword);
         }
         sql.append(" limit ").append(metadataQueryMaxSize);
 
@@ -175,7 +176,8 @@ public class H2MetadataQueryDAO implements IMetadataQueryDAO {
         sql.append(EndpointTraffic.SERVICE_ID).append("=?");
         condition.add(serviceId);
         if (!Strings.isNullOrEmpty(keyword)) {
-            sql.append(" and ").append(EndpointTraffic.NAME).append(" like '%").append(keyword).append("%' ");
+            sql.append(" and ").append(EndpointTraffic.NAME).append(" like concat('%',?,'%') ");
+            condition.add(keyword);
         }
         sql.append(" limit ").append(limit);
 

oap-server/server-storage-plugin/storage-jdbc-hikaricp-plugin/src/main/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/h2/dao/H2TraceQueryDAO.java

@@ -82,7 +82,8 @@ public class H2TraceQueryDAO implements ITraceQueryDAO {
             }
         }
         if (!Strings.isNullOrEmpty(endpointName)) {
-            sql.append(" and ").append(SegmentRecord.ENDPOINT_NAME).append(" like '%" + endpointName + "%'");
+            sql.append(" and ").append(SegmentRecord.ENDPOINT_NAME).append(" like concat('%',?,'%')");
+            parameters.add(endpointName);
         }
         if (StringUtil.isNotEmpty(serviceId)) {
             sql.append(" and ").append(SegmentRecord.SERVICE_ID).append(" = ?");

oap-server/server-storage-plugin/storage-jdbc-hikaricp-plugin/src/main/java/org/apache/skywalking/oap/server/storage/plugin/jdbc/mysql/MySQLAlarmQueryDAO.java

@@ -61,7 +61,8 @@ public class MySQLAlarmQueryDAO implements IAlarmQueryDAO {
         }
 
         if (!Strings.isNullOrEmpty(keyword)) {
-            sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like '%").append(keyword).append("%' ");
+            sql.append(" and ").append(AlarmRecord.ALARM_MESSAGE).append(" like concat('%',?,'%') ");
+            parameters.add(keyword);
         }
         sql.append(" order by ").append(AlarmRecord.START_TIME).append(" desc ");