Allow list for JDBC connection properties to address CVE-2021-26919

[jihoonson]

Description

This is a backport PR of 48953e3. CVE-2021-26919 is filed for the security vulnerability of remote code execution using vulnerable MySQL JDBC properties. This PR adds an allow list for JDBC connection properties that is enforced against every JDBC connections for ingestion and lookups but not metadata stores. The allow list is enforced to connections to postgresql as well as mysql. This is because, even though the known security vulnerability can be exploitable with only MySQL, we want to be conservative and avoid the same issue even with PostgreSQL that can be potentially exploitable in the future. The JDBC connection will fail if it uses a property that is not in the allow list.

Implementation-wise, this PR uses vendor-specific libraries to parse JDBC connection URLs because the JDBC URL format is diverse across different vendors. This introduces new compatibility issues.

1. The JDBC driver version in the classpath at runtime should be compatible to the version that is used for URL parsing at compile time.
2. Druid can enforce the allow list to only the JDBC connections that it knows how to parse. However, we should restrict allowed JDBC properties for other database systems to avoid similar issues that can be potentially found in the future.

As a result, URL parsing should be a short-term workaround to mitigate this vulnerability. Longer term, we should rather disallow arbitrary URLs in JDBC connections. Instead, we can only accept connection properties individually including host, port and user name.

---

Key changed/added classes in this PR

• JdbcAccessSecurityConfig
• JdbcExtractionNamespace
• JdbcFetcher
• MySQLFirehoseDatabaseConnector
• PostgresqlFirehoseDatabaseConnector

---

This PR has:

• been self-reviewed.
  • using the concurrency checklist (Remove this item if the PR doesn't have any relation to concurrency.)
• added documentation for new or modified features or behaviors.
• added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.