injection

Author: dengzhhu653

standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java

@@ -1013,10 +1013,6 @@ private List<Partition> getPartitionsByNames(String catName, String dbName,
       throws MetaException {
     // Get most of the fields for the partNames provided.
     // Assume db and table names are the same for all partition, as provided in arguments.
-    String quotedPartNames = partNameList.stream()
-        .map(DirectSqlUpdatePart::quoteString)
-        .collect(Collectors.joining(","));
-
     String queryText =
         "select " + PARTITIONS + ".\"PART_ID\"," + SDS + ".\"SD_ID\"," + SDS + ".\"CD_ID\","
         + SERDES + ".\"SERDE_ID\"," + PARTITIONS + ".\"CREATE_TIME\"," + PARTITIONS
@@ -1028,12 +1024,12 @@ private List<Partition> getPartitionsByNames(String catName, String dbName,
         + " left outer join " + SERDES + " on " + SDS + ".\"SERDE_ID\" = " + SERDES + ".\"SERDE_ID\" "
         + " inner join " + TBLS + " on " + TBLS + ".\"TBL_ID\" = " + PARTITIONS + ".\"TBL_ID\" "
         + " inner join " + DBS + " on " + DBS + ".\"DB_ID\" = " + TBLS + ".\"DB_ID\" "
-        + " where \"PART_NAME\" in (" + quotedPartNames + ") "
+        + " where \"PART_NAME\" in (" + makeParams(partNameList.size()) + ") "
         + " and " + TBLS + ".\"TBL_NAME\" = ? and " + DBS + ".\"NAME\" = ? and " + DBS
         + ".\"CTLG_NAME\" = ? order by \"PART_NAME\" asc";
-
-    Object[] params = new Object[]{tblName, dbName, catName};
-    return getPartitionsByQuery(catName, dbName, tblName, queryText, params, isAcidTable, args);
+    List params = new ArrayList<>(partNameList);
+    params.addAll(List.of(tblName, dbName, catName));
+    return getPartitionsByQuery(catName, dbName, tblName, queryText, params.toArray(), isAcidTable, args);
   }
 
   private List<Partition> getPartitionsByPartitionIdsInBatch(String catName, String dbName,