[Bug] [task datax] The datax task single quotes are not translated, causing the shell to fail.

[DanYanShuYv4j]

Search before asking

• I had searched in the issues and found no similar issues.

What happened

The DolphinScheduler DataX task plugin does not escape variable values containing single quotes when generating shell commands, causing quote mismatches during shell parsing. As a result, "10:59:09" is executed as the name of the Java main class. Below is the specific error log.

1778036486909.log

'AND create_data > '2026-05-06 10:59:09''

What you expected to happen

src/main/java/org/apache/dolphinscheduler/plugin/task/datax/DataxTask.java The method for adding parameters in this class does not escape quotation marks.

private StringBuilder addCustomParameters(Map<String, Property> paramsMap) {
        if (paramsMap == null || paramsMap.size() == 0) {
            return new StringBuilder();
        }
        StringBuilder customParameters = new StringBuilder("-p \"");
        for (Map.Entry<String, Property> entry : paramsMap.entrySet()) {
            customParameters.append(String.format(CUSTOM_PARAM, entry.getKey(), entry.getValue().getValue()));
        }
        customParameters.replace(4, 5, "");
        customParameters.append("\"");
        return customParameters;
    }

Change to the code below

private StringBuilder addCustomParameters(Map<String, Property> paramsMap) {
        if (paramsMap == null || paramsMap.size() == 0) {
            return new StringBuilder();
        }
        StringBuilder customParameters = new StringBuilder("-p \"");
        for (Map.Entry<String, Property> entry : paramsMap.entrySet()) {
            String value = entry.getValue().getValue();
            // Escape single quotes for shell safety: ' -> '\'' (bash standard escape)
            // Prevents shell quoting conflicts when value contains single quotes, e.g.
            // "AND create_data > '2026-05-06 10:59:09'" -> "AND create_data > '\''2026-05-06 10:59:09'\''"
            String escapedValue = value.replace("'", "'\\''");
            customParameters.append(String.format(CUSTOM_PARAM, entry.getKey(), escapedValue));
        }
        customParameters.replace(4, 5, "");
        customParameters.append("\"");
        return customParameters;
    }

How to reproduce

  → Generate ds_incr_condition = "AND create_data > '2026-05-06 10:59:09'" (contains single quotes)
        → Pass through DolphinScheduler varPool
              → Single quote nesting conflict when DS DataX plugin generates shell command ← Failure point
                   → JVM receives incorrect parameters

Anything else

No response

Version

3.4.0

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

Search before asking

• I had searched in the issues and found no similar issues.

What happened

When the DolphinScheduler DataX task plug-in generates a Shell command, variable values containing single quotes are not escaped, causing the quotes to be confused during shell parsing, and 10:59:09 is executed as the Java main class name.
This is

1778036486909.log

'AND create_data > '2026-05-06 10:59:09''

What you expected to happen

src/main/java/org/apache/dolphinscheduler/plugin/task/datax/DataxTask.java The add parameter method of this class does not translate quotes

private StringBuilder addCustomParameters(Map<String, Property> paramsMap) {
        if (paramsMap == null || paramsMap.size() == 0) {
            return new StringBuilder();
        }
        StringBuilder customParameters = new StringBuilder("-p \"");
        for (Map.Entry<String, Property> entry : paramsMap.entrySet()) {
            customParameters.append(String.format(CUSTOM_PARAM, entry.getKey(), entry.getValue().getValue()));
        }
        customParameters.replace(4, 5, "");
        customParameters.append("\"");
        return customParameters;
    }

Change to the code below and add translation

private StringBuilder addCustomParameters(Map<String, Property> paramsMap) {
        if (paramsMap == null || paramsMap.size() == 0) {
            return new StringBuilder();
        }
        StringBuilder customParameters = new StringBuilder("-p \"");
        for (Map.Entry<String, Property> entry : paramsMap.entrySet()) {
            String value = entry.getValue().getValue();
            // Escape single quotes for shell safety: ' -> '\'' (bash standard escape)
            // Prevents shell quoting conflicts when value contains single quotes, e.g.
            // "AND create_data > '2026-05-06 10:59:09'" -> "AND create_data > '\''2026-05-06 10:59:09'\''"
            String escapedValue = value.replace("'", "'\\''");
            customParameters.append(String.format(CUSTOM_PARAM, entry.getKey(), escapedValue));
        }
        customParameters.replace(4, 5, "");
        customParameters.append("\"");
        return customParameters;
    }

How to reproduce

  → Generate ds_incr_condition = "AND create_data > '2026-05-06 10:59:09'" (including single quotes)
    → DolphinScheduler varPool passed
      → Single quote nesting conflict when DS DataX plug-in generates Shell command ← Failure point
        → JVM received bad parameter

Anything else

No response

Version

3.4.0

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[SbloodyS]

Please using english to describe. @DanYanShuYv4j

[DanYanShuYv4j]

Please using english to describe. @DanYanShuYv4j

done @SbloodyS