Fixes unrestricted JNDI lookup in JDBC_PING datasource setup by checking datasource_jndi_name before fetching context

Author: belaban

src/org/jgroups/protocols/JDBC_PING.java

@@ -431,6 +431,7 @@ protected void closeConnection(final Connection connection) {
     protected DataSource getDataSourceFromJNDI(String name) {
         final DataSource data_source;
         InitialContext ctx = null;
+        validateDatasourceJndiName(name);
         try {
             ctx = new InitialContext();
             Object whatever = ctx.lookup(name);
@@ -454,6 +455,16 @@ protected DataSource getDataSourceFromJNDI(String name) {
         }
     }
 
+    protected static void validateDatasourceJndiName(String name) {
+        if(name == null || name.isEmpty())
+            throw new IllegalArgumentException("JNDI name must not be empty");
+        int colon=name.indexOf(':');
+        if(colon > 0 && !name.regionMatches(true, 0, "java:", 0, "java:".length())) {
+            NamingException cause=new NamingException("Remote JNDI URL schemes are not supported for datasource_jndi_name");
+            throw new IllegalArgumentException("Remote JNDI URL schemes are not supported for datasource_jndi_name: " + name, cause);
+        }
+    }
+    
     protected void verifyConfigurationParameters() {
         // initialize_sql is skipped as the table could be created external to JDBC_PING
         assertNonNull("insert_single_sql",         insert_single_sql,