optimize: validate that the primary key is free of illegal characters

changes/en-us/2.x.md

@@ -45,6 +45,7 @@ Add changes here for all PR submitted to the 2.x branch.
 - [[#6200](https://github.com/apache/incubator-seata/pull/6200)] cancel required_status_checks
 - [[#6201](https://github.com/apache/incubator-seata/pull/6201)] restore required_status_checks kept to remove context validation
 - [[#6218](https://github.com/apache/incubator-seata/pull/6218)] remove Seata-Docker link
+- [[#6227](https://github.com/apache/incubator-seata/pull/6227)] validate that the primary key is free of illegal characters
 
 ### security:
 - [[#6069](https://github.com/apache/incubator-seata/pull/6069)] Upgrade Guava dependencies to fix security vulnerabilities

changes/zh-cn/2.x.md

@@ -45,6 +45,7 @@
 - [[#6200](https://github.com/apache/incubator-seata/pull/6200)] 去除required_status_checks检查
 - [[#6201](https://github.com/apache/incubator-seata/pull/6201)] 恢复required_status_checks但去除context校验
 - [[#6218](https://github.com/apache/incubator-seata/pull/6218)] 移除Seata-Docker链接
+- [[#6227](https://github.com/apache/incubator-seata/pull/6227)] 校验pk中不含逗号
 
 ### security:
 - [[#6069](https://github.com/apache/incubator-seata/pull/6069)] 升级Guava依赖版本，修复安全漏洞

rm-datasource/src/main/java/io/seata/rm/datasource/exec/BaseTransactionalExecutor.java

@@ -411,6 +411,17 @@ protected void prepareUndoLog(TableRecords beforeImage, TableRecords afterImage)
         }
     }
 
+    /**
+     * validate that the primary key is free of illegal characters
+     *
+     * @param pkVal primary key value
+     */
+    protected void validPk(String pkVal) {
+        if (pkVal.contains(",")) {
+            throw new IllegalArgumentException(pkVal + " contains illegal character!");
+        }
+    }
+
     /**
      * build lockKey
      *
@@ -421,7 +432,6 @@ protected String buildLockKey(TableRecords rowsIncludingPK) {
         if (rowsIncludingPK.size() == 0) {
             return null;
         }
-
         StringBuilder sb = new StringBuilder();
         sb.append(rowsIncludingPK.getTableMeta().getTableName());
         sb.append(":");
@@ -434,7 +444,9 @@ protected String buildLockKey(TableRecords rowsIncludingPK) {
                 if (pkSplitIndex > 0) {
                     sb.append("_");
                 }
-                sb.append(rowMap.get(pkName).getValue());
+                Object pkVal = rowMap.get(pkName).getValue();
+                validPk(String.valueOf(pkVal));
+                sb.append(pkVal);
                 pkSplitIndex++;
             }
             rowSequence++;