restrictedAuth allowlist is matched with substring contains() instead of equality,

from PR https://github.com/mariadb-corporation/mariadb-connector-j/pull/231

restrictedAuth is meant to limit which authentication plugins the server is allowed to request. In AuthenticationPluginLoader, each entry of the list was compared to the requested plugin with type.contains() rather than exact equality:

if (authList == null || Arrays.stream(authList).anyMatch(type::contains))

This makes the restriction ineffective:

an empty element from a leading or doubled comma (",mysql_native_password", "a,,b") makes contains("") true for every plugin, so the restriction is silently disabled;
a partial entry like "mysql" or "password" matches plugins that were never listed;
as a result a malicious/compromised server can request mysql_clear_password and receive the account password in clear text, despite restrictedAuth being set.

Fix
Match each restrictedAuth entry with exact equality (type::equals), so only explicitly listed plugin types are permitted.