socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled

Description

ConnectionHelper.standardSocket() passes the socketFactory option to Class.forName without validation. Under a URLClassLoader-based loader (e.g. Spring Boot fat-jar run with java -jar), a crafted value can be resolved as a jar: URL, causing a class to be loaded from an arbitrary location rather than the classpath. A class extending javax.net.SocketFactory then passes the type check and executes attacker code on instantiation, resulting in RCE.

Requires the application to pass user-controlled input to DriverManager.getConnection(). A working PoC has been reported.

Goal is to validate socketFactoryName against a strict class-name pattern; reject any value containing :, /, or !.