Language: Go
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
func (u *MysqlService) Create(ctx context.Context, req dto.MysqlDBCreate) (*model.DatabaseMysql, error) {
	if cmd.CheckIllegal(req.Name, req.Username, req.Password, req.Format, req.Permission) {
		return nil, buserr.New(constant.ErrCmdIllegal)
	}

	if req.Username == "root" {
		return nil, errors.New("Cannot set root as user name")
	}
	app, err := appInstallRepo.LoadBaseInfo("mysql", "")
	if err != nil {
		return nil, err
	}
	mysql, _ := mysqlRepo.Get(commonRepo.WithByName(req.Name))
	if mysql.ID != 0 {
		return nil, constant.ErrRecordExist
	}
	if err := copier.Copy(&mysql, &req); err != nil {
		return nil, errors.WithMessage(constant.ErrStructTransform, err.Error())
	}

	createSql := fmt.Sprintf("create database `%s` default character set %s collate %s", req.Name, req.Format, formatMap[req.Format])
	if err := excSQL(app.ContainerName, app.Password, createSql); err != nil {
		if strings.Contains(err.Error(), "ERROR 1007") {
			return nil, buserr.New(constant.ErrDatabaseIsExist)
		}
		return nil, err
	}
	if err := u.createUser(app.ContainerName, app.Password, app.Version, req); err != nil {
		return nil, err
	}

	global.LOG.Infof("create database %s successful!", req.Name)
	mysql.MysqlName = app.Name
	if err := mysqlRepo.Create(ctx, &mysql); err != nil {
		return nil, err
	}
	return &mysql, nil
}