CVE-2019-19499: Grafana Arbitrary File Read

The vulnerability stems from improper input sanitization when building the MySQL connection string. The pre-patch code in newMysqlQueryEndpoint directly interpolated user-controlled parameters (including credentials and URL) into the connection string without escaping special characters. This allowed authenticated attackers to inject path traversal sequences (via URL parameter) to read arbitrary files. The fix introduced characterEscape() to properly sanitize these inputs, confirming the vulnerability existed in the original string construction logic.