From 619626ae7ef85afc60c720fb309efb08b58b0cb7 Mon Sep 17 00:00:00 2001
From: 潘志宝 <979469083@qq.com>
Date: 星期一, 20 一月 2025 09:43:26 +0800
Subject: [PATCH] sqlInject2
---
iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/data/controller/admin/PlanDataSetController.java | 4 ++--
iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/value/service/impl/IndItemValueServiceImpl.java | 10 +++++-----
iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/data/controller/admin/IndDataSetController.java | 4 ++--
iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/item/collection/PlanItemCollector.java | 2 ++
iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/common/xss/SQLFilter.java | 36 +++++++++++++++++++++++++++++++-----
5 files changed, 42 insertions(+), 14 deletions(-)
diff --git a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/common/xss/SQLFilter.java b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/common/xss/SQLFilter.java
index 57178fc..7d2d02d 100644
--- a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/common/xss/SQLFilter.java
+++ b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/common/xss/SQLFilter.java
@@ -12,10 +12,11 @@
/**
* SQL注入过滤
- * @param str 待验证的字符串
+ *
+ * @param str 待验证的字符串
*/
- public static String sqlInject(String str){
- if(StringUtils.isBlank(str)){
+ public static String sqlInject(String str) {
+ if (StringUtils.isBlank(str)) {
return null;
}
//去掉'|"|;|\字符
@@ -31,8 +32,33 @@
String[] keywords = {"master", "truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"};
//判断是否包含非法字符
- for(String keyword : keywords){
- if(str.indexOf(keyword) != -1){
+ for (String keyword : keywords) {
+ if (str.indexOf(keyword) != -1) {
+ throw new RRException("包含非法字符");
+ }
+ }
+
+ return str;
+ }
+
+ /**
+ * SQL注入过滤
+ *
+ * @param orgStr 待验证的字符串
+ */
+ public static String sqlInject2(String orgStr) {
+ if (StringUtils.isBlank(orgStr)) {
+ return null;
+ }
+ //转换成小写
+ String str = new String(orgStr.toLowerCase());
+
+ //非法字符
+ String[] keywords = {";", "master", "truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"};
+
+ //判断是否包含非法字符
+ for (String keyword : keywords) {
+ if (str.indexOf(keyword) != -1) {
throw new RRException("包含非法字符");
}
}
diff --git a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/data/controller/admin/IndDataSetController.java b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/data/controller/admin/IndDataSetController.java
index d117c17..4438ab3 100644
--- a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/data/controller/admin/IndDataSetController.java
+++ b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/data/controller/admin/IndDataSetController.java
@@ -48,7 +48,7 @@
@Operation(summary = "创建指标数据集")
@PreAuthorize("@ss.hasPermission('data:ind-data-set:create')")
public CommonResult<Boolean> create(@Valid @RequestBody IndDataSetSaveReqVO createReqVO) {
- SQLFilter.sqlInject(createReqVO.getQuerySql());
+ SQLFilter.sqlInject2(createReqVO.getQuerySql());
indDataSetService.create(createReqVO);
return success(true);
}
@@ -57,7 +57,7 @@
@Operation(summary = "修改指标数据集")
@PreAuthorize("@ss.hasPermission('data:ind-data-set:update')")
public CommonResult<Boolean> update(@Valid @RequestBody IndDataSetSaveReqVO updateReqVO) {
- SQLFilter.sqlInject(updateReqVO.getQuerySql());
+ SQLFilter.sqlInject2(updateReqVO.getQuerySql());
indDataSetService.update(updateReqVO);
return success(true);
}
diff --git a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/value/service/impl/IndItemValueServiceImpl.java b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/value/service/impl/IndItemValueServiceImpl.java
index 625bf6e..ed1c49d 100644
--- a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/value/service/impl/IndItemValueServiceImpl.java
+++ b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/ind/value/service/impl/IndItemValueServiceImpl.java
@@ -65,11 +65,11 @@
log.warn("数据源不能为空");
return null;
}
- SQLFilter.sqlInject(dto.getSelectSql());
- SQLFilter.sqlInject(dto.getViewSql());
- SQLFilter.sqlInject(dto.getWhereSql());
- SQLFilter.sqlInject(dto.getGroupSql());
- SQLFilter.sqlInject(dto.getGroupSql());
+ SQLFilter.sqlInject2(dto.getSelectSql());
+ SQLFilter.sqlInject2(dto.getViewSql());
+ SQLFilter.sqlInject2(dto.getWhereSql());
+ SQLFilter.sqlInject2(dto.getGroupSql());
+ SQLFilter.sqlInject2(dto.getGroupSql());
DataContextHolder.setDataSourceId(Long.valueOf(dto.getDataSource()));
return baseDao.getSourceValue(dto);
}
diff --git a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/data/controller/admin/PlanDataSetController.java b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/data/controller/admin/PlanDataSetController.java
index 0314c7b..7d7721b 100644
--- a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/data/controller/admin/PlanDataSetController.java
+++ b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/data/controller/admin/PlanDataSetController.java
@@ -47,7 +47,7 @@
@Operation(summary = "创建计划数据集")
@PreAuthorize("@ss.hasPermission('data:plan-data-set:create')")
public CommonResult<Boolean> create(@Valid @RequestBody PlanDataSetSaveReqVO createReqVO) {
- SQLFilter.sqlInject(createReqVO.getQuerySql());
+ SQLFilter.sqlInject2(createReqVO.getQuerySql());
indDataSetService.create(createReqVO);
return success(true);
}
@@ -56,7 +56,7 @@
@Operation(summary = "修改计划数据集")
@PreAuthorize("@ss.hasPermission('data:plan-data-set:update')")
public CommonResult<Boolean> update(@Valid @RequestBody PlanDataSetSaveReqVO updateReqVO) {
- SQLFilter.sqlInject(updateReqVO.getQuerySql());
+ SQLFilter.sqlInject2(updateReqVO.getQuerySql());
indDataSetService.update(updateReqVO);
return success(true);
}
diff --git a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/item/collection/PlanItemCollector.java b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/item/collection/PlanItemCollector.java
index 4e116ea..2ef1f30 100644
--- a/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/item/collection/PlanItemCollector.java
+++ b/iailab-module-data/iailab-module-data-biz/src/main/java/com/iailab/module/data/plan/item/collection/PlanItemCollector.java
@@ -2,6 +2,7 @@
import com.iailab.framework.tenant.core.context.DataContextHolder;
import com.iailab.module.data.common.utils.DateUtils;
+import com.iailab.module.data.common.xss.SQLFilter;
import com.iailab.module.data.plan.data.entity.PlanDataSetEntity;
import com.iailab.module.data.plan.data.service.PlanDataSetService;
import com.iailab.module.data.plan.item.entity.PlanItemEntity;
@@ -44,6 +45,7 @@
return null;
}
Map<String, Object> params = getSqlParams(dataSet, startTime, endTime);
+ SQLFilter.sqlInject2(dataSet.getQuerySql());
DataContextHolder.setDataSourceId(Long.valueOf(dataSet.getDataSource()));
List<PlanItemDataVO> dataList = planItemService.getSourceValue(params);
--
Gitblit v1.9.3