mirrors/pig
1
0
Fork 0
mirror of https://gitee.com/log4j/pig.git synced 2024-12-23 13:03:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

🔒 修复安全问题。 更新SQL过滤器，和新版mybatis plus orderitem 保持一致

Browse Source
This commit is contained in:
冷冷 2019-07-11 15:50:04 +08:00
parent 033f76038c
commit d3c9098782
3 changed files with 42 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
pig-common/pig-common-core/src/main/java/com/pig4cloud/pig/common/core/mybatis/SqlFilterArgumentResolver.java
View File

@ -17,8 +17,9 @@
package com.pig4cloud.pig.common.core.mybatis; package com.pig4cloud.pig.common.core.mybatis;
import cn.hutool.core.util.ArrayUtil; import cn.hutool.core.collection.CollUtil;
import cn.hutool.core.util.StrUtil; import cn.hutool.core.util.StrUtil;
import com.baomidou.mybatisplus.core.metadata.OrderItem;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page; import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.pig4cloud.pig.common.core.exception.CheckedException; import com.pig4cloud.pig.common.core.exception.CheckedException;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
@ -29,6 +30,8 @@ import org.springframework.web.method.support.HandlerMethodArgumentResolver;
import org.springframework.web.method.support.ModelAndViewContainer; import org.springframework.web.method.support.ModelAndViewContainer;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import java.util.ArrayList;
import java.util.List;
/** /**
* @author lengleng * @author lengleng
@ -67,8 +70,8 @@ public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver
HttpServletRequest request = webRequest.getNativeRequest(HttpServletRequest.class); HttpServletRequest request = webRequest.getNativeRequest(HttpServletRequest.class);
String[] ascs = request.getParameterValues("ascs"); String ascs = request.getParameter("ascs");
String[] descs = request.getParameterValues("descs"); String descs = request.getParameter("descs");
String current = request.getParameter("current"); String current = request.getParameter("current");
String size = request.getParameter("size"); String size = request.getParameter("size");
@ -78,11 +81,23 @@ public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver
} }
if (StrUtil.isNotBlank(size)) { if (StrUtil.isNotBlank(size)) {
page.setCurrent(Long.parseLong(size)); page.setSize(Long.parseLong(size));
} }
page.setAsc(sqlInject(ascs)); // 过滤 asc 条件
page.setDesc(sqlInject(descs)); List<OrderItem> ascList = sqlInject(ascs, "asc");
// 过滤 desc条件
List<OrderItem> descList = sqlInject(descs, "desc");
List<OrderItem> orderItemList = new ArrayList<>();
if (CollUtil.isNotEmpty(ascList)) {
orderItemList.addAll(ascList);
}
if (CollUtil.isNotEmpty(descList)) {
orderItemList.addAll(descList);
}
page.setOrders(orderItemList);
return page; return page;
} }
@ -90,13 +105,14 @@ public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver
* SQL注入过滤 * SQL注入过滤
* *
* @param str 待验证的字符串 * @param str 待验证的字符串
* @return 返回标准的order 属性
*/ */
public static String[] sqlInject(String[] str) { private static List<OrderItem> sqlInject(String str, String type) {
if (ArrayUtil.isEmpty(str)) { if (StrUtil.isBlank(str)) {
return null; return null;
} }
//转换成小写 //转换成小写
String inStr = ArrayUtil.join(str, StrUtil.COMMA).toLowerCase(); String inStr = str.toLowerCase();
//判断是否包含非法字符 //判断是否包含非法字符
for (String keyword : KEYWORDS) { for (String keyword : KEYWORDS) {
@ -106,6 +122,14 @@ public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver
} }
} }
return str; List<OrderItem> orderItemList = new ArrayList<>();
for (String in : str.split(StrUtil.COMMA)) {
if ("asc".equals(type)) {
orderItemList.add(OrderItem.asc(in));
} else {
orderItemList.add(OrderItem.desc(in));
}
}
return orderItemList;
} }
} }

4
pig-common/pig-common-core/src/main/java/com/pig4cloud/pig/common/core/mybatis/WebMvcConfig.java
View File

@ -17,12 +17,15 @@
package com.pig4cloud.pig.common.core.mybatis; package com.pig4cloud.pig.common.core.mybatis;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
import org.springframework.web.method.support.HandlerMethodArgumentResolver; import org.springframework.web.method.support.HandlerMethodArgumentResolver;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import java.util.List; import java.util.List;
import static org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type.SERVLET;
/** /**
* @author lengleng * @author lengleng
* @date 2019-06-24 * @date 2019-06-24
@ -30,6 +33,7 @@ import java.util.List;
* 注入自自定义SQL 过滤 * 注入自自定义SQL 过滤
*/ */
@Configuration @Configuration
@ConditionalOnWebApplication(type = SERVLET)
public class WebMvcConfig implements WebMvcConfigurer { public class WebMvcConfig implements WebMvcConfigurer {
@Override @Override
public void addArgumentResolvers(List<HandlerMethodArgumentResolver> argumentResolvers) { public void addArgumentResolvers(List<HandlerMethodArgumentResolver> argumentResolvers) {

3
pig-common/pig-common-core/src/main/resources/META-INF/spring.factories
View File

@ -4,4 +4,5 @@ org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
com.pig4cloud.pig.common.core.config.RestTemplateConfig,\ com.pig4cloud.pig.common.core.config.RestTemplateConfig,\
com.pig4cloud.pig.common.core.config.FilterIgnorePropertiesConfig,\ com.pig4cloud.pig.common.core.config.FilterIgnorePropertiesConfig,\
com.pig4cloud.pig.common.core.exception.GlobalExceptionHandler,\ com.pig4cloud.pig.common.core.exception.GlobalExceptionHandler,\
com.pig4cloud.pig.common.core.util.SpringContextHolder com.pig4cloud.pig.common.core.util.SpringContextHolder,\
com.pig4cloud.pig.common.core.mybatis.WebMvcConfig