manager/my-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

新增 列名 columnName 正则表达式的安全过滤

Browse Source
This commit is contained in:
thinkgem
2025-02-11 12:46:41 +08:00
parent 97b299a113
commit ac699f9057
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
common/src/main/java/com/jeesite/common/codec/EncodeUtils.java
View File

@@ -267,6 +267,7 @@ public class EncodeUtils {
+ "|(\\b(select|update|and|or|delete|insert|trancate|substr|ascii|declare|exec|count|master|into" + "|(\\b(select|update|and|or|delete|insert|trancate|substr|ascii|declare|exec|count|master|into"
+ "|drop|execute|case when|sleep|union|load_file)\\b)", Pattern.CASE_INSENSITIVE); + "|drop|execute|case when|sleep|union|load_file)\\b)", Pattern.CASE_INSENSITIVE);
private static final Pattern simplePattern = Pattern.compile("[a-z0-9_\\.\\, ]*", Pattern.CASE_INSENSITIVE); private static final Pattern simplePattern = Pattern.compile("[a-z0-9_\\.\\, ]*", Pattern.CASE_INSENSITIVE);
private static final Pattern columnNamePattern = Pattern.compile("[a-z0-9_\\.`\"\\[\\]]*", Pattern.CASE_INSENSITIVE);
/** /**
* SQL过滤，防止注入，传入参数输入有select相关代码，替换空。 * SQL过滤，防止注入，传入参数输入有select相关代码，替换空。
@@ -283,11 +284,16 @@ public class EncodeUtils {
public static String sqlFilter(String text, String source){ public static String sqlFilter(String text, String source){
if (text != null){ if (text != null){
String value = text; String value = text;
if ("simple".equals(source) || "orderBy".equals(source)) { if (StringUtils.inString(source, "simple", "orderBy")) {
Matcher matcher = simplePattern.matcher(value); Matcher matcher = simplePattern.matcher(value);
if (!matcher.matches()) { if (!matcher.matches()) {
value = StringUtils.EMPTY; value = StringUtils.EMPTY;
} }
} else if (StringUtils.inString(source, "columnName")) {
Matcher matcher = columnNamePattern.matcher(value);
if (!matcher.matches()) {
value = StringUtils.EMPTY;
}
} else { } else {
Matcher matcher = sqlPattern.matcher(value); Matcher matcher = sqlPattern.matcher(value);
if (matcher.find()) { if (matcher.find()) {