+ * 解决Mybatis Plus Order By SQL注入问题 + */ +@Slf4j +public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver { + private final static String[] KEYWORDS = {"master", "truncate", "insert", "select" + , "delete", "update", "declare", "alter", "drop", "sleep"}; + + /** + * 判断Controller是否包含page 参数 + * + * @param parameter 参数 + * @return 是否过滤 + */ + @Override + public boolean supportsParameter(MethodParameter parameter) { + return parameter.getParameterType().equals(Page.class); + } + + /** + * @param parameter 入参集合 + * @param mavContainer model 和 view + * @param webRequest web相关 + * @param binderFactory 入参解析 + * @return 检查后新的page对象 + *
+ * page 只支持查询 GET .如需解析POST获取请求报文体处理
+ */
+ @Override
+ public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer
+ , NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
+
+ HttpServletRequest request = webRequest.getNativeRequest(HttpServletRequest.class);
+
+ String[] ascs = request.getParameterValues("ascs");
+ String[] descs = request.getParameterValues("descs");
+ String current = request.getParameter("current");
+ String size = request.getParameter("size");
+
+ Page page = new Page();
+ if (StrUtil.isNotBlank(current)) {
+ page.setCurrent(Long.parseLong(current));
+ }
+
+ if (StrUtil.isNotBlank(size)) {
+ page.setCurrent(Long.parseLong(size));
+ }
+
+ page.setAsc(sqlInject(ascs));
+ page.setDesc(sqlInject(descs));
+ return page;
+ }
+
+ /**
+ * SQL注入过滤
+ *
+ * @param str 待验证的字符串
+ */
+ public static String[] sqlInject(String[] str) {
+ if (ArrayUtil.isEmpty(str)) {
+ return null;
+ }
+ //转换成小写
+ String inStr = ArrayUtil.join(str, StrUtil.COMMA).toLowerCase();
+
+ //判断是否包含非法字符
+ for (String keyword : KEYWORDS) {
+ if (inStr.contains(keyword)) {
+ log.error("查询包含非法字符 {}", keyword);
+ throw new CheckedException(keyword + "包含非法字符");
+ }
+ }
+
+ return str;
+ }
+}
diff --git a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/WebMvcConfig.java b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/WebMvcConfig.java
new file mode 100644
index 000000000..278c92c8e
--- /dev/null
+++ b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/WebMvcConfig.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2018-2025, lengleng All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * Neither the name of the pig4cloud.com developer nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * Author: lengleng (wangiegie@gmail.com)
+ */
+
+package com.pig4cloud.pigx.common.data.resolver;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+import java.util.List;
+
+/**
+ * @author lengleng
+ * @date 2019-06-24
+ */
+@Configuration
+public class WebMvcConfig implements WebMvcConfigurer {
+ @Override
+ public void addArgumentResolvers(List