From 002f7d41a21463c2e547368f590adafd921426a3 Mon Sep 17 00:00:00 2001
From: pigxcloud <2270033969@qq.com>
Date: Mon, 24 Jun 2019 22:28:54 +0800
Subject: [PATCH] =?UTF-8?q?:lock:=20=E4=BF=AE=E5=A4=8D=E5=AE=89=E5=85=A8?=
=?UTF-8?q?=E9=97=AE=E9=A2=98=E3=80=82MyBatis-plus=20Order=20By=20?=
=?UTF-8?q?=E5=AD=98=E5=9C=A8=E7=9A=84SQL=20=E6=B3=A8=E5=85=A5=E9=97=AE?=
=?UTF-8?q?=E9=A2=98=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
.../resolver/SqlFilterArgumentResolver.java | 111 ++++++++++++++++++
.../common/data/resolver/WebMvcConfig.java | 36 ++++++
.../main/resources/META-INF/spring.factories | 3 +-
3 files changed, 149 insertions(+), 1 deletion(-)
create mode 100644 pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java
create mode 100644 pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/WebMvcConfig.java
diff --git a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java
new file mode 100644
index 000000000..fb356b398
--- /dev/null
+++ b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java
@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2018-2025, lengleng All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * Neither the name of the pig4cloud.com developer nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * Author: lengleng (wangiegie@gmail.com)
+ */
+
+package com.pig4cloud.pigx.common.data.resolver;
+
+import cn.hutool.core.util.ArrayUtil;
+import cn.hutool.core.util.StrUtil;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.pig4cloud.pigx.common.core.exception.CheckedException;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.core.MethodParameter;
+import org.springframework.web.bind.support.WebDataBinderFactory;
+import org.springframework.web.context.request.NativeWebRequest;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.method.support.ModelAndViewContainer;
+
+import javax.servlet.http.HttpServletRequest;
+
+/**
+ * @author lengleng
+ * @date 2019-06-24
+ *
+ * 解决Mybatis Plus Order By SQL注入问题
+ */
+@Slf4j
+public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver {
+ private final static String[] KEYWORDS = {"master", "truncate", "insert", "select"
+ , "delete", "update", "declare", "alter", "drop", "sleep"};
+
+ /**
+ * 判断Controller是否包含page 参数
+ *
+ * @param parameter 参数
+ * @return 是否过滤
+ */
+ @Override
+ public boolean supportsParameter(MethodParameter parameter) {
+ return parameter.getParameterType().equals(Page.class);
+ }
+
+ /**
+ * @param parameter 入参集合
+ * @param mavContainer model 和 view
+ * @param webRequest web相关
+ * @param binderFactory 入参解析
+ * @return 检查后新的page对象
+ *
+ * page 只支持查询 GET .如需解析POST获取请求报文体处理
+ */
+ @Override
+ public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer
+ , NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
+
+ HttpServletRequest request = webRequest.getNativeRequest(HttpServletRequest.class);
+
+ String[] ascs = request.getParameterValues("ascs");
+ String[] descs = request.getParameterValues("descs");
+ String current = request.getParameter("current");
+ String size = request.getParameter("size");
+
+ Page page = new Page();
+ if (StrUtil.isNotBlank(current)) {
+ page.setCurrent(Long.parseLong(current));
+ }
+
+ if (StrUtil.isNotBlank(size)) {
+ page.setCurrent(Long.parseLong(size));
+ }
+
+ page.setAsc(sqlInject(ascs));
+ page.setDesc(sqlInject(descs));
+ return page;
+ }
+
+ /**
+ * SQL注入过滤
+ *
+ * @param str 待验证的字符串
+ */
+ public static String[] sqlInject(String[] str) {
+ if (ArrayUtil.isEmpty(str)) {
+ return null;
+ }
+ //转换成小写
+ String inStr = ArrayUtil.join(str, StrUtil.COMMA).toLowerCase();
+
+ //判断是否包含非法字符
+ for (String keyword : KEYWORDS) {
+ if (inStr.contains(keyword)) {
+ log.error("查询包含非法字符 {}", keyword);
+ throw new CheckedException(keyword + "包含非法字符");
+ }
+ }
+
+ return str;
+ }
+}
diff --git a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/WebMvcConfig.java b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/WebMvcConfig.java
new file mode 100644
index 000000000..278c92c8e
--- /dev/null
+++ b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/WebMvcConfig.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2018-2025, lengleng All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * Neither the name of the pig4cloud.com developer nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * Author: lengleng (wangiegie@gmail.com)
+ */
+
+package com.pig4cloud.pigx.common.data.resolver;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+import java.util.List;
+
+/**
+ * @author lengleng
+ * @date 2019-06-24
+ */
+@Configuration
+public class WebMvcConfig implements WebMvcConfigurer {
+ @Override
+ public void addArgumentResolvers(List argumentResolvers) {
+ argumentResolvers.add(new SqlFilterArgumentResolver());
+ }
+}
diff --git a/pigx-common/pigx-common-data/src/main/resources/META-INF/spring.factories b/pigx-common/pigx-common-data/src/main/resources/META-INF/spring.factories
index b31d9ce74..8bc3f62f8 100644
--- a/pigx-common/pigx-common-data/src/main/resources/META-INF/spring.factories
+++ b/pigx-common/pigx-common-data/src/main/resources/META-INF/spring.factories
@@ -5,4 +5,5 @@ org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
com.pig4cloud.pigx.common.data.tenant.PigxTenantConfigProperties,\
com.pig4cloud.pigx.common.data.tenant.TenantContextHolderFilter,\
com.pig4cloud.pigx.common.data.tenant.PigxFeignTenantConfiguration,\
- com.pig4cloud.pigx.common.data.mybatis.MybatisPlusConfig
\ No newline at end of file
+ com.pig4cloud.pigx.common.data.mybatis.MybatisPlusConfig,\
+ com.pig4cloud.pigx.common.data.resolver.WebMvcConfig
\ No newline at end of file