fix(codegen): 拦截非法表名

(cherry picked from commit 4e441f50473a4c3c5222002f23de6afdb5c70588)

pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenCreateTableController.java

@@ -19,6 +19,7 @@ package com.pig4cloud.pigx.codegen.controller;
 import cn.hutool.json.JSONUtil;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.core.toolkit.sql.SqlInjectionUtils;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.pig4cloud.pigx.codegen.entity.GenCreateTable;
 import com.pig4cloud.pigx.codegen.service.GenCreateTableService;
@@ -30,6 +31,7 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.security.SecurityRequirement;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpHeaders;
 import org.springframework.web.bind.annotation.*;
 
@@ -42,6 +44,7 @@ import java.util.List;
  * @date 2022-09-23 21:56:11
  */
 @RestController
+@Slf4j
 @RequiredArgsConstructor
 @RequestMapping("/create-table")
 @Tag(description = "create-table", name = "自动创建表管理管理")
@@ -84,6 +87,10 @@ public class GenCreateTableController {
 	@PostMapping
 	@HasPermission("codegen_table_add")
 	public R save(@RequestBody GenCreateTableVO createTableVO) {
+		if (SqlInjectionUtils.check(createTableVO.getTableName())) {
+			log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", createTableVO.getDsName(), createTableVO.getTableName());
+			return R.failed("非法内容");
+		}
         AnylineDataSourceHelper.run(createTableVO.getDsName(), () -> createTableService.createTable(createTableVO));
 		GenCreateTable createTable = new GenCreateTable();
         createTable.setId(createTableVO.getId());

pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenTableController.java

@@ -19,6 +19,7 @@ package com.pig4cloud.pigx.codegen.controller;
 
 import com.baomidou.dynamic.datasource.toolkit.DynamicDataSourceContextHolder;
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.core.toolkit.sql.SqlInjectionUtils;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.pig4cloud.pigx.codegen.entity.GenTable;
 import com.pig4cloud.pigx.codegen.entity.GenTableColumnEntity;
@@ -31,6 +32,7 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.security.SecurityRequirement;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpHeaders;
 import org.springframework.web.bind.annotation.*;
 
@@ -43,6 +45,7 @@ import java.util.List;
  * @date 2023-02-06 20:34:55
  */
 @RestController
+@Slf4j
 @RequiredArgsConstructor
 @RequestMapping("/table")
 @Tag(description = "table", name = "列属性管理")
@@ -96,6 +99,10 @@ public class GenTableController {
      */
     @GetMapping("/{dsName}/{tableName}")
     public R<GenTable> getTable(@PathVariable("dsName") String dsName, @PathVariable String tableName) {
+		if (SqlInjectionUtils.check(tableName)) {
+			log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", dsName, tableName);
+			return R.failed("非法内容");
+		}
         return R.ok(tableService.queryOrBuildTable(dsName, tableName));
     }
 
@@ -107,6 +114,10 @@ public class GenTableController {
      */
     @GetMapping("/column/{dsName}/{tableName}")
     public R getColumn(@PathVariable("dsName") String dsName, @PathVariable String tableName) throws Exception {
+		if (SqlInjectionUtils.check(tableName)) {
+			log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", dsName, tableName);
+			return R.failed("非法内容");
+		}
         return R.ok(tableService.queryTableColumn(dsName, tableName));
     }
 
@@ -118,6 +129,10 @@ public class GenTableController {
      */
     @GetMapping("/ddl/{dsName}/{tableName}")
     public R getDdl(@PathVariable("dsName") String dsName, @PathVariable String tableName) throws Exception {
+		if (SqlInjectionUtils.check(tableName)) {
+			log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", dsName, tableName);
+			return R.failed("非法内容");
+		}
         return R.ok(tableService.queryTableDdl(dsName, tableName));
     }
 
@@ -130,6 +145,10 @@ public class GenTableController {
      */
     @GetMapping("/sync/{dsName}/{tableName}")
     public R<GenTable> syncTable(@PathVariable("dsName") String dsName, @PathVariable String tableName) {
+		if (SqlInjectionUtils.check(tableName)) {
+			log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", dsName, tableName);
+			return R.failed("非法内容");
+		}
         return R.ok(tableService.syncTable(dsName, tableName));
     }