From 2edc478f730ef988448ef97a976964d31510b68b Mon Sep 17 00:00:00 2001 From: PIGCLOUD Date: Wed, 5 Aug 2026 12:36:24 +0800 Subject: [PATCH] =?UTF-8?q?fix(codegen):=20=E6=8B=A6=E6=88=AA=E9=9D=9E?= =?UTF-8?q?=E6=B3=95=E8=A1=A8=E5=90=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit 4e441f50473a4c3c5222002f23de6afdb5c70588) --- .../controller/GenCreateTableController.java | 7 +++++++ .../controller/GenTableController.java | 19 +++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenCreateTableController.java b/pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenCreateTableController.java index 5591eab1c..031a9f702 100755 --- a/pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenCreateTableController.java +++ b/pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenCreateTableController.java @@ -19,6 +19,7 @@ package com.pig4cloud.pigx.codegen.controller; import cn.hutool.json.JSONUtil; import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper; import com.baomidou.mybatisplus.core.toolkit.Wrappers; +import com.baomidou.mybatisplus.core.toolkit.sql.SqlInjectionUtils; import com.baomidou.mybatisplus.extension.plugins.pagination.Page; import com.pig4cloud.pigx.codegen.entity.GenCreateTable; import com.pig4cloud.pigx.codegen.service.GenCreateTableService; @@ -30,6 +31,7 @@ import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.security.SecurityRequirement; import io.swagger.v3.oas.annotations.tags.Tag; import lombok.RequiredArgsConstructor; +import lombok.extern.slf4j.Slf4j; import org.springframework.http.HttpHeaders; import org.springframework.web.bind.annotation.*; @@ -42,6 +44,7 @@ import java.util.List; * @date 2022-09-23 21:56:11 */ @RestController +@Slf4j @RequiredArgsConstructor @RequestMapping("/create-table") @Tag(description = "create-table", name = "自动创建表管理管理") @@ -84,6 +87,10 @@ public class GenCreateTableController { @PostMapping @HasPermission("codegen_table_add") public R save(@RequestBody GenCreateTableVO createTableVO) { + if (SqlInjectionUtils.check(createTableVO.getTableName())) { + log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", createTableVO.getDsName(), createTableVO.getTableName()); + return R.failed("非法内容"); + } AnylineDataSourceHelper.run(createTableVO.getDsName(), () -> createTableService.createTable(createTableVO)); GenCreateTable createTable = new GenCreateTable(); createTable.setId(createTableVO.getId()); diff --git a/pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenTableController.java b/pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenTableController.java index 989cffa6c..4ee11ec3e 100644 --- a/pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenTableController.java +++ b/pigx-visual/pigx-codegen/src/main/java/com/pig4cloud/pigx/codegen/controller/GenTableController.java @@ -19,6 +19,7 @@ package com.pig4cloud.pigx.codegen.controller; import com.baomidou.dynamic.datasource.toolkit.DynamicDataSourceContextHolder; import com.baomidou.mybatisplus.core.toolkit.Wrappers; +import com.baomidou.mybatisplus.core.toolkit.sql.SqlInjectionUtils; import com.baomidou.mybatisplus.extension.plugins.pagination.Page; import com.pig4cloud.pigx.codegen.entity.GenTable; import com.pig4cloud.pigx.codegen.entity.GenTableColumnEntity; @@ -31,6 +32,7 @@ import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.security.SecurityRequirement; import io.swagger.v3.oas.annotations.tags.Tag; import lombok.RequiredArgsConstructor; +import lombok.extern.slf4j.Slf4j; import org.springframework.http.HttpHeaders; import org.springframework.web.bind.annotation.*; @@ -43,6 +45,7 @@ import java.util.List; * @date 2023-02-06 20:34:55 */ @RestController +@Slf4j @RequiredArgsConstructor @RequestMapping("/table") @Tag(description = "table", name = "列属性管理") @@ -96,6 +99,10 @@ public class GenTableController { */ @GetMapping("/{dsName}/{tableName}") public R getTable(@PathVariable("dsName") String dsName, @PathVariable String tableName) { + if (SqlInjectionUtils.check(tableName)) { + log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", dsName, tableName); + return R.failed("非法内容"); + } return R.ok(tableService.queryOrBuildTable(dsName, tableName)); } @@ -107,6 +114,10 @@ public class GenTableController { */ @GetMapping("/column/{dsName}/{tableName}") public R getColumn(@PathVariable("dsName") String dsName, @PathVariable String tableName) throws Exception { + if (SqlInjectionUtils.check(tableName)) { + log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", dsName, tableName); + return R.failed("非法内容"); + } return R.ok(tableService.queryTableColumn(dsName, tableName)); } @@ -118,6 +129,10 @@ public class GenTableController { */ @GetMapping("/ddl/{dsName}/{tableName}") public R getDdl(@PathVariable("dsName") String dsName, @PathVariable String tableName) throws Exception { + if (SqlInjectionUtils.check(tableName)) { + log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", dsName, tableName); + return R.failed("非法内容"); + } return R.ok(tableService.queryTableDdl(dsName, tableName)); } @@ -130,6 +145,10 @@ public class GenTableController { */ @GetMapping("/sync/{dsName}/{tableName}") public R syncTable(@PathVariable("dsName") String dsName, @PathVariable String tableName) { + if (SqlInjectionUtils.check(tableName)) { + log.warn("代码生成检测到非法表名，dsName: {}, tableName: {}", dsName, tableName); + return R.failed("非法内容"); + } return R.ok(tableService.syncTable(dsName, tableName)); }