From 3f4d1dbf6e4fa02603252b84d1aa3849a62c14fd Mon Sep 17 00:00:00 2001 From: PIGCLOUD Date: Sun, 20 Sep 2026 08:57:45 +0800 Subject: [PATCH] =?UTF-8?q?feat(sql):=20=E6=96=B0=E5=A2=9E=20SqlSortUtils?= =?UTF-8?q?=20=E5=B7=A5=E5=85=B7=E7=B1=BB=EF=BC=8C=E6=8F=90=E4=BE=9B?= =?UTF-8?q?=E6=8E=92=E5=BA=8F=E5=AD=97=E6=AE=B5=E6=A0=A1=E9=AA=8C=E5=8A=9F?= =?UTF-8?q?=E8=83=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 实现 isValidColumn 方法，校验前端传入的排序字段是否合法 - 更新 SqlFilterArgumentResolver，使用 SqlSortUtils 进行排序字段校验 (cherry picked from commit 1833847cd835d9972c2237cb804f00fd8075d4e8) --- .../resolver/SqlFilterArgumentResolver.java | 12 +++--- .../pigx/common/data/util/SqlSortUtils.java | 43 +++++++++++++++++++ 2 files changed, 50 insertions(+), 5 deletions(-) create mode 100644 pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/util/SqlSortUtils.java diff --git a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java index 9cd531a28..ed3aedea7 100644 --- a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java +++ b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java @@ -20,9 +20,9 @@ package com.pig4cloud.pigx.common.data.resolver; import cn.hutool.core.comparator.CompareUtil; import cn.hutool.core.util.StrUtil; import com.baomidou.mybatisplus.core.metadata.OrderItem; -import com.baomidou.mybatisplus.core.toolkit.sql.SqlInjectionUtils; import com.baomidou.mybatisplus.extension.plugins.pagination.Page; import com.pig4cloud.pigx.common.core.exception.CheckedException; +import com.pig4cloud.pigx.common.data.util.SqlSortUtils; import jakarta.servlet.http.HttpServletRequest; import lombok.extern.slf4j.Slf4j; import org.springframework.core.MethodParameter; @@ -92,14 +92,16 @@ public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver List orderItemList = new ArrayList<>(); Optional.ofNullable(ascs) .ifPresent(s -> orderItemList.addAll(Arrays.stream(s.split(StrUtil.COMMA)) - .filter(asc -> !SqlInjectionUtils.check(asc)) + .map(String::trim) + .filter(SqlSortUtils::isValidColumn) .map(OrderItem::asc) - .toList())); + .toList())); Optional.ofNullable(descs) .ifPresent(s -> orderItemList.addAll(Arrays.stream(s.split(StrUtil.COMMA)) - .filter(desc -> !SqlInjectionUtils.check(desc)) + .map(String::trim) + .filter(SqlSortUtils::isValidColumn) .map(OrderItem::desc) - .toList())); + .toList())); page.addOrder(orderItemList); return page; diff --git a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/util/SqlSortUtils.java b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/util/SqlSortUtils.java new file mode 100644 index 000000000..6c0a11998 --- /dev/null +++ b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/util/SqlSortUtils.java @@ -0,0 +1,43 @@ +/* + * Copyright (c) 2018-2025, lengleng All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * Neither the name of the pig4cloud.com developer nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * Author: lengleng (wangiegie@gmail.com) + */ + +package com.pig4cloud.pigx.common.data.util; + +import java.util.regex.Pattern; + +/** + * 前端排序字段校验。仅接受字段名或表别名限定的字段名，不接受 SQL 表达式。 + *

+ * 本工具只校验字段格式，业务层仍需限制允许排序的字段。 + */ +public final class SqlSortUtils { + + private static final Pattern SORT_COLUMN = Pattern.compile("[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*)?"); + + private SqlSortUtils() { + } + + /** + * 校验单个排序字段。调用方应先拆分多个字段并去除首尾空白。 + * @param column 前端传入的排序字段 + * @return 是否为合法的字段名或别名限定字段名 + */ + public static boolean isValidColumn(String column) { + return column != null && SORT_COLUMN.matcher(column).matches(); + } + +}