diff --git a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java index a0ce13631..41660cf3b 100644 --- a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java +++ b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java @@ -46,66 +46,65 @@ import java.util.stream.Collectors; @Slf4j public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver { - private final static String[] KEYWORDS = { "master", "truncate", "insert", "select", "delete", "update", "declare", - "alter", "drop", "sleep", "extractvalue", "concat" }; - /** - * 判断Controller是否包含page 参数 - * @param parameter 参数 - * @return 是否过滤 - */ - @Override - public boolean supportsParameter(MethodParameter parameter) { - return parameter.getParameterType().equals(Page.class); - } + /** + * 判断Controller是否包含page 参数 + * + * @param parameter 参数 + * @return 是否过滤 + */ + @Override + public boolean supportsParameter(MethodParameter parameter) { + return parameter.getParameterType().equals(Page.class); + } - /** - * @param parameter 入参集合 - * @param mavContainer model 和 view - * @param webRequest web相关 - * @param binderFactory 入参解析 - * @return 检查后新的page对象 - *

- * page 只支持查询 GET .如需解析POST获取请求报文体处理 - */ - @Override - public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer, - NativeWebRequest webRequest, WebDataBinderFactory binderFactory) { + /** + * @param parameter 入参集合 + * @param mavContainer model 和 view + * @param webRequest web相关 + * @param binderFactory 入参解析 + * @return 检查后新的page对象 + *

+ * page 只支持查询 GET .如需解析POST获取请求报文体处理 + */ + @Override + public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer, + NativeWebRequest webRequest, WebDataBinderFactory binderFactory) { - HttpServletRequest request = webRequest.getNativeRequest(HttpServletRequest.class); + HttpServletRequest request = webRequest.getNativeRequest(HttpServletRequest.class); - String ascs = request.getParameter("ascs"); - String descs = request.getParameter("descs"); + String ascs = request.getParameter("ascs"); + String descs = request.getParameter("descs"); - String current = request.getParameter("current"); - String size = request.getParameter("size"); + String current = request.getParameter("current"); + String size = request.getParameter("size"); - Page page = new Page(); - if (StrUtil.isNotBlank(current)) { - // 如果current page 小于零 视为不合法数据 - if (CompareUtil.compare(Long.parseLong(current), 0L) < 0) { - throw new CheckedException("current page error"); - } - page.setCurrent(Long.parseLong(current)); - } + Page page = new Page(); + if (StrUtil.isNotBlank(current)) { + // 如果current page 小于零 视为不合法数据 + if (CompareUtil.compare(Long.parseLong(current), 0L) < 0) { + throw new CheckedException("current page error"); + } + page.setCurrent(Long.parseLong(current)); + } - if (StrUtil.isNotBlank(size)) { - page.setSize(Long.parseLong(size)); - } + if (StrUtil.isNotBlank(size)) { + page.setSize(Long.parseLong(size)); + } - List orderItemList = new ArrayList<>(); - Optional.ofNullable(ascs) - .ifPresent(s -> orderItemList.addAll(Arrays.stream(s.split(StrUtil.COMMA)) - .filter(SqlInjectionUtils::check) - .map(OrderItem::asc) - .collect(Collectors.toList()))); - Optional.ofNullable(descs) - .ifPresent(s -> orderItemList.addAll(Arrays.stream(s.split(StrUtil.COMMA)) - .filter(SqlInjectionUtils::check) - .map(OrderItem::desc) - .collect(Collectors.toList()))); - page.addOrder(orderItemList); + List orderItemList = new ArrayList<>(); + Optional.ofNullable(ascs) + .ifPresent(s -> orderItemList.addAll(Arrays.stream(s.split(StrUtil.COMMA)) + .filter(asc -> !SqlInjectionUtils.check(asc)) + .map(OrderItem::asc) + .collect(Collectors.toList()))); + Optional.ofNullable(descs) + .ifPresent(s -> orderItemList.addAll(Arrays.stream(s.split(StrUtil.COMMA)) + .filter(desc -> !SqlInjectionUtils.check(desc)) + .map(OrderItem::desc) + .collect(Collectors.toList()))); + page.addOrder(orderItemList); - return page; - } + return page; + } }