From 0d27c9e3daf5bc19d648f3ef0fead0c0799b207d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B7=E5=86=B7?= Date: Thu, 20 Feb 2020 19:01:51 +0800 Subject: [PATCH] :lock: Fixing security issues. [Security Bug]Sql injection on page pagination!!! --- .../resolver/SqlFilterArgumentResolver.java | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java index 6826743f2..44acbbb7a 100644 --- a/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java +++ b/pigx-common/pigx-common-data/src/main/java/com/pig4cloud/pigx/common/data/resolver/SqlFilterArgumentResolver.java @@ -17,7 +17,6 @@ package com.pig4cloud.pigx.common.data.resolver; -import cn.hutool.core.util.ArrayUtil; import cn.hutool.core.util.StrUtil; import com.baomidou.mybatisplus.core.metadata.OrderItem; import com.baomidou.mybatisplus.extension.plugins.pagination.Page; @@ -33,6 +32,7 @@ import java.util.ArrayList; import java.util.Arrays; import java.util.List; import java.util.Optional; +import java.util.function.Predicate; import java.util.stream.Collectors; /** @@ -88,13 +88,28 @@ public class SqlFilterArgumentResolver implements HandlerMethodArgumentResolver List orderItemList = new ArrayList<>(); Optional.ofNullable(ascs).ifPresent(s -> orderItemList.addAll(Arrays.stream(s) - .filter(s1 -> !ArrayUtil.containsIgnoreCase(KEYWORDS, s1)) + .filter(sqlInjectPredicate()) .map(OrderItem::asc).collect(Collectors.toList()))); Optional.ofNullable(descs).ifPresent(s -> orderItemList.addAll(Arrays.stream(s) - .filter(s1 -> !ArrayUtil.containsIgnoreCase(KEYWORDS, s1)) + .filter(sqlInjectPredicate()) .map(OrderItem::desc).collect(Collectors.toList()))); page.addOrder(orderItemList); return page; } + + /** + * 判断用户输入里面有没有关键字 + * @return Predicate + */ + private Predicate sqlInjectPredicate() { + return sql -> { + for (String keyword : KEYWORDS) { + if (StrUtil.containsIgnoreCase(sql, keyword)){ + return false; + } + } + return true; + }; + } }