jeecg/jeecg-boot
1
0
Fork 0
mirror of https://github.com/jeecgboot/jeecg-boot.git synced 2025-09-08 07:18:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

解决SQL注入检测逻辑影响业务 #6105

Browse Source
This commit is contained in:
JEECG
2024-04-20 18:34:52 +08:00
parent 13d00a8bb4
commit 4dc4e87900
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysDictServiceImpl.java
View File

@@ -84,7 +84,8 @@ public class SysDictServiceImpl extends ServiceImpl<SysDictMapper, SysDict> impl
// 2.SQL注入check（只限制非法串改数据库）
//关联表字典（举例：sys_user,realname,id）
SqlInjectionUtil.filterContent(table, fieldName);
SqlInjectionUtil.filterContent(table);
SqlInjectionUtil.filterContent(fieldName);
String checkSql = table + SymbolConstant.COMMA + fieldName + SymbolConstant.COMMA;
// 【QQYUN-6533】表字典白名单check
@@ -268,7 +269,8 @@ public class SysDictServiceImpl extends ServiceImpl<SysDictMapper, SysDict> impl
// 1.SQL注入校验（只限制非法串改数据库）
SqlInjectionUtil.specialFilterContentForDictSql(table);
SqlInjectionUtil.filterContent(text, code);
SqlInjectionUtil.filterContent(text);
SqlInjectionUtil.filterContent(code);
SqlInjectionUtil.specialFilterContentForDictSql(filterSql);
String str = table+","+text+","+code;