jeecg/jeecg-boot
1
0
Fork 0
mirror of https://github.com/jeecgboot/jeecg-boot.git synced 2025-09-26 09:58:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

解决SQL注入检测逻辑影响业务 #6105

Browse Source
This commit is contained in:
JEECG
2024-04-20 18:34:52 +08:00
parent 13d00a8bb4
commit 4dc4e87900
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysDictServiceImpl.java
View File

@@ -84,7 +84,8 @@ public class SysDictServiceImpl extends ServiceImpl<SysDictMapper, SysDict> impl
// 2.SQL注入check（只限制非法串改数据库） // 2.SQL注入check（只限制非法串改数据库）
//关联表字典（举例：sys_user,realname,id） //关联表字典（举例：sys_user,realname,id）
SqlInjectionUtil.filterContent(table, fieldName); SqlInjectionUtil.filterContent(table);
SqlInjectionUtil.filterContent(fieldName);
String checkSql = table + SymbolConstant.COMMA + fieldName + SymbolConstant.COMMA; String checkSql = table + SymbolConstant.COMMA + fieldName + SymbolConstant.COMMA;
// 【QQYUN-6533】表字典白名单check // 【QQYUN-6533】表字典白名单check
@@ -268,7 +269,8 @@ public class SysDictServiceImpl extends ServiceImpl<SysDictMapper, SysDict> impl
// 1.SQL注入校验（只限制非法串改数据库） // 1.SQL注入校验（只限制非法串改数据库）
SqlInjectionUtil.specialFilterContentForDictSql(table); SqlInjectionUtil.specialFilterContentForDictSql(table);
SqlInjectionUtil.filterContent(text, code); SqlInjectionUtil.filterContent(text);
SqlInjectionUtil.filterContent(code);
SqlInjectionUtil.specialFilterContentForDictSql(filterSql); SqlInjectionUtil.specialFilterContentForDictSql(filterSql);
String str = table+","+text+","+code; String str = table+","+text+","+code;