jeecg/jeecg-boot
1
0
Fork 0
mirror of https://github.com/jeecgboot/jeecg-boot.git synced 2025-09-08 21:07:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

【issues/4393】解决使用参数tableName=sys_user t&复测，漏洞仍然存在

Browse Source
This commit is contained in:
zhangdaiscott
2023-08-14 12:51:31 +08:00
parent 0bc7e0967d
commit 751b81c7bf
2 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/security/DictQueryBlackListHandler.java
View File

@@ -56,6 +56,9 @@ public class DictQueryBlackListHandler extends AbstractQueryBlackListHandler {
if (tableName.contains(" ")) {
tableName = tableName.substring(0, tableName.indexOf(" "));
}
if (tableName.contains(".")) {
tableName = tableName.substring(tableName.indexOf(".")+1, tableName.length());
}
//【issues/4393】 sys_user , (sys_user), sys_user%20, %60sys_user%60
String reg = "\\s+|\\(|\\)|`";
return tableName.replaceAll(reg, "");