Skip to content

Commit 09b3017

Browse files
TommyLemonTommyLemon
committed
Java：MultiDataSource 中 SQLAuto: 强校验 SQL 避免 \t, \r, \f 等制表符绕过
1 parent 758b32a commit 09b3017

1 file changed

Lines changed: 11 additions & 6 deletions

File tree

‎APIJSON-Java-Server/APIJSONBoot-MultiDataSource/src/main/java/apijson/boot/DemoController.java‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2366,19 +2366,24 @@ public String execute(@RequestBody String request, HttpSession session) {
23662366
config.setSchema(schema);
23672367

23682368
if (WRITE_STRICTLY && isWrite && ! isInsert) {
2369-
int fromInd = isEdit ? 0 : findKeyIndex(trimmedSQL, "FROM");
2369+
String sqlRest = trimmedSQL.replaceAll("\\s+", " ");
2370+
sqlRest = sqlRest.replaceAll("\f", " ");
2371+
sqlRest = sqlRest.replaceAll("\n", " ");
2372+
sqlRest = sqlRest.replaceAll("\t", " ");
2373+
sqlRest = sqlRest.replaceAll("\r", " ");
2374+
int fromInd = isEdit ? 0 : findKeyIndex(sqlRest, "FROM");
23702375
if (fromInd < 0) {
23712376
throw new IllegalArgumentException("SQL 缺 FORM 关键词!");
23722377
}
23732378

2374-
String sqlRest = trimmedSQL.substring(fromInd + (isEdit ? "UPDATE " : " FROM ").length()).trim();
2379+
sqlRest = sqlRest.substring(fromInd + (isEdit ? "UPDATE " : " FROM ").length()).trim();
23752380
int blankRest = sqlRest.indexOf(" ");
23762381
if (blankRest < 0) {
23772382
throw new IllegalArgumentException("SQL 缺少 表名!");
23782383
}
23792384

23802385
String tblPath = sqlRest.substring(0, blankRest).trim();
2381-
sqlRest = sqlRest.substring(blankRest + 1).trim();
2386+
sqlRest = sqlRest.substring(blankRest); // + 1).trim();
23822387
String[] tblArr = tblPath.indexOf(".") >= 0 ? tblPath.split("\\.") : new String[]{tblPath}; // StringUtil.split(tblPath.Pattern.quota("."), true);
23832388
int len = tblArr == null ? 0 : tblArr.length;
23842389
String sch = len < 2 ? null : tblArr[len - 2];
@@ -2423,7 +2428,7 @@ public String execute(@RequestBody String request, HttpSession session) {
24232428
throw new IllegalArgumentException("SQL WHERE 后必须接着 "+ idKey + " 或 " + idKey + " = ? 或 IN(?,?..) !");
24242429
}
24252430

2426-
sqlRest = sqlRest.substring(key. length()).trim();
2431+
sqlRest = sqlRest.substring(key.length()).trim();
24272432
boolean isEq = sqlRest.startsWith("=");
24282433
if (! (isEq || sqlRest.startsWith("IN(") || sqlRest.startsWith("in("))) {
24292434
throw new IllegalArgumentException("SQL WHERE "+ key + " 后必须接着 = ? 或 IN(?, ? ...) ! ");
@@ -2692,8 +2697,8 @@ private static int findLastKeyIndex(String sql, String key) {
26922697
return findKeyIndex(sql, key, true, false);
26932698
}
26942699

2695-
private static final String[] LEFT_CHARS = new String[]{" ", "\n", ")"};
2696-
private static final String[] RIGHT_CHARS = new String[]{" ", "\n", "("};
2700+
private static final String[] LEFT_CHARS = new String[]{" ", "\n", "\t", "\r", "\f", ")"};
2701+
private static final String[] RIGHT_CHARS = new String[]{" ", "\n", "\t", "\r", "\f", "("};
26972702
private static int findKeyIndex(String sql, String key, boolean last, boolean cased) {
26982703
for (int i = 0; i < LEFT_CHARS.length; i++) {
26992704
String l = LEFT_CHARS[i];

0 commit comments

Comments
 (0)