From 9f663904e2f914df171f15f3880ba39847dc065a Mon Sep 17 00:00:00 2001 From: wxyclub Date: Tue, 8 Aug 2023 13:50:25 +0800 Subject: [PATCH] =?UTF-8?q?bug:=E9=9D=9E=E6=B3=95=E5=AD=97=E7=AC=A6?= =?UTF-8?q?=E5=A4=84=E7=90=86=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/main/java/com/adc/da/xss/SQLFilter.java | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/adc-da-base/src/main/java/com/adc/da/xss/SQLFilter.java b/adc-da-base/src/main/java/com/adc/da/xss/SQLFilter.java index 60584f33..eb6978d0 100644 --- a/adc-da-base/src/main/java/com/adc/da/xss/SQLFilter.java +++ b/adc-da-base/src/main/java/com/adc/da/xss/SQLFilter.java @@ -1,8 +1,14 @@ package com.adc.da.xss; import com.adc.da.exception.AdcDaBaseException; +import com.alibaba.fastjson.JSON; +import com.alibaba.fastjson.JSONObject; import org.apache.commons.lang3.StringUtils; +import java.util.Arrays; +import java.util.List; +import java.util.stream.Collectors; + public class SQLFilter { @@ -13,13 +19,13 @@ public class SQLFilter { String checkStr= str; checkStr = StringUtils.replace(checkStr, "\\", ""); checkStr = checkStr.toLowerCase(); - String[] keywords = new String[]{"master", "truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"}; + String[] keywords = new String[]{"master ", "truncate ", "insert ", "select ", "delete ", "update", "declare ", "alter ", "drop "}; String[] arr$ = keywords; int len$ = keywords.length; for(int i$ = 0; i$ < len$; ++i$) { String keyword = arr$[i$]; - if (checkStr.indexOf(keyword) != -1) { + if (checkStr.contains(keyword)) { throw new AdcDaBaseException("包含非法字符"); } }