diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java index 14fc7da6..5fe64902 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java @@ -1,24 +1,38 @@ package com.jero.common.util; import cn.hutool.crypto.SecureUtil; -import lombok.extern.slf4j.Slf4j; import com.jero.common.exception.JeroBootException; +import lombok.extern.slf4j.Slf4j; + import javax.servlet.http.HttpServletRequest; import java.util.regex.Pattern; /** * sql注入处理工具类 - * + * * @author zhoujf */ @Slf4j public class SqlInjectionUtil { + + private SqlInjectionUtil(){ + + } /** * sign 用于表字典加签的盐值【SQL漏洞】 * (上线修改值 20200501,同步修改前端的盐值) */ - private final static String TABLE_DICT_SIGN_SALT = "20200501"; - private final static String xssStr = "'|and |exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+"; + private static final String TABLE_DICT_SIGN_SALT = "20200501"; + private static final String XSS_STR = "'|and |exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+"; + + private static final String SYMBOL_CONSTANT = "/\\*.*\\*/"; + private static final String SQL_INJECTION_CONSTANT = "请注意,存在SQL注入关键词---> {}"; + private static final String SQL_VALUE_INJECTION_CONSTANT = "请注意,值可能存在SQL注入风险!---> {}"; + private static final String SQL_VALUE_INJECTION_CONSTANT1 = "请注意,值可能存在SQL注入风险!--->"; + private static final String SHOW_S_TABLE_CONSTANT = "show\\s+tables"; + + + /* * 针对表字典进行额外的sign签名校验(增加安全机制) @@ -42,7 +56,7 @@ public class SqlInjectionUtil { /** * sql注入过滤处理,遇到注入关键字抛异常 - * + * * @param value * @return */ @@ -52,50 +66,48 @@ public class SqlInjectionUtil { } // 统一转为小写 value = value.toLowerCase(); - value = value.replaceAll("/\\*.*\\*/",""); + value = value.replaceAll(SYMBOL_CONSTANT,""); - String[] xssArr = xssStr.split("\\|"); + String[] xssArr = XSS_STR.split("\\|"); for (int i = 0; i < xssArr.length; i++) { if (value.indexOf(xssArr[i]) > -1) { - log.error("请注意,存在SQL注入关键词---> {}", xssArr[i]); - log.error("请注意,值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意,值可能存在SQL注入风险!--->" + value); + log.error(SQL_INJECTION_CONSTANT, xssArr[i]); + log.error(SQL_VALUE_INJECTION_CONSTANT, value); + throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } - if(Pattern.matches("show\\s+tables", value)){ - throw new RuntimeException("请注意,值可能存在SQL注入风险!--->" + value); + if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ + throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); } - return; } /** * sql注入过滤处理,遇到注入关键字抛异常 - * + * * @param values * @return */ public static void filterContent(String[] values) { - String[] xssArr = xssStr.split("\\|"); + String[] xssArr = XSS_STR.split("\\|"); for (String value : values) { if (value == null || "".equals(value)) { return; } // 统一转为小写 value = value.toLowerCase(); - value = value.replaceAll("/\\*.*\\*/",""); + value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { if (value.indexOf(xssArr[i]) > -1) { - log.error("请注意,存在SQL注入关键词---> {}", xssArr[i]); - log.error("请注意,值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意,值可能存在SQL注入风险!--->" + value); + log.error(SQL_INJECTION_CONSTANT, xssArr[i]); + log.error(SQL_VALUE_INJECTION_CONSTANT, value); + throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } - if(Pattern.matches("show\\s+tables", value)){ - throw new RuntimeException("请注意,值可能存在SQL注入风险!--->" + value); + if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ + throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } - return; } /** @@ -112,19 +124,18 @@ public class SqlInjectionUtil { } // 统一转为小写 value = value.toLowerCase(); - value = value.replaceAll("/\\*.*\\*/",""); + value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { - log.error("请注意,存在SQL注入关键词---> {}", xssArr[i]); - log.error("请注意,值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意,值可能存在SQL注入风险!--->" + value); + log.error(SQL_INJECTION_CONSTANT, xssArr[i]); + log.error(SQL_VALUE_INJECTION_CONSTANT, value); + throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } - if(Pattern.matches("show\\s+tables", value)){ - throw new RuntimeException("请注意,值可能存在SQL注入风险!--->" + value); + if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ + throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); } - return; } @@ -141,19 +152,18 @@ public class SqlInjectionUtil { } // 统一转为小写 value = value.toLowerCase(); - value = value.replaceAll("/\\*.*\\*/",""); + value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { - log.error("请注意,存在SQL注入关键词---> {}", xssArr[i]); - log.error("请注意,值可能存在SQL注入风险!---> {}", value); - throw new RuntimeException("请注意,值可能存在SQL注入风险!--->" + value); + log.error(SQL_INJECTION_CONSTANT, xssArr[i]); + log.error(SQL_VALUE_INJECTION_CONSTANT, value); + throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } - if(Pattern.matches("show\\s+tables", value)){ - throw new RuntimeException("请注意,值可能存在SQL注入风险!--->" + value); + if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ + throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); } - return; } }