JeroBoot/base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

【fix sonar】SqlInjectionUtil文件

Browse Source
This commit is contained in:
梁琦涛
2023-03-06 11:06:55 +08:00
parent 26f531f79a
commit 09c99ee967
1 changed files with 46 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java
+46 -36
View File
@@ -1,24 +1,38 @@
package com.jero.common.util; package com.jero.common.util;
import cn.hutool.crypto.SecureUtil; import cn.hutool.crypto.SecureUtil;
import lombok.extern.slf4j.Slf4j;
import com.jero.common.exception.JeroBootException; import com.jero.common.exception.JeroBootException;
import lombok.extern.slf4j.Slf4j;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import java.util.regex.Pattern; import java.util.regex.Pattern;
/** /**
* sql注入处理工具类 * sql注入处理工具类
* *
* @author zhoujf * @author zhoujf
*/ */
@Slf4j @Slf4j
public class SqlInjectionUtil { public class SqlInjectionUtil {
private SqlInjectionUtil(){
}
/** /**
* sign 用于表字典加签的盐值【SQL漏洞】 * sign 用于表字典加签的盐值【SQL漏洞】
* （上线修改值 20200501，同步修改前端的盐值） * （上线修改值 20200501，同步修改前端的盐值）
*/ */
private final static String TABLE_DICT_SIGN_SALT = "20200501"; private static final String TABLE_DICT_SIGN_SALT = "20200501";
private final static String xssStr = "'|and |exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+"; private static final String XSS_STR = "'|and |exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+";
private static final String SYMBOL_CONSTANT = "/\\*.*\\*/";
private static final String SQL_INJECTION_CONSTANT = "请注意，存在SQL注入关键词---> {}";
private static final String SQL_VALUE_INJECTION_CONSTANT = "请注意，值可能存在SQL注入风险!---> {}";
private static final String SQL_VALUE_INJECTION_CONSTANT1 = "请注意，值可能存在SQL注入风险!--->";
private static final String SHOW_S_TABLE_CONSTANT = "show\\s+tables";
/* /*
* 针对表字典进行额外的sign签名校验（增加安全机制） * 针对表字典进行额外的sign签名校验（增加安全机制）
@@ -42,7 +56,7 @@ public class SqlInjectionUtil {
/** /**
* sql注入过滤处理，遇到注入关键字抛异常 * sql注入过滤处理，遇到注入关键字抛异常
* *
* @param value * @param value
* @return * @return
*/ */
@@ -52,50 +66,48 @@ public class SqlInjectionUtil {
} }
// 统一转为小写 // 统一转为小写
value = value.toLowerCase(); value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/",""); value = value.replaceAll(SYMBOL_CONSTANT,"");
String[] xssArr = xssStr.split("\\|"); String[] xssArr = XSS_STR.split("\\|");
for (int i = 0; i < xssArr.length; i++) { for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1) { if (value.indexOf(xssArr[i]) > -1) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error("请注意，值可能存在SQL注入风险!---> {}", value); log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
if(Pattern.matches("show\\s+tables", value)){ if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
return;
} }
/** /**
* sql注入过滤处理，遇到注入关键字抛异常 * sql注入过滤处理，遇到注入关键字抛异常
* *
* @param values * @param values
* @return * @return
*/ */
public static void filterContent(String[] values) { public static void filterContent(String[] values) {
String[] xssArr = xssStr.split("\\|"); String[] xssArr = XSS_STR.split("\\|");
for (String value : values) { for (String value : values) {
if (value == null || "".equals(value)) { if (value == null || "".equals(value)) {
return; return;
} }
// 统一转为小写 // 统一转为小写
value = value.toLowerCase(); value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/",""); value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) { for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1) { if (value.indexOf(xssArr[i]) > -1) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error("请注意，值可能存在SQL注入风险!---> {}", value); log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
if(Pattern.matches("show\\s+tables", value)){ if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
return;
} }
/** /**
@@ -112,19 +124,18 @@ public class SqlInjectionUtil {
} }
// 统一转为小写 // 统一转为小写
value = value.toLowerCase(); value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/",""); value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) { for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error("请注意，值可能存在SQL注入风险!---> {}", value); log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
if(Pattern.matches("show\\s+tables", value)){ if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
return;
} }
@@ -141,19 +152,18 @@ public class SqlInjectionUtil {
} }
// 统一转为小写 // 统一转为小写
value = value.toLowerCase(); value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/",""); value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) { for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error("请注意，值可能存在SQL注入风险!---> {}", value); log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
if(Pattern.matches("show\\s+tables", value)){ if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
return;
} }
} }