diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java index 5fe64902..ceb6a6d2 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java @@ -73,11 +73,11 @@ public class SqlInjectionUtil { if (value.indexOf(xssArr[i]) > -1) { log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_VALUE_INJECTION_CONSTANT, value); - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } @@ -98,14 +98,14 @@ public class SqlInjectionUtil { value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { - if (value.indexOf(xssArr[i]) > -1) { + if (value.contains(xssArr[i])) { log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_VALUE_INJECTION_CONSTANT, value); - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } } @@ -113,6 +113,7 @@ public class SqlInjectionUtil { /** * @特殊方法(不通用) 仅用于字典条件SQL参数,注入过滤 * @param value + * @deprecated 不推荐 * @return */ @Deprecated @@ -127,14 +128,14 @@ public class SqlInjectionUtil { value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { - if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { + if (value.contains(xssArr[i]) || value.startsWith(xssArr[i].trim())) { log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_VALUE_INJECTION_CONSTANT, value); - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } @@ -155,14 +156,14 @@ public class SqlInjectionUtil { value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { - if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { + if (value.contains(xssArr[i]) || value.startsWith(xssArr[i].trim())) { log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_VALUE_INJECTION_CONSTANT, value); - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } }