KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

【fix sonar】SqlInjectionUtil文件

Browse Source
This commit is contained in:
梁琦涛
2023-03-06 11:06:55 +08:00
parent 26f531f79a
commit 09c99ee967
1 changed files with 46 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java
+46 -36
View File
@@ -1,24 +1,38 @@
package com.jero.common.util;
import cn.hutool.crypto.SecureUtil;
import lombok.extern.slf4j.Slf4j;
import com.jero.common.exception.JeroBootException;
import lombok.extern.slf4j.Slf4j;
import javax.servlet.http.HttpServletRequest;
import java.util.regex.Pattern;
/**
* sql注入处理工具类
*
*
* @author zhoujf
*/
@Slf4j
public class SqlInjectionUtil {
private SqlInjectionUtil(){
}
/**
* sign 用于表字典加签的盐值【SQL漏洞】
* （上线修改值 20200501，同步修改前端的盐值）
*/
private final static String TABLE_DICT_SIGN_SALT = "20200501";
private final static String xssStr = "'|and |exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+";
private static final String TABLE_DICT_SIGN_SALT = "20200501";
private static final String XSS_STR = "'|and |exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+";
private static final String SYMBOL_CONSTANT = "/\\*.*\\*/";
private static final String SQL_INJECTION_CONSTANT = "请注意，存在SQL注入关键词---> {}";
private static final String SQL_VALUE_INJECTION_CONSTANT = "请注意，值可能存在SQL注入风险!---> {}";
private static final String SQL_VALUE_INJECTION_CONSTANT1 = "请注意，值可能存在SQL注入风险!--->";
private static final String SHOW_S_TABLE_CONSTANT = "show\\s+tables";
/*
* 针对表字典进行额外的sign签名校验（增加安全机制）
@@ -42,7 +56,7 @@ public class SqlInjectionUtil {
/**
* sql注入过滤处理，遇到注入关键字抛异常
*
*
* @param value
* @return
*/
@@ -52,50 +66,48 @@ public class SqlInjectionUtil {
}
// 统一转为小写
value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/","");
value = value.replaceAll(SYMBOL_CONSTANT,"");
String[] xssArr = xssStr.split("\\|");
String[] xssArr = XSS_STR.split("\\|");
for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
log.error("请注意，值可能存在SQL注入风险!---> {}", value);
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
}
}
if(Pattern.matches("show\\s+tables", value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
}
return;
}
/**
* sql注入过滤处理，遇到注入关键字抛异常
*
*
* @param values
* @return
*/
public static void filterContent(String[] values) {
String[] xssArr = xssStr.split("\\|");
String[] xssArr = XSS_STR.split("\\|");
for (String value : values) {
if (value == null || "".equals(value)) {
return;
}
// 统一转为小写
value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/","");
value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
log.error("请注意，值可能存在SQL注入风险!---> {}", value);
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
}
}
if(Pattern.matches("show\\s+tables", value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
}
}
return;
}
/**
@@ -112,19 +124,18 @@ public class SqlInjectionUtil {
}
// 统一转为小写
value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/","");
value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
log.error("请注意，值可能存在SQL注入风险!---> {}", value);
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
}
}
if(Pattern.matches("show\\s+tables", value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
}
return;
}
@@ -141,19 +152,18 @@ public class SqlInjectionUtil {
}
// 统一转为小写
value = value.toLowerCase();
value = value.replaceAll("/\\*.*\\*/","");
value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) {
log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]);
log.error("请注意，值可能存在SQL注入风险!---> {}", value);
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
}
}
if(Pattern.matches("show\\s+tables", value)){
throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);
if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value);
}
return;
}
}