From 5259f93356a824434d8ef2ceece67b9f210ac0dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=A2=81=E7=90=A6=E6=B6=9B?= Date: Wed, 8 Mar 2023 15:46:14 +0800 Subject: [PATCH] =?UTF-8?q?=E3=80=90fix=20sonar=E3=80=91SqlInjectionUtil?= =?UTF-8?q?=E6=96=87=E4=BB=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../jero/common/util/SqlInjectionUtil.java | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java index 5fe64902..ceb6a6d2 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java @@ -73,11 +73,11 @@ public class SqlInjectionUtil { if (value.indexOf(xssArr[i]) > -1) { log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_VALUE_INJECTION_CONSTANT, value); - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } @@ -98,14 +98,14 @@ public class SqlInjectionUtil { value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { - if (value.indexOf(xssArr[i]) > -1) { + if (value.contains(xssArr[i])) { log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_VALUE_INJECTION_CONSTANT, value); - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } } @@ -113,6 +113,7 @@ public class SqlInjectionUtil { /** * @特殊方法(不通用) 仅用于字典条件SQL参数，注入过滤 * @param value + * @deprecated 不推荐 * @return */ @Deprecated @@ -127,14 +128,14 @@ public class SqlInjectionUtil { value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { - if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { + if (value.contains(xssArr[i]) || value.startsWith(xssArr[i].trim())) { log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_VALUE_INJECTION_CONSTANT, value); - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } @@ -155,14 +156,14 @@ public class SqlInjectionUtil { value = value.replaceAll(SYMBOL_CONSTANT,""); for (int i = 0; i < xssArr.length; i++) { - if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { + if (value.contains(xssArr[i]) || value.startsWith(xssArr[i].trim())) { log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_VALUE_INJECTION_CONSTANT, value); - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } } if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ - throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); + throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value); } }