KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

【fix sonar】SqlInjectionUtil文件

Browse Source
This commit is contained in:
梁琦涛
2023-03-08 15:46:14 +08:00
parent 5b95b853f8
commit 5259f93356
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java
+12 -11
View File
@@ -73,11 +73,11 @@ public class SqlInjectionUtil {
if (value.indexOf(xssArr[i]) > -1) { if (value.indexOf(xssArr[i]) > -1) {
log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error(SQL_VALUE_INJECTION_CONSTANT, value); log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
@@ -98,14 +98,14 @@ public class SqlInjectionUtil {
value = value.replaceAll(SYMBOL_CONSTANT,""); value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) { for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1) { if (value.contains(xssArr[i])) {
log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error(SQL_VALUE_INJECTION_CONSTANT, value); log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
} }
@@ -113,6 +113,7 @@ public class SqlInjectionUtil {
/** /**
* @特殊方法(不通用) 仅用于字典条件SQL参数，注入过滤 * @特殊方法(不通用) 仅用于字典条件SQL参数，注入过滤
* @param value * @param value
* @deprecated 不推荐
* @return * @return
*/ */
@Deprecated @Deprecated
@@ -127,14 +128,14 @@ public class SqlInjectionUtil {
value = value.replaceAll(SYMBOL_CONSTANT,""); value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) { for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { if (value.contains(xssArr[i]) || value.startsWith(xssArr[i].trim())) {
log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error(SQL_VALUE_INJECTION_CONSTANT, value); log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
@@ -155,14 +156,14 @@ public class SqlInjectionUtil {
value = value.replaceAll(SYMBOL_CONSTANT,""); value = value.replaceAll(SYMBOL_CONSTANT,"");
for (int i = 0; i < xssArr.length; i++) { for (int i = 0; i < xssArr.length; i++) {
if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { if (value.contains(xssArr[i]) || value.startsWith(xssArr[i].trim())) {
log.error(SQL_INJECTION_CONSTANT, xssArr[i]); log.error(SQL_INJECTION_CONSTANT, xssArr[i]);
log.error(SQL_VALUE_INJECTION_CONSTANT, value); log.error(SQL_VALUE_INJECTION_CONSTANT, value);
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }
if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){ if(Pattern.matches(SHOW_S_TABLE_CONSTANT, value)){
throw new RuntimeException(SQL_VALUE_INJECTION_CONSTANT1 + value); throw new JeroBootException(SQL_VALUE_INJECTION_CONSTANT1 + value);
} }
} }