perf: sqlInject性能优化

laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java

@@ -6,13 +6,9 @@
 package com.jero.config.filter.xss;
 
 import com.jero.common.exception.JeroBootException;
-import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.regex.Pattern;
 
 public class SqlFilter {
     private SqlFilter(){
@@ -20,25 +16,19 @@ public class SqlFilter {
     }
 
     public static String sqlInject(String str) {
-        if (StringUtils.isBlank(str) || str.contains("itemContent") || str.contains("item_content")){
+        if (StringUtils.isBlank(str)) {
             return null;
-        } else {
-            str = StringUtils.replace(str, "\\n", "Line_Break");
-            String[] keywords = new String[]{"truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"};
+        }
 
-            List<String> list = Arrays.asList(keywords);
-            String finalStr = str;
-            List<String> listErr = new CopyOnWriteArrayList<>();
-            list.parallelStream().forEach(p->{
-                if (StringUtils.indexOfIgnoreCase(finalStr, p + " ") != -1) {
-                    listErr.add("1");
-                }
-            });
-            if(!CollectionUtils.isEmpty(listErr)){
-                throw new JeroBootException("包含非法字符");
-            }
-            str = StringUtils.replace(str, "Line_Break", "\\n");
+        if (str.contains("itemContent") || str.contains("item_content")) {
             return str;
         }
+
+        Pattern pattern = Pattern.compile("\\b(truncate |insert |select |delete |update |declare |alter |drop )\\b", Pattern.CASE_INSENSITIVE);
+        if (pattern.matcher(str).find()) {
+            throw new JeroBootException("包含非法字符");
+        }
+
+        return str;
     }
 }