From 21ab6fd609404732d4d80ba3a72e232b6102d1d1 Mon Sep 17 00:00:00 2001
From: caihaohan <caihaohan0712@foxmail.com>
Date: Wed, 21 Aug 2024 19:38:23 +0800
Subject: [PATCH] =?UTF-8?q?perf:=20sqlInject=E6=80=A7=E8=83=BD=E4=BC=98?=
 =?UTF-8?q?=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/jero/config/filter/xss/SqlFilter.java | 32 +++++++------------
 1 file changed, 11 insertions(+), 21 deletions(-)

diff --git a/laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java b/laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java
index ee985e1a..e71f5f1b 100644
--- a/laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java
+++ b/laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java
@@ -6,13 +6,9 @@
 package com.jero.config.filter.xss;
 
 import com.jero.common.exception.JeroBootException;
-import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.regex.Pattern;
 
 public class SqlFilter {
     private SqlFilter(){
@@ -20,25 +16,19 @@ public class SqlFilter {
     }
 
     public static String sqlInject(String str) {
-        if (StringUtils.isBlank(str) || str.contains("itemContent") || str.contains("item_content")){
+        if (StringUtils.isBlank(str)) {
             return null;
-        } else {
-            str = StringUtils.replace(str, "\\n", "Line_Break");
-            String[] keywords = new String[]{"truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"};
+        }
 
-            List<String> list = Arrays.asList(keywords);
-            String finalStr = str;
-            List<String> listErr = new CopyOnWriteArrayList<>();
-            list.parallelStream().forEach(p->{
-                if (StringUtils.indexOfIgnoreCase(finalStr, p + " ") != -1) {
-                    listErr.add("1");
-                }
-            });
-            if(!CollectionUtils.isEmpty(listErr)){
-                throw new JeroBootException("包含非法字符");
-            }
-            str = StringUtils.replace(str, "Line_Break", "\\n");
+        if (str.contains("itemContent") || str.contains("item_content")) {
             return str;
         }
+
+        Pattern pattern = Pattern.compile("\\b(truncate |insert |select |delete |update |declare |alter |drop )\\b", Pattern.CASE_INSENSITIVE);
+        if (pattern.matcher(str).find()) {
+            throw new JeroBootException("包含非法字符");
+        }
+
+        return str;
     }
 }