From 34aa5fe0742b43dcc2e520ca248d52058d5c13a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=A2=81=E7=90=A6=E6=B6=9B?= <liangqitao@syxysoft.com>
Date: Tue, 24 Sep 2024 18:29:43 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9sql=E6=B3=A8=E5=85=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../impl/FileSplitItemsEOServiceImpl.java     | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/laws-modules/src/main/java/com/jero/modules/split/service/impl/FileSplitItemsEOServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/split/service/impl/FileSplitItemsEOServiceImpl.java
index 9bf1b681..b7aaeb73 100644
--- a/laws-modules/src/main/java/com/jero/modules/split/service/impl/FileSplitItemsEOServiceImpl.java
+++ b/laws-modules/src/main/java/com/jero/modules/split/service/impl/FileSplitItemsEOServiceImpl.java
@@ -4635,11 +4635,31 @@ public class FileSplitItemsEOServiceImpl extends ServiceImpl<FileSplitItemsEOMap
         bis.close(); // 先开后关
     }
 
+    private void checkForSQLInjection(Map<String, Object> parameterMap) {
+        // 定义要检查的特殊字符
+        String[] specialCharacters = {"'", "\"", "\\", "<", ">", "&", "*", ";"};
+
+        for (Map.Entry<String, Object> entry : parameterMap.entrySet()) {
+            Object value = entry.getValue();
+
+            // 检查是否是字符串类型
+            if (value instanceof String) {
+                String strValue = (String) value;
+                // 检查是否包含特殊字符
+                for (String character : specialCharacters) {
+                    if (strValue.contains(character)) {
+                        throw new JeroBootException("输入字段中包含非法字符，请检查");
+                    }
+                }
+            }
+        }
+    }
     @Override
     public void exportSplitInfo(String cut, String idList, Map<String, Object> parameter,String exportName, HttpServletResponse response, HttpServletRequest request) {
         // 水平越权
         documentSplitService.isHorizontalOverstep(String.valueOf(parameter.get("info_id")));
-
+// 防止SQL注入
+        this.checkForSQLInjection(parameter);
         OutputStream os = null;
         OutputStream excelOS = null;
         HSSFWorkbook workbook = new HSSFWorkbook();