标题检索修改sql注入
This commit is contained in:
梁琦涛
+51
-48
@@ -222,46 +222,49 @@ public class LawsHomeSearchServiceImpl implements ILawsHomeSearchService {
|
||||
private QueryWrapper<LawsHomeNormalSearchDTO> getQueryWrapperNormal(LawsHomeNormalSearchDTO lawsHomeNormalSearchDTO) {
|
||||
String[] searchContent = lawsHomeNormalSearchDTO.getSearchContent().split(BLANK_SPACE);
|
||||
searchContent = Arrays.stream(searchContent).distinct().toArray(String[]::new);
|
||||
StringBuilder regexp = new StringBuilder();
|
||||
StringBuilder re = new StringBuilder();
|
||||
StringBuilder select = new StringBuilder();
|
||||
select.append("( ");
|
||||
for (int i = 0; i < searchContent.length; i++) {
|
||||
regexp.append(searchContent[i]);
|
||||
StringBuilder ss = new StringBuilder();
|
||||
if(isNumericAndAlphabetic(searchContent[i])){
|
||||
// 英文 数字
|
||||
replaceLength(searchContent, i, ss, " ");
|
||||
}else{
|
||||
// 中文
|
||||
replaceLength(searchContent, i, ss, " ");
|
||||
ss.append(" ");
|
||||
}
|
||||
String str = ss.toString();
|
||||
select.append(" ABS(LENGTH(standard_name) - LENGTH(REPLACE(standard_name, '").append(searchContent[i])
|
||||
.append("',").append(" '").append(str).append("'))) ");
|
||||
if(i != searchContent.length - 1){
|
||||
regexp.append("|");
|
||||
select.append("+");
|
||||
}
|
||||
}
|
||||
select.append(") as sort_index");
|
||||
QueryWrapper<LawsHomeNormalSearchDTO> queryWrapper = new QueryWrapper<>();
|
||||
select.append("( ");
|
||||
String[] finalSearchContent = searchContent;
|
||||
queryWrapper.and(o->{
|
||||
for (int i = 0; i < finalSearchContent.length; i++) {
|
||||
o.like("standard_name",finalSearchContent[i]);
|
||||
re.append(finalSearchContent[i]);
|
||||
StringBuilder ss = new StringBuilder();
|
||||
if(isNumericAndAlphabetic(finalSearchContent[i])){
|
||||
// 英文 数字
|
||||
replaceLength(finalSearchContent, i, ss, " ");
|
||||
}else{
|
||||
// 中文
|
||||
replaceLength(finalSearchContent, i, ss, " ");
|
||||
ss.append(" ");
|
||||
}
|
||||
String str = ss.toString();
|
||||
select.append(" ABS(LENGTH(standard_name) - LENGTH(REPLACE(standard_name, '").append(finalSearchContent[i])
|
||||
.append("',").append(" '").append(str).append("'))) ");
|
||||
if(i != finalSearchContent.length - 1){
|
||||
o.or();
|
||||
select.append("+");
|
||||
}
|
||||
}
|
||||
});
|
||||
select.append(") as sort_index");
|
||||
|
||||
queryWrapper.select("id,standard_name,resource_type," +
|
||||
"create_time,standard_type_order,standard_state_order,standard_class," +
|
||||
"dynamic_type,applicable_vehicle," +
|
||||
"standard_state,standard_code,grade_classification,implementation_date, " + select);
|
||||
|
||||
queryWrapper.and(s->s.apply("standard_name REGEXP '" + regexp.toString() + "'"));
|
||||
queryWrapper.eq(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getResourceType()),RESOURCE_TYPE,lawsHomeNormalSearchDTO.getResourceType());
|
||||
String str = "',','))";
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardClass()),"instr(concat(',',standard_class,','),concat(',','" + lawsHomeNormalSearchDTO.getStandardClass() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getDynamicType()),"instr(concat(',',dynamic_type,','),concat(',','" + lawsHomeNormalSearchDTO.getDynamicType() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getApplicableVehicle()),"instr(concat(',',applicable_vehicle,','),concat(',','" + lawsHomeNormalSearchDTO.getApplicableVehicle() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardProperty()),"instr(concat(',',type,','),concat(',','" + lawsHomeNormalSearchDTO.getStandardProperty() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardState()),"instr(concat(',',standard_state,','), concat(',','" + lawsHomeNormalSearchDTO.getStandardState() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getCategoryCode()),"instr(concat(',',category_code,','),concat(',','" + lawsHomeNormalSearchDTO.getCategoryCode() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getEnterpriseStandardState()),"instr(concat(',',standard_state,','), concat(',','" + lawsHomeNormalSearchDTO.getEnterpriseStandardState() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getApplicableMarket()),"instr(concat(',',applicable_market,','),concat(',','" + lawsHomeNormalSearchDTO.getApplicableMarket() + str,0);
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardClass()),"concat(',',standard_class,',')","," + lawsHomeNormalSearchDTO.getStandardClass() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getDynamicType()),"concat(',',dynamic_type,',')","," + lawsHomeNormalSearchDTO.getDynamicType() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getApplicableVehicle()),"concat(',',applicable_vehicle,',')","," + lawsHomeNormalSearchDTO.getApplicableVehicle() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardProperty()),"concat(',',type,',')","," + lawsHomeNormalSearchDTO.getStandardProperty() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardState()),"concat(',',standard_state,',')", "," + lawsHomeNormalSearchDTO.getStandardState() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getCategoryCode()),"concat(',',category_code,',')","," + lawsHomeNormalSearchDTO.getCategoryCode() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getEnterpriseStandardState()),"concat(',',standard_state,',')","," + lawsHomeNormalSearchDTO.getEnterpriseStandardState() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getApplicableMarket()),"concat(',',applicable_market,',')","," + lawsHomeNormalSearchDTO.getApplicableMarket() + ",");
|
||||
return queryWrapper;
|
||||
}
|
||||
|
||||
@@ -501,25 +504,25 @@ public class LawsHomeSearchServiceImpl implements ILawsHomeSearchService {
|
||||
QueryWrapper<LawsHomeNormalSearchDTO> queryWrapper = new QueryWrapper<>();
|
||||
String[] text = searchContent.split(BLANK_SPACE);
|
||||
|
||||
StringBuilder regexp = new StringBuilder();
|
||||
for (int i = 0; i < text.length; i++) {
|
||||
regexp.append(text[i]);
|
||||
if(i != text.length - 1){
|
||||
regexp.append("|");
|
||||
queryWrapper.and(o->{
|
||||
for (int i = 0; i < text.length; i++) {
|
||||
o.like("CONCAT_WS(' ',standard_number,standard_name)",text[i]);
|
||||
if(i != text.length - 1){
|
||||
o.or();
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
queryWrapper.and(s->s.apply("CONCAT_WS(' ',standard_number,standard_name) REGEXP '" + regexp + "'"));
|
||||
queryWrapper.eq("del_flag",0);
|
||||
String str = "',','))";
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardClass()),"instr(concat(',',standard_class,','),concat(',','" + lawsHomeNormalSearchDTO.getStandardClass() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getDynamicType()),"instr(concat(',',dynamic_type,','),concat(',','" + lawsHomeNormalSearchDTO.getDynamicType() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getApplicableVehicle()),"instr(concat(',',applicable_vehicle,','),concat(',','" + lawsHomeNormalSearchDTO.getApplicableVehicle() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardProperty()),"instr(concat(',',type,','),concat(',','" + lawsHomeNormalSearchDTO.getStandardProperty() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardState()),"instr(concat(',',standard_state,','),concat(',','" + lawsHomeNormalSearchDTO.getStandardState() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getCategoryCode()),"instr(concat(',',category_code,','),concat(',','" + lawsHomeNormalSearchDTO.getCategoryCode() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getEnterpriseStandardState()),"instr(concat(',',standard_state,','),concat(',','" + lawsHomeNormalSearchDTO.getEnterpriseStandardState() + str,0);
|
||||
queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getApplicableMarket()),"instr(concat(',',applicable_market,','),concat(',','" + lawsHomeNormalSearchDTO.getApplicableMarket() + str,0);
|
||||
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardClass()),"concat(',',standard_class,',')","," + lawsHomeNormalSearchDTO.getStandardClass() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getDynamicType()),"concat(',',dynamic_type,',')","," + lawsHomeNormalSearchDTO.getDynamicType() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getApplicableVehicle()),"concat(',',applicable_vehicle,',')","," + lawsHomeNormalSearchDTO.getApplicableVehicle() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardProperty()),"concat(',',type,',')","," + lawsHomeNormalSearchDTO.getStandardProperty() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getStandardState()),"concat(',',standard_state,',')","," + lawsHomeNormalSearchDTO.getStandardState() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getCategoryCode()),"concat(',',category_code,',')","," + lawsHomeNormalSearchDTO.getCategoryCode() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getEnterpriseStandardState()),"concat(',',standard_state,',')","," + lawsHomeNormalSearchDTO.getEnterpriseStandardState() + ",");
|
||||
queryWrapper.like(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getApplicableMarket()),"concat(',',applicable_market,',')","," + lawsHomeNormalSearchDTO.getApplicableMarket() + ",");
|
||||
// queryWrapper.gt(!StringUtils.isEmpty(lawsHomeNormalSearchDTO.getGradeClassification()),"instr(concat(',',grade_classification,','),concat(',','" + lawsHomeNormalSearchDTO.getGradeClassification() + str,0);
|
||||
|
||||
switch (lawsHomeNormalSearchDTO.getResourceType()){
|
||||
|
||||
Reference in New Issue
Block a user