diff --git a/laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java b/laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java index 14258a40..fe453fce 100644 --- a/laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java +++ b/laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java @@ -6,8 +6,14 @@ package com.jero.config.filter.xss; import com.jero.common.exception.JeroBootException; +import org.apache.commons.collections4.CollectionUtils; import org.apache.commons.lang3.StringUtils; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; +import java.util.concurrent.CopyOnWriteArrayList; + public class SqlFilter { private SqlFilter(){ @@ -19,19 +25,22 @@ public class SqlFilter { } else { str = StringUtils.replace(str, "\\n", "Line_Break"); String[] keywords = new String[]{"truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"}; - String[] var2 = keywords; - int var3 = keywords.length; - for(int var4 = 0; var4 < var3; ++var4) { - String keyword = var2[var4]; - int index = StringUtils.indexOfIgnoreCase(str, keyword + " "); + List list = Arrays.asList(keywords); + String finalStr = str; + List listErr = new CopyOnWriteArrayList<>(); + list.parallelStream().forEach(p->{ + int index = StringUtils.indexOfIgnoreCase(finalStr, p + " "); if (index != -1) { // 判断是否是条款内容 - if (str.contains("itemContent") || str.contains("item_content")){ - break; + if (finalStr.contains("itemContent") || finalStr.contains("item_content")){ + return; } - throw new JeroBootException("包含非法字符"); + listErr.add("1"); } + }); + if(!CollectionUtils.isEmpty(listErr)){ + throw new JeroBootException("包含非法字符"); } str = StringUtils.replace(str, "Line_Break", "\\n"); return str;