fix 由于有sql注入风险 重复校验接口增加混淆表
This commit is contained in:
lijiarao
+31
-9
@@ -1,13 +1,18 @@
|
||||
package com.jero.modules.system.controller;
|
||||
|
||||
import javax.annotation.Resource;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
|
||||
import cn.hutool.core.util.StrUtil;
|
||||
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
|
||||
import com.jero.common.api.vo.Result;
|
||||
import com.jero.common.util.PasswordUtil;
|
||||
import org.apache.commons.lang3.StringUtils;
|
||||
import com.jero.common.util.SqlInjectionUtil;
|
||||
import com.jero.modules.system.entity.SysConfusion;
|
||||
import com.jero.modules.system.mapper.SysConfusionMapper;
|
||||
import com.jero.modules.system.mapper.SysDictMapper;
|
||||
import com.jero.modules.system.model.DuplicateCheckVo;
|
||||
import org.apache.commons.lang.StringUtils;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.web.bind.annotation.GetMapping;
|
||||
import org.springframework.web.bind.annotation.RequestMapping;
|
||||
@@ -30,9 +35,12 @@ import lombok.extern.slf4j.Slf4j;
|
||||
@Api(tags="重复校验")
|
||||
public class DuplicateCheckController {
|
||||
|
||||
@Autowired
|
||||
@Resource
|
||||
SysDictMapper sysDictMapper;
|
||||
|
||||
@Resource
|
||||
SysConfusionMapper sysConfusionMapper;
|
||||
|
||||
/**
|
||||
* 校验数据是否在系统中是否存在
|
||||
*
|
||||
@@ -42,17 +50,20 @@ public class DuplicateCheckController {
|
||||
@ApiOperation("重复校验接口")
|
||||
public Result<Object> doDuplicateCheck(DuplicateCheckVo duplicateCheckVo, HttpServletRequest request) {
|
||||
Long num = null;
|
||||
SysConfusion sysConfusion = changeRealName(duplicateCheckVo.getConfusionCode());
|
||||
|
||||
log.info("----duplicate check------："+ duplicateCheckVo.toString());
|
||||
duplicateCheckVo.setTableName(sysConfusion.getTableName());
|
||||
duplicateCheckVo.setFieldName(sysConfusion.getFieldName());
|
||||
//如果加密字段有值，则把校验数据进行加密后在判断
|
||||
String encrypt = duplicateCheckVo.getEncrypt();
|
||||
if (StrUtil.isNotBlank(encrypt)){
|
||||
duplicateCheckVo.setFieldVal(PasswordUtil.encrypt(duplicateCheckVo.getFieldVal()));
|
||||
}
|
||||
log.info("----duplicate check------：" + duplicateCheckVo.toString());
|
||||
//关联表字典（举例：sys_user,realname,id）
|
||||
//SQL注入校验（只限制非法串改数据库）
|
||||
final String[] sqlInjCheck = {duplicateCheckVo.getTableName(),duplicateCheckVo.getFieldName()};
|
||||
final String[] sqlInjCheck = {duplicateCheckVo.getTableName(), duplicateCheckVo.getFieldName()};
|
||||
SqlInjectionUtil.filterContent(sqlInjCheck);
|
||||
if ("phone".equals(duplicateCheckVo.getFieldName())) {
|
||||
if (StringUtils.isNotBlank(duplicateCheckVo.getFieldVal())) {
|
||||
duplicateCheckVo.setFieldVal(PasswordUtil.encrypt(duplicateCheckVo.getFieldVal()));
|
||||
}
|
||||
}
|
||||
if (StringUtils.isNotBlank(duplicateCheckVo.getDataId())) {
|
||||
// [2].编辑页面校验
|
||||
num = sysDictMapper.duplicateCheckCountSql(duplicateCheckVo);
|
||||
@@ -70,4 +81,15 @@ public class DuplicateCheckController {
|
||||
return Result.error("该值不可用，系统中已存在！");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 根据混淆code转换为真实表名和字段名
|
||||
*
|
||||
* @param confusionCode 混淆code
|
||||
* @return 真实表名和字段名
|
||||
*/
|
||||
private SysConfusion changeRealName(String confusionCode) {
|
||||
SysConfusion sysConfusion = sysConfusionMapper.selectOne(new QueryWrapper<SysConfusion>().lambda().eq(SysConfusion::getConfusionCode, confusionCode));
|
||||
return sysConfusion;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,102 @@
|
||||
package com.jero.modules.system.entity;
|
||||
|
||||
import com.baomidou.mybatisplus.annotation.IdType;
|
||||
import com.baomidou.mybatisplus.annotation.TableId;
|
||||
import com.baomidou.mybatisplus.annotation.TableName;
|
||||
import com.fasterxml.jackson.annotation.JsonFormat;
|
||||
import com.fasterxml.jackson.databind.annotation.JsonSerialize;
|
||||
import com.fasterxml.jackson.datatype.jsr310.ser.LocalDateTimeSerializer;
|
||||
import io.swagger.annotations.ApiModel;
|
||||
import io.swagger.annotations.ApiModelProperty;
|
||||
import lombok.Data;
|
||||
import lombok.EqualsAndHashCode;
|
||||
import lombok.experimental.Accessors;
|
||||
import org.jeecgframework.poi.excel.annotation.Excel;
|
||||
import org.springframework.format.annotation.DateTimeFormat;
|
||||
|
||||
import java.io.Serializable;
|
||||
import java.time.LocalDateTime;
|
||||
|
||||
|
||||
/**
|
||||
* @Description: 混淆表
|
||||
* @Author: jero-boot
|
||||
* @Date: 2021-08-05
|
||||
* @Version: V1.0
|
||||
*/
|
||||
@Data
|
||||
@TableName("sys_confusion")
|
||||
@Accessors(chain = true)
|
||||
@EqualsAndHashCode(callSuper = false)
|
||||
@ApiModel(value = "sys_confusion对象", description = "混淆表")
|
||||
public class SysConfusion implements Serializable {
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
/**
|
||||
* 主键
|
||||
*/
|
||||
@TableId(type = IdType.ASSIGN_ID)
|
||||
@ApiModelProperty(value = "主键")
|
||||
private String id;
|
||||
|
||||
/**
|
||||
* 创建人
|
||||
*/
|
||||
|
||||
@ApiModelProperty(value = "创建人")
|
||||
private String createBy;
|
||||
|
||||
/**
|
||||
* 创建日期
|
||||
*/
|
||||
@JsonFormat(timezone = "GMT+8", pattern = "yyyy-MM-dd HH:mm:ss")
|
||||
@JsonSerialize(using = LocalDateTimeSerializer.class)
|
||||
@DateTimeFormat(pattern = "yyyy-MM-dd HH:mm:ss")
|
||||
@ApiModelProperty(value = "创建日期")
|
||||
private LocalDateTime createTime;
|
||||
|
||||
/**
|
||||
* 更新人
|
||||
*/
|
||||
|
||||
@ApiModelProperty(value = "更新人")
|
||||
private String updateBy;
|
||||
|
||||
/**
|
||||
* 更新日期
|
||||
*/
|
||||
@JsonFormat(timezone = "GMT+8", pattern = "yyyy-MM-dd HH:mm:ss")
|
||||
@JsonSerialize(using = LocalDateTimeSerializer.class)
|
||||
@DateTimeFormat(pattern = "yyyy-MM-dd HH:mm:ss")
|
||||
@ApiModelProperty(value = "更新日期")
|
||||
private LocalDateTime updateTime;
|
||||
|
||||
/**
|
||||
* 所属部门
|
||||
*/
|
||||
|
||||
@ApiModelProperty(value = "所属部门")
|
||||
private String sysOrgCode;
|
||||
|
||||
/**
|
||||
* 混淆类型
|
||||
*/
|
||||
@Excel(name = "表名", width = 15)
|
||||
@ApiModelProperty(value = "表名")
|
||||
private String tableName;
|
||||
|
||||
/**
|
||||
* 表名或字段名
|
||||
*/
|
||||
@Excel(name = "字段名", width = 15)
|
||||
@ApiModelProperty(value = "字段名")
|
||||
private String fieldName;
|
||||
|
||||
/**
|
||||
* 混淆code
|
||||
*/
|
||||
@Excel(name = "混淆code", width = 15)
|
||||
@ApiModelProperty(value = "混淆code")
|
||||
private String confusionCode;
|
||||
|
||||
}
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
package com.jero.modules.system.mapper;
|
||||
|
||||
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
|
||||
import com.jero.modules.system.entity.SysConfusion;
|
||||
|
||||
/**
|
||||
* @Description: 混淆表
|
||||
* @Author: jero-boot
|
||||
* @Date: 2021-08-05
|
||||
* @Version: V1.0
|
||||
*/
|
||||
public interface SysConfusionMapper extends BaseMapper<SysConfusion> {
|
||||
|
||||
}
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
|
||||
<mapper namespace="com.jero.modules.system.mapper.SysConfusionMapper">
|
||||
<resultMap id="SysConfusionResultMap" type="com.jero.modules.system.entity.SysConfusion">
|
||||
<id column="id" property="id" />
|
||||
<result column="create_by" property="createBy" />
|
||||
<result column="create_time" property="createTime" />
|
||||
<result column="update_by" property="updateBy" />
|
||||
<result column="update_time" property="updateTime" />
|
||||
<result column="sys_org_code" property="sysOrgCode" />
|
||||
<result column="table_name" property="tableName" />
|
||||
<result column="field_name" property="fieldName" />
|
||||
<result column="confusion_code" property="confusionCode" />
|
||||
</resultMap>
|
||||
</mapper>
|
||||
@@ -5,6 +5,8 @@ import io.swagger.annotations.ApiModel;
|
||||
import io.swagger.annotations.ApiModelProperty;
|
||||
import lombok.Data;
|
||||
|
||||
import javax.validation.constraints.NotBlank;
|
||||
|
||||
/**
|
||||
* @Title: DuplicateCheckVo
|
||||
* @Description: 重复校验VO
|
||||
@@ -16,6 +18,12 @@ import lombok.Data;
|
||||
@ApiModel(value="重复校验数据模型",description="重复校验数据模型")
|
||||
public class DuplicateCheckVo implements Serializable {
|
||||
private static final long serialVersionUID = 1L;
|
||||
/**
|
||||
* 表名
|
||||
*/
|
||||
@NotBlank(message = "混淆code不能为空")
|
||||
@ApiModelProperty(value="混淆code",name="confusionCode",example="id")
|
||||
private String confusionCode;
|
||||
|
||||
/**
|
||||
* 表名
|
||||
@@ -41,4 +49,10 @@ public class DuplicateCheckVo implements Serializable {
|
||||
@ApiModelProperty(value="数据ID",name="dataId",example="2000")
|
||||
private String dataId;
|
||||
|
||||
/**
|
||||
* 是否加密
|
||||
*/
|
||||
@ApiModelProperty(value="是否加密",name="encrypt")
|
||||
private String encrypt;
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user