feat: getCommonPage接口增加防sql注入校验

2024-02-28 09:10:55 +08:00
parent ec4249e1a3
commit 7c587cd051
1 changed files with 23 additions and 0 deletions
@@ -2002,12 +2002,35 @@ public class LawsCommonServiceImpl implements ILawsCommonService {
        return selectFieldBuilder.toString();
    }

+    private void checkForSQLInjection(Map<String, Object> parameterMap) {
+        // 定义要检查的特殊字符
+        String[] specialCharacters = {"'", "\"", "\\", "<", ">", "&", "*", ";"};
+
+        for (Map.Entry<String, Object> entry : parameterMap.entrySet()) {
+            Object value = entry.getValue();
+
+            // 检查是否是字符串类型
+            if (value instanceof String) {
+                String strValue = (String) value;
+                // 检查是否包含特殊字符
+                for (String character : specialCharacters) {
+                    if (strValue.contains(character)) {
+                        throw new JeroBootException("输入字段中包含非法字符，请检查");
+                    }
+                }
+            }
+        }
+    }
+
    /**
     * @Author: liao
     * @Date: 2023/8/23 17:16
     * @Description: 封装查询条件
     **/
    private String getSelectCondition(Map<String, Object> parameterMap, List<LawsTag> fieldList) {
+        // 防止SQL注入
+        this.checkForSQLInjection(parameterMap);
+
        String module = (String) parameterMap.get("module");
        // 获取要操作的表名
        String tableName = TableNameEnum.getTableName(module);