From 7c587cd05145dbffda32d8962bd30307799c1f22 Mon Sep 17 00:00:00 2001
From: caihaohan <caihaohan0712@foxmail.com>
Date: Wed, 28 Feb 2024 09:10:38 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20getCommonPage=E6=8E=A5=E5=8F=A3?=
 =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E9=98=B2sql=E6=B3=A8=E5=85=A5=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../service/impl/LawsCommonServiceImpl.java   | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java
index 7e2ade68..4703ab1c 100644
--- a/laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java
+++ b/laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java
@@ -2002,12 +2002,35 @@ public class LawsCommonServiceImpl implements ILawsCommonService {
         return selectFieldBuilder.toString();
     }
 
+    private void checkForSQLInjection(Map<String, Object> parameterMap) {
+        // 定义要检查的特殊字符
+        String[] specialCharacters = {"'", "\"", "\\", "<", ">", "&", "*", ";"};
+
+        for (Map.Entry<String, Object> entry : parameterMap.entrySet()) {
+            Object value = entry.getValue();
+
+            // 检查是否是字符串类型
+            if (value instanceof String) {
+                String strValue = (String) value;
+                // 检查是否包含特殊字符
+                for (String character : specialCharacters) {
+                    if (strValue.contains(character)) {
+                        throw new JeroBootException("输入字段中包含非法字符，请检查");
+                    }
+                }
+            }
+        }
+    }
+
     /**
      * @Author: liao
      * @Date: 2023/8/23 17:16
      * @Description: 封装查询条件
      **/
     private String getSelectCondition(Map<String, Object> parameterMap, List<LawsTag> fieldList) {
+        // 防止SQL注入
+        this.checkForSQLInjection(parameterMap);
+
         String module = (String) parameterMap.get("module");
         // 获取要操作的表名
         String tableName = TableNameEnum.getTableName(module);