FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Server防SQL注入：编译模式下禁用key{}:"conditions"和@having:"conditions" · blackbin/APIJSON@75227ad · GitHub

/ APIJSON Public
forked from APIJSON/APIJSON

Commit 75227ad

Browse files
TommyLemon
committed
Server防SQL注入：编译模式下禁用key{}:"conditions"和@having:"conditions"
1 parent c6fbf36 commit 75227ad

5 files changed

Lines changed: 39 additions & 29 deletions

File tree

‎APIJSON-Java-Server/APIJSONDemo/src/main/java/apijson/demo/server/DemoSQLExecutor.java‎

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -73,30 +73,14 @@ private PreparedStatement getStatement(@NotNull SQLConfig config) throws Excepti
7373
+ config.getDBAccount() + "&password=" + config.getDBPassword());
7474
}
7575

76-
// statement = connection.prepareStatement("SELECT ?,? FROM sys.apijson_user WHERE sex=? AND id IN (?,?,?)"); //创建Statement对象
77-
//// Object[] values = config.getWhere().values().toArray();
78-
//// if (values != null && values.length > 0) {
79-
//// for (int i = 0; i < values.length; i++) {
80-
//// statement.setObject(i + 1, values[i]);
81-
//// }
82-
//// }
83-
//
84-
// statement.setObject(1, "id");
85-
// statement.setObject(2, "name");
86-
// statement.setObject(3, 0);
87-
// statement.setObject(4, 82001);
88-
// statement.setObject(5, 82002);
89-
// statement.setObject(6, 38710);
90-
91-
statement = connection.prepareStatement(config.getSQL(true)); //创建Statement对象
92-
List<Object> valueList = config.getPreparedValues();
76+
statement = connection.prepareStatement(config.getSQL(config.isPrepared())); //创建Statement对象
77+
List<Object> valueList = config.isPrepared() ? config.getPreparedValueList() : null;
9378
if (valueList != null && valueList.isEmpty() == false) {
9479
for (int i = 0; i < valueList.size(); i++) {
9580
statement.setString(i + 1, "" + valueList.get(i));
9681
}
9782
}
9883

99-
10084
return statement;
10185
}
10286

‎APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractParser.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -515,6 +515,7 @@ public JSONObject parseCorrectResponse(String table, JSONObject response) throws
515515
public JSONObject getStructure(@NotNull String table, String key, String value, int version) throws Exception {
516516
//获取指定的JSON结构 <<<<<<<<<<<<<<
517517
SQLConfig config = createSQLConfig().setMethod(GET).setTable(table);
518+
config.setPrepared(false);
518519
config.setColumn("structure");
519520

520521
Map<String, Object> where = new HashMap<String, Object>();

‎APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractSQLConfig.java‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public abstract class AbstractSQLConfig implements SQLConfig {
7979

8080
private long id; //Table的id
8181
private RequestMethod method; //操作方法
82-
private boolean prepared; //预编译
82+
private boolean prepared = true; //预编译
8383
/**
8484
* TODO 被关联的表通过就忽略关联的表？(这个不行 User:{"sex@":"/Comment/toId"})
8585
*/
@@ -132,11 +132,14 @@ public AbstractSQLConfig setMethod(RequestMethod method) {
132132
this.method = method;
133133
return this;
134134
}
135+
@Override
135136
public boolean isPrepared() {
136137
return prepared;
137138
}
138-
public void setPrepared(boolean prepared) {
139+
@Override
140+
public AbstractSQLConfig setPrepared(boolean prepared) {
139141
this.prepared = prepared;
142+
return this;
140143
}
141144

142145

@@ -248,7 +251,13 @@ public AbstractSQLConfig setHaving(String having) {
248251
@JSONField(serialize = false)
249252
public String getHavingString() {
250253
having = StringUtil.getTrimedString(having);
251-
return having.isEmpty() ? "" : " HAVING " + having;
254+
if(having.isEmpty()) {
255+
return "";
256+
}
257+
if (isPrepared()) {
258+
throw new UnsupportedOperationException("预编译模式下不允许传 @having:\"condition\" !");
259+
}
260+
return " HAVING " + having;
252261
}
253262

254263
@Override
@@ -646,7 +655,7 @@ private Object getValue(@NotNull Object value) {
646655
return "'" + value + "'";
647656
}
648657
@Override
649-
public List<Object> getPreparedValues() {
658+
public List<Object> getPreparedValueList() {
650659
return preparedValues;
651660
}
652661

@@ -797,6 +806,11 @@ public String getRangeString(String key, Object range) throws Exception {
797806
if (condition.isEmpty()) {
798807
return "";
799808
}
809+
810+
if (isPrepared()) {
811+
throw new UnsupportedOperationException("预编译模式下不允许传 key{}:\"condition\" !");
812+
}
813+
800814
return getCondition(logic.isNot(), condition);
801815
}
802816

@@ -999,8 +1013,7 @@ public static String getRemoveString(String key, Object value) throws IllegalArg
9991013
@JSONField(serialize = false)
10001014
@Override
10011015
public String getSQL(boolean prepared) throws Exception {
1002-
setPrepared(prepared);
1003-
return getSQL(this);
1016+
return getSQL(this.setPrepared(prepared));
10041017
}
10051018
/**
10061019
* @param config

‎APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractSQLExecutor.java‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,10 +113,18 @@ public void close() {
113113
*/
114114
@Override
115115
public JSONObject execute(SQLConfig config) throws Exception {
116-
117-
final String sql = config == null ? null : config.getSQL(false);
116+
if (config == null) {
117+
Log.e(TAG, "select config==null >> return null;");
118+
return null;
119+
}
120+
boolean prepared = config.isPrepared();
121+
122+
final String sql = config.getSQL(false);
123+
124+
config.setPrepared(prepared);
125+
118126
if (StringUtil.isNotEmpty(sql, true) == false) {
119-
Log.e(TAG, "select config==null||StringUtil.isNotEmpty(config.getSQLTable(), true)==false>>return null;");
127+
Log.e(TAG, "select StringUtil.isNotEmpty(sql, true) == false >> return null;");
120128
return null;
121129
}
122130
JSONObject result = null;

‎APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/SQLConfig.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ public interface SQLConfig {
5252
* @return
5353
* @throws Exception
5454
*/
55-
String getSQL(boolean isPrepared) throws Exception;
55+
String getSQL(boolean prepared) throws Exception;
5656

5757

5858

@@ -154,5 +154,9 @@ public interface SQLConfig {
154154
SQLConfig putWhere(String key, Object value);
155155

156156

157-
List<Object> getPreparedValues();
157+
boolean isPrepared();
158+
159+
AbstractSQLConfig setPrepared(boolean prepared);
160+
161+
List<Object> getPreparedValueList();
158162
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL