From af0e0a110e7187bf008655f7510199a0c0b25ec4 Mon Sep 17 00:00:00 2001
From: Nymph2333 <498092988@qq.com>
Date: 星期一, 10 四月 2023 14:27:40 +0800
Subject: [PATCH] newInstance() 已弃用,使用clazz.getDeclaredConstructor().newInstance() This method propagates any exception thrown by the nullary constructor, including a checked exception. Use of this method effectively bypasses the compile-time exception checking that would otherwise be performed by the compiler. The Constructor.newInstance method avoids this problem by wrapping any exception thrown by the constructor in a (checked) InvocationTargetException. The call clazz.newInstance() can be replaced by clazz.getDeclaredConstructor().newInstance() The latter sequence of calls is inferred to be able to throw the additional exception types InvocationTargetException and NoSuchMethodException. Both of these exception types are subclasses of ReflectiveOperationException.
---
ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java | 28 ++++++++++++++++++++++++++--
1 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java b/ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java
index 39e88ef..40a800d 100644
--- a/ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java
+++ b/ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java
@@ -1,6 +1,6 @@
package com.ruoyi.common.utils.sql;
-import com.ruoyi.common.exception.BaseException;
+import com.ruoyi.common.exception.UtilException;
import com.ruoyi.common.utils.StringUtils;
/**
@@ -10,6 +10,11 @@
*/
public class SqlUtil
{
+ /**
+ * 定义常用的 sql关键字
+ */
+ public static String SQL_REGEX = "and |extractvalue|updatexml|exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |or |+|user()";
+
/**
* 仅支持字母、数字、下划线、空格、逗号、小数点（支持多个字段排序）
*/
@@ -22,7 +27,7 @@
{
if (StringUtils.isNotEmpty(value) && !isValidOrderBySql(value))
{
- throw new BaseException("参数不符合规范，不能进行查询");
+ throw new UtilException("参数不符合规范，不能进行查询");
}
return value;
}
@@ -34,4 +39,23 @@
{
return value.matches(SQL_PATTERN);
}
+
+ /**
+ * SQL关键字检查
+ */
+ public static void filterKeyword(String value)
+ {
+ if (StringUtils.isEmpty(value))
+ {
+ return;
+ }
+ String[] sqlKeywords = StringUtils.split(SQL_REGEX, "\\|");
+ for (String sqlKeyword : sqlKeywords)
+ {
+ if (StringUtils.indexOfIgnoreCase(value, sqlKeyword) > -1)
+ {
+ throw new UtilException("参数存在SQL注入风险");
+ }
+ }
+ }
}
--
Gitblit v1.9.2