hhyykk/RuoYi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

代码生成创建表检查关键字，防止注入风险

Browse Source
This commit is contained in:
RuoYi
2021-12-21 13:21:03 +08:00
parent c78758e32d
commit 452da5caeb
4 changed files with 49 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
ruoyi-generator/src/main/java/com/ruoyi/generator/controller/GenController.java
View File

@ -31,6 +31,7 @@ import com.ruoyi.common.core.text.Convert;
import com.ruoyi.common.enums.BusinessType;
import com.ruoyi.common.utils.StringUtils;
import com.ruoyi.common.utils.security.PermissionUtils;
import com.ruoyi.common.utils.sql.SqlUtil;
import com.ruoyi.generator.domain.GenTable;
import com.ruoyi.generator.domain.GenTableColumn;
import com.ruoyi.generator.service.IGenTableColumnService;
@ -196,31 +197,33 @@ public class GenController extends BaseController
@ResponseBody
public AjaxResult create(String sql)
{
List<SQLStatement> sqlStatements = SQLUtils.parseStatements(sql, DbType.mysql);
List<String> tableNames = new ArrayList<>();
for (SQLStatement sqlStatement : sqlStatements)
try
{
if (sqlStatement instanceof MySqlCreateTableStatement)
SqlUtil.filterKeyword(sql);
List<SQLStatement> sqlStatements = SQLUtils.parseStatements(sql, DbType.mysql);
List<String> tableNames = new ArrayList<>();
for (SQLStatement sqlStatement : sqlStatements)
{
MySqlCreateTableStatement createTableStatement = (MySqlCreateTableStatement) sqlStatement;
String tableName = createTableStatement.getTableName();
tableName = tableName.replaceAll("`", "");
int msg = genTableService.createTable(createTableStatement.toString());
if (msg == 0)
if (sqlStatement instanceof MySqlCreateTableStatement)
{
tableNames.add(tableName);
MySqlCreateTableStatement createTableStatement = (MySqlCreateTableStatement) sqlStatement;
if (genTableService.createTable(createTableStatement.toString()))
{
String tableName = createTableStatement.getTableName().replaceAll("`", "");
tableNames.add(tableName);
}
}
}
else
{
return AjaxResult.error("请输入建表语句");
}
List<GenTable> tableList = genTableService.selectDbTableListByNames(tableNames.toArray(new String[tableNames.size()]));
String operName = Convert.toStr(PermissionUtils.getPrincipalProperty("loginName"));
genTableService.importGenTable(tableList, operName);
return AjaxResult.success();
}
catch (Exception e)
{
logger.error(e.getMessage(), e);
return AjaxResult.error("创建表结构异常" + e.getMessage());
}
List<GenTable> tableList = genTableService.selectDbTableListByNames((tableNames.toArray(new String[tableNames.size()])));
String operName = Convert.toStr(PermissionUtils.getPrincipalProperty("loginName"));
genTableService.importGenTable(tableList, operName);
return AjaxResult.success();
}
/**

2
ruoyi-generator/src/main/java/com/ruoyi/generator/service/IGenTableService.java
View File

@ -72,7 +72,7 @@ public interface IGenTableService
* @param sql 创建表语句
* @return 结果
*/
public int createTable(String sql);
public boolean createTable(String sql);
/**
* 导入表结构

4
ruoyi-generator/src/main/java/com/ruoyi/generator/service/impl/GenTableServiceImpl.java
View File

@ -157,9 +157,9 @@ public class GenTableServiceImpl implements IGenTableService
* @return 结果
*/
@Override
public int createTable(String sql)
public boolean createTable(String sql)
{
return genTableMapper.createTable(sql);
return genTableMapper.createTable(sql) == 0;
}
/**