SQL注入

ygtx-framework/src/main/java/com/ygtx/framework/config/SqlInjectionFilter.java

@@ -0,0 +1,41 @@
+package com.ygtx.framework.config;
+
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Map;
+
+@Component
+public class SqlInjectionFilter extends OncePerRequestFilter {
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request,
+                                    HttpServletResponse response,
+                                    FilterChain filterChain)
+            throws ServletException, IOException {
+
+        String[] sqlKeywords = {"select", "insert", "update", "delete",
+                "union", "case", "when", "sleep", "benchmark"};
+
+        // 检查请求参数
+        Map<String, String[]> params = request.getParameterMap();
+        for (String[] values : params.values()) {
+            for (String value : values) {
+                String lowerValue = value.toLowerCase();
+                for (String keyword : sqlKeywords) {
+                    if (lowerValue.contains(keyword + " ") ||
+                            lowerValue.contains("(" + keyword)) {
+                        throw new RuntimeException("参数异常");
+                    }
+                }
+            }
+        }
+
+        filterChain.doFilter(request, response);
+    }
+}

ygtx-gxt/src/main/java/com/ygtx/gxt/controller/mobile/GxtMobileOrderController.java

@@ -6,6 +6,7 @@ import com.ygtx.common.core.domain.AjaxResult;
 import com.ygtx.common.core.page.TableDataInfo;
 import com.ygtx.common.enums.BusinessType;
 import com.ygtx.common.utils.StringUtils;
+import com.ygtx.common.utils.sql.SqlUtil;
 import com.ygtx.gxt.domain.*;
 import com.ygtx.gxt.service.IGxtOrderMineService;
 import com.ygtx.gxt.service.IGxtOrderScoreService;
@@ -62,8 +63,10 @@ public class GxtMobileOrderController extends BaseController
     @GetMapping("/overdue")
     public TableDataInfo overdueList(GxtWorkOrder workOrder, @Param("keyword") String keyword)
     {
+        SqlUtil.filterKeyword(keyword);
         // 开启分页插件自动分页
         startPage();
+
         // 对 keyword 进行空格过滤处理
         if (keyword != null) {
             keyword = keyword.trim();
@@ -75,17 +78,17 @@ public class GxtMobileOrderController extends BaseController
 
         // 创建维修工单查询条件
         GxtRepairOrder repairOrder = new GxtRepairOrder();
-        
+
         // 设置超时条件参数
         Map<String, Object> params = new HashMap<>();
         params.put("overdueCondition", "overdue");
         repairOrder.setParams(params);
         workOrder.setParams(params);
         workOrder.setWorkOrderStatus("ignore");
-        
+
         // 从selectMobileUnionOrderList获取数据
         List<OrderScoreInfo> list = gxtOrderScoreService.selectMobileUnionOrderList(repairOrder, workOrder, keyword);
-        
+
         Date now = new Date();
         for (OrderScoreInfo order : list) {
             // 只处理维保工单（orderType == 2）
@@ -96,12 +99,12 @@ public class GxtMobileOrderController extends BaseController
                     // 计算超过的时间（按分钟计算）
                     long diffInMillis = now.getTime() - order.getUpdateTime().getTime();
                     long diffInMinutes = TimeUnit.MINUTES.convert(diffInMillis, TimeUnit.MILLISECONDS);
-                    
+
                     // 计算超时时间并格式化为X天X小时X分钟格式
                     long days = diffInMinutes / (24 * 60);
                     long hours = (diffInMinutes % (24 * 60)) / 60;
                     long minutes = diffInMinutes % 60;
-                    
+
                     StringBuilder remark = new StringBuilder("已超时");
                     if (days > 0) {
                         remark.append(days).append("天");
@@ -122,12 +125,12 @@ public class GxtMobileOrderController extends BaseController
                     // 计算超过的时间（按分钟计算）
                     long diffInMillis = now.getTime() - order.getUpdateTime().getTime();
                     long diffInMinutes = TimeUnit.MINUTES.convert(diffInMillis, TimeUnit.MILLISECONDS);
-                    
+
                     // 计算超时时间并格式化为X天X小时X分钟格式
                     long days = diffInMinutes / (24 * 60);
                     long hours = (diffInMinutes % (24 * 60)) / 60;
                     long minutes = diffInMinutes % 60;
-                    
+
                     StringBuilder remark = new StringBuilder("已超时");
                     if (days > 0) {
                         remark.append(days).append("天");
@@ -142,7 +145,7 @@ public class GxtMobileOrderController extends BaseController
                 }
             }
         }
-        
+
         return getDataTable(list);
     }
 
@@ -154,6 +157,7 @@ public class GxtMobileOrderController extends BaseController
     @GetMapping("/almostOverdue")
     public TableDataInfo almostOverdueList(GxtWorkOrder workOrder, @Param("keyword") String keyword)
     {
+        SqlUtil.filterKeyword(keyword);
         // 开启分页插件自动分页
         startPage();
         // 查询即将超时工单列表
@@ -163,12 +167,12 @@ public class GxtMobileOrderController extends BaseController
             if (order.getPlanEndTime() != null && order.getRealEndTime() == null) {
                 long diffInMillies = Math.abs(order.getPlanEndTime().getTime() - new Date().getTime());
                 long diffInMinutes = TimeUnit.MINUTES.convert(diffInMillies, TimeUnit.MILLISECONDS);
-                
+
                 // 将分钟数转换为X天X小时X分钟格式
                 long days = diffInMinutes / (24 * 60);
                 long hours = (diffInMinutes % (24 * 60)) / 60;
                 long minutes = diffInMinutes % 60;
-                
+
                 StringBuilder remark = new StringBuilder("剩余");
                 if (days > 0) {
                     remark.append(days).append("天");
@@ -196,6 +200,7 @@ public class GxtMobileOrderController extends BaseController
     @GetMapping("/list")
     public TableDataInfo list(GxtRepairOrder repairOrder, GxtWorkOrder workOrder, @Param("keyword") String keyword)
     {
+        SqlUtil.filterKeyword(keyword);
         // 开启分页插件自动分页
         startPage();
         // 对 keyword 进行空格过滤处理
@@ -370,6 +375,7 @@ public class GxtMobileOrderController extends BaseController
     @GetMapping("/pendingList")
     public TableDataInfo pendingList(GxtRepairOrder repairOrder, GxtWorkOrder workOrder, @Param("keyword") String keyword)
     {
+        SqlUtil.filterKeyword(keyword);
         // 开启分页插件自动分页
         startPage();
         // 对 keyword 进行空格过滤处理
@@ -394,6 +400,7 @@ public class GxtMobileOrderController extends BaseController
     @GetMapping("/listMyRate")
     public TableDataInfo listMyRate(GxtRepairOrder repairOrder, GxtWorkOrder workOrder, @Param("keyword") String keyword)
     {
+        SqlUtil.filterKeyword(keyword);
         // 开启分页插件自动分页
         startPage();
         // 对 keyword 进行空格过滤处理
@@ -434,4 +441,4 @@ public class GxtMobileOrderController extends BaseController
 
         return toAjax(result);
     }
-}
+}