From 4c6457cf29676298e1c65f369f426197f1703634 Mon Sep 17 00:00:00 2001 From: Qiuyi LI Date: Wed, 28 Jun 2023 16:38:44 +0200 Subject: [PATCH] Fix: When checking SQL injections, make sure that the tested string's length also matches keyword's length, otherwise a perfectly normal table name "country" will be considered as SQL injection suspect because it starts with "count" --- .../src/main/java/org/jeecg/common/util/SqlInjectionUtil.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java b/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java index 604c6de43..2b55c2cd7 100644 --- a/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java +++ b/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java @@ -180,7 +180,7 @@ public class SqlInjectionUtil { //value = value.replaceAll("/\\*.*\\*/",""); for (int i = 0; i < xssArr.length; i++) { - if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { + if ((value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) && value.length() == xssArr[i].trim().length()) { log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); log.error("请注意，值可能存在SQL注入风险!---> {}", value); throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value);