github
/
jeecg-boot
mirror of https://github.com/jeecgboot/jeecg-boot
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

【issues/4393】解决使用参数tableName=sys_user t&复测，漏洞仍然存在

pull/5216/merge
zhangdaiscott 2023-08-14 12:51:31 +08:00
parent 0bc7e0967d
commit 751b81c7bf
2 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java
View File

@ -1,6 +1,7 @@
package org.jeecg.common.util.security;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang.StringUtils;
import java.util.*;
import java.util.regex.Matcher;
@ -59,7 +60,7 @@ public abstract class AbstractQueryBlackListHandler {
if(list==null){
return true;
}
log.info("--获取sql信息--", list.toString());
log.info(" 获取sql信息 ：{} ", list.toString());
boolean flag = checkTableAndFieldsName(list);
if(flag == false){
return false;
@ -189,21 +190,21 @@ public abstract class AbstractQueryBlackListHandler {
* @return
*/
public boolean existSameField(String fieldString) {
String[] arr = fieldString.split(",");
for (String exp : fields) {
for (String config : arr) {
if (exp.equals(config)) {
String[] controlFields = fieldString.split(",");
for (String sqlField : fields) {
for (String controlField : controlFields) {
if (sqlField.equals(controlField)) {
// 非常明确的列直接比较
log.warn("sql黑名单校验，表【"+name+"】中字段【"+config+"】禁止查询");
log.warn("sql黑名单校验，表【"+name+"】中字段【"+controlField+"】禁止查询");
return true;
} else {
// 使用表达式的列 只能判读字符串包含了
String aliasColumn = config;
if (alias != null && alias.length() > 0) {
aliasColumn = alias + "." + config;
String aliasColumn = controlField;
if (StringUtils.isNotBlank(alias)) {
aliasColumn = alias + "." + controlField;
}
if (exp.indexOf(aliasColumn) > 0) {
log.warn("sql黑名单校验，表【"+name+"】中字段【"+config+"】禁止查询");
if (sqlField.indexOf(aliasColumn) != -1) {
log.warn("sql黑名单校验，表【"+name+"】中字段【"+controlField+"】禁止查询");
return true;
}
}

3
jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/security/DictQueryBlackListHandler.java
View File

@ -56,6 +56,9 @@ public class DictQueryBlackListHandler extends AbstractQueryBlackListHandler {
if (tableName.contains(" ")) {
tableName = tableName.substring(0, tableName.indexOf(" "));
}
if (tableName.contains(".")) {
tableName = tableName.substring(tableName.indexOf(".")+1, tableName.length());
}
//【issues/4393】 sys_user , (sys_user), sys_user%20, %60sys_user%60
String reg = "\\s+|\\(|\\)|`";
return tableName.replaceAll(reg, "");