深圳三院SQL注入修改-新加接口

ibps-provider-root/modules/provider-business/src/main/java/com/lc/ibps/sysdata/services/impl/UpdateDataTableImpl.java

@@ -86,11 +86,7 @@ public class UpdateDataTableImpl extends GenericProvider implements UpdateDataTa
         Map<String, Object> map = commonDao.queryOne(sql);
         List<Map<String, Object>> list = new ArrayList<>();
         if (BeanUtils.isNotEmpty(map) && BeanUtils.isNotEmpty(map.get("sql_"))) {
-            Object[] origin = queryDTO.getParams().toArray();
-            Object[] params = new Object[origin.length];
-            for(Object o : origin) {
-                params = ArrayUtils.add(params, RequestUtil.filterInjectQuery(o.toString()));
-            }
+            Object[] params = queryDTO.getParams().toArray();
             list = (List<Map<String, Object>>) commonDao.query( map.get("sql_").toString(), params);
         }
         Map<String, Object> datas = new HashMap<>();
@@ -557,7 +553,7 @@ public class UpdateDataTableImpl extends GenericProvider implements UpdateDataTa
             Map mapSql = JSONObject.parseObject(text);
             String sql = (String) mapSql.get("sql");
             if (null != sql && !sql.isEmpty() && "select".equals(sql.substring(0, 6))) {
-                sql = RequestUtil.filterInjectQuery(sql);
+                // sql = RequestUtil.filterInjectQuery(sql);
                 apiResult.addVariable("data", updateDataTableDao.inputSqlSelectData(sql));
                 apiResult.setState(StateEnum.SUCCESS.getCode());
                 return apiResult;