Преглед изворни кода

sql注入接口优化,支持更多的类型

wy пре 3 месеци
родитељ
комит
f192fd86be

+ 10 - 0
ibps-provider-root/modules/provider-business/src/main/java/com/lc/ibps/sysdata/services/impl/UpdateDataTableImpl.java

@@ -81,6 +81,9 @@ public class UpdateDataTableImpl extends GenericProvider implements UpdateDataTa
             if(BeanUtils.isNotEmpty(queryDTO.getType()) && "export".equals(queryDTO.getType())){
                 String build = build(queryDTO.getParamMap());
                 list = (List<Map<String, Object>>) commonDao.query( map.get("sql_").toString() + build );
+            }else if(BeanUtils.isNotEmpty(queryDTO.getType()) && "append".equals(queryDTO.getType())){
+                String buildApen = append(map,queryDTO.getParams().toArray());
+                list = (List<Map<String, Object>>) commonDao.query(buildApen);
             }else{
                 Object[] params = queryDTO.getParams().toArray();
                 list = (List<Map<String, Object>>) commonDao.query( map.get("sql_").toString(), params);
@@ -164,6 +167,13 @@ public class UpdateDataTableImpl extends GenericProvider implements UpdateDataTa
             return conditions.isEmpty() ? "" : " where " + String.join(" and ", conditions);
     }
 
+    public String append(Map<String, Object> map,  Object[] list){
+        //map 数据库查出的sql对象
+        String sql = map.get("sql_").toString();
+        String o = list[0].toString();
+        String endSql = sql + o;
+        return endSql;
+    }
     @Override
     public APIResult<Void> upEmployee(String str){
         APIResult<Void> result = new APIResult<>();