From 9fa3f4e054bf628f677c7199b5f4ccda4a948e10 Mon Sep 17 00:00:00 2001 From: RuoYi Date: Wed, 27 Feb 2019 12:29:03 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E7=95=8C=E9=9D=A2=E5=AD=98?= =?UTF-8?q?=E5=9C=A8=E7=9A=84=E4=B8=80=E4=BA=9B=E5=AE=89=E5=85=A8=E9=97=AE?= =?UTF-8?q?=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pom.xml | 2 +- .../controller/common/CommonController.java | 7 +++++- .../main/resources/static/ruoyi/js/ry-ui.js | 1 - .../com/ruoyi/common/page/PageDomain.java | 5 ++-- .../ruoyi/common/utils/file/FileUtils.java | 13 ++++++++++ .../com/ruoyi/common/utils/sql/SqlUtil.java | 24 +++++++++++++++++++ 6 files changed, 47 insertions(+), 5 deletions(-) create mode 100644 ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java diff --git a/pom.xml b/pom.xml index 4d93d707..f0342a17 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ 1.4.0 2.0.0 1.3.2 - 1.1.10 + 1.1.13 1.19 2.3.2 2.7.0 diff --git a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java index fccdbc09..341e68df 100644 --- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java +++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java @@ -14,6 +14,7 @@ import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.multipart.MultipartFile; import com.ruoyi.common.base.AjaxResult; import com.ruoyi.common.config.Global; +import com.ruoyi.common.utils.StringUtils; import com.ruoyi.common.utils.file.FileUploadUtils; import com.ruoyi.common.utils.file.FileUtils; import com.ruoyi.framework.config.ServerConfig; @@ -45,9 +46,13 @@ public class CommonController @GetMapping("common/download") public void fileDownload(String fileName, Boolean delete, HttpServletResponse response, HttpServletRequest request) { - String realFileName = System.currentTimeMillis() + fileName.substring(fileName.indexOf("_") + 1); try { + if (!FileUtils.isValidFilename(fileName)) + { + throw new Exception(StringUtils.format(" 文件名称({})非法，不允许下载。 ", fileName)); + } + String realFileName = System.currentTimeMillis() + fileName.substring(fileName.indexOf("_") + 1); String filePath = Global.getDownloadPath() + fileName; response.setCharacterEncoding("utf-8"); diff --git a/ruoyi-admin/src/main/resources/static/ruoyi/js/ry-ui.js b/ruoyi-admin/src/main/resources/static/ruoyi/js/ry-ui.js index 25e1531b..aa5ec964 100644 --- a/ruoyi-admin/src/main/resources/static/ruoyi/js/ry-ui.js +++ b/ruoyi-admin/src/main/resources/static/ruoyi/js/ry-ui.js @@ -282,7 +282,6 @@ url: options.url, // 请求后台的URL（*） ajaxParams: options.ajaxParams, // 请求数据的ajax的data属性 height: options.height, // 表格树的高度 - ajaxParams: {}, // 请求数据的ajax的data属性 expandColumn: options.expandColumn, // 在哪一列上面显示展开按钮 striped: options.striped, // 是否显示行间隔色 bordered: true, // 是否显示边框 diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/page/PageDomain.java b/ruoyi-common/src/main/java/com/ruoyi/common/page/PageDomain.java index dd3eb4f9..fd46979e 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/page/PageDomain.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/page/PageDomain.java @@ -1,6 +1,7 @@ package com.ruoyi.common.page; import com.ruoyi.common.utils.StringUtils; +import com.ruoyi.common.utils.sql.SqlUtil; /** * 分页数据 @@ -57,7 +58,7 @@ public class PageDomain public void setOrderByColumn(String orderByColumn) { - this.orderByColumn = orderByColumn; + this.orderByColumn = SqlUtil.escapeSql(orderByColumn); } public String getIsAsc() @@ -67,6 +68,6 @@ public class PageDomain public void setIsAsc(String isAsc) { - this.isAsc = isAsc; + this.isAsc = SqlUtil.escapeSql(isAsc); } } diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/utils/file/FileUtils.java b/ruoyi-common/src/main/java/com/ruoyi/common/utils/file/FileUtils.java index 36532cae..afbe43ae 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/utils/file/FileUtils.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/utils/file/FileUtils.java @@ -13,6 +13,8 @@ import java.io.OutputStream; */ public class FileUtils { + public static String FILENAME_PATTERN = "[a-zA-Z0-9_\\-\\|\\.\\u4e00-\\u9fa5]+"; + /** * 输出指定文件的byte数组 * @@ -87,4 +89,15 @@ public class FileUtils } return flag; } + + /** + * 文件名称验证 + * + * @param filename 文件名称 + * @return true 正常 false 非法 + */ + public static boolean isValidFilename(String filename) + { + return filename.matches(FILENAME_PATTERN); + } } diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java b/ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java new file mode 100644 index 00000000..38f49215 --- /dev/null +++ b/ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java @@ -0,0 +1,24 @@ +package com.ruoyi.common.utils.sql; + +import com.ruoyi.common.utils.StringUtils; + +/** + * sql操作工具类 + * + * @author ruoyi + */ +public class SqlUtil +{ + /** + * 防止sql注入 替换危险字符 + */ + public static String escapeSql(String value) + { + if (StringUtils.isNotEmpty(value)) + { + value = value.replaceAll("\\(", ""); + value = value.replaceAll("\\)", ""); + } + return value; + } +}