[Bug修复](master): 修复区别不信任源的校验问题 filter

如题
土豆兄弟 1 year ago
parent 716878f6a5
commit a4ba863c01

@ -71,7 +71,8 @@ public class MobileMonitorCallbackNewAPI {
@RequestParam(value = "callback_url", defaultValue = "") String callbackUrl, @RequestParam(value = "callback_url", defaultValue = "") String callbackUrl,
@RequestParam(value = "advertiser_id", defaultValue = "") String advertiserId, @RequestParam(value = "advertiser_id", defaultValue = "") String advertiserId,
@RequestParam(value = "tag", defaultValue = "") String tag, @RequestParam(value = "tag", defaultValue = "") String tag,
@RequestParam(value = "vpoint", defaultValue = "") int vpoint @RequestParam(value = "vpoint", defaultValue = "") int vpoint,
@RequestParam(value = "safe", defaultValue = "") String safe
) { ) {
// 映射 // 映射

@ -23,16 +23,25 @@ public class SqlFilter implements Filter{
// 获得所有请求参数名 // 获得所有请求参数名
Enumeration<String> names = servletRequest.getParameterNames(); Enumeration<String> names = servletRequest.getParameterNames();
String sql = ""; String sql = "";
// 只有客户自己的回传检测才进行校验
boolean safeTag = false;
while (names.hasMoreElements()){ while (names.hasMoreElements()){
// 得到参数名 // 得到参数名
String name = names.nextElement().toString(); String name = names.nextElement().toString();
// 不信任请求, 进行 SQL 校验
if (StrUtil.equalsIgnoreCase("safe", name)){
safeTag = true;
}
// 得到参数对应值 // 得到参数对应值
String[] values = servletRequest.getParameterValues(name); String[] values = servletRequest.getParameterValues(name);
for (int i = 0; i < values.length; i++) { for (int i = 0; i < values.length; i++) {
sql += values[i]; sql += values[i];
} }
} }
if (sqlValidate(sql)) {
if (sqlValidate(sql) && safeTag) {
// 传递异常信息 // 传递异常信息
servletRequest.setAttribute("filterError", "您发送请求中的参数中含有非法字符"); servletRequest.setAttribute("filterError", "您发送请求中的参数中含有非法字符");
// 指定处理该请求的处理器 // 指定处理该请求的处理器

Loading…
Cancel
Save