dianliang/dl-sale-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

排序属性orderBy参数限制长度

Browse Source
This commit is contained in:
RuoYi 2023-07-06 22:09:02 +08:00
parent 4d5c204b9a
commit 1ffb6379f7
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java
View File

@ -20,6 +20,11 @@ public class SqlUtil
*/ */
public static String SQL_PATTERN = "[a-zA-Z0-9_\\ \\,\\.]+"; public static String SQL_PATTERN = "[a-zA-Z0-9_\\ \\,\\.]+";
/**
* 限制orderBy最大长度
*/
private static final int ORDER_BY_MAX_LENGTH = 500;
/** /**
* 检查字符，防止注入绕过 * 检查字符，防止注入绕过
*/ */
@ -29,6 +34,10 @@ public class SqlUtil
{ {
throw new UtilException("参数不符合规范，不能进行查询"); throw new UtilException("参数不符合规范，不能进行查询");
} }
if (StringUtils.length(value) > ORDER_BY_MAX_LENGTH)
{
throw new UtilException("参数已超过最大限制，不能进行查询");
}
return value; return value;
} }