update jwtutil #302
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
| @@ -1,19 +1,25 @@ | ||||||||
| package com.tinyengine.it.dynamic.dto; | ||||||||
|
|
||||||||
| import jakarta.validation.constraints.NotBlank; | ||||||||
| import jakarta.validation.constraints.Pattern; | ||||||||
| import lombok.Data; | ||||||||
|
|
||||||||
| import java.util.List; | ||||||||
| import java.util.Map; | ||||||||
|
|
||||||||
| @Data | ||||||||
| public class DynamicQuery { | ||||||||
| @NotBlank(message = "表英文名不能为空") | ||||||||
| @Pattern(regexp = "^[a-zA-Z_][a-zA-Z0-9_]*$", message = "模型名称格式不正确") | ||||||||
| private String nameEn; // 表名 | ||||||||
| private String nameCh; // 表中文名 | ||||||||
| @Pattern(regexp = "^[a-zA-Z_][a-zA-Z0-9_]*$", message = "字段名称格式不正确") | ||||||||
| private List<String> fields; // 查询字段 | ||||||||
|
Comment on lines
+16
to
17
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: Jakarta Bean Validation Citations:
🏁 Script executed: cat -n base/src/main/java/com/tinyengine/it/dynamic/dto/DynamicQuery.java | head -50Repository: opentiny/tiny-engine-backend-java Length of output: 1145 Apply
Proposed fix- `@Pattern`(regexp = "^[a-zA-Z_][a-zA-Z0-9_]*$", message = "字段名称格式不正确")
- private List<String> fields; // 查询字段
+ private List<@Pattern(regexp = "^[a-zA-Z_][a-zA-Z0-9_]*$", message = "字段名称格式不正确") String> fields; // 查询字段📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||
| private Map<String, Object> params; // 查询条件 | ||||||||
| private Integer currentPage = 1; // 页码 | ||||||||
| private Integer pageSize = 10; // 每页大小 | ||||||||
| @Pattern(regexp = "^[a-zA-Z_][a-zA-Z0-9_]*$", message = "排序字段格式不正确") | ||||||||
| private String orderBy; // 排序字段 | ||||||||
| @Pattern(regexp = "ASC|DESC", message = "排序方式必须为ASC或DESC") | ||||||||
| private String orderType = "ASC"; // 排序方式 | ||||||||
| } | ||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| package com.tinyengine.it.dynamic.util; | ||
|
|
||
| public class SQLIdentifierValidator { | ||
|
|
||
| private static final String IDENTIFIER_REGEX = "^[a-zA-Z_][a-zA-Z0-9_]*$"; | ||
|
|
||
| /** | ||
| * Validates a SQL identifier (e.g., table name, column name). | ||
| * | ||
| * @param identifier the identifier to validate | ||
| * @return true if valid, false otherwise | ||
| */ | ||
| public static boolean isValidIdentifier(String identifier) { | ||
| if (identifier == null || identifier.trim().isEmpty()) { | ||
| return false; | ||
| } | ||
| return identifier.matches(IDENTIFIER_REGEX); | ||
| } | ||
|
|
||
| /** | ||
| * Validates a list of SQL identifiers. | ||
| * | ||
| * @param identifiers the list of identifiers to validate | ||
| * @throws IllegalArgumentException if any identifier is invalid | ||
| */ | ||
| public static void validateIdentifiers(Iterable<String> identifiers) { | ||
| if (identifiers != null) { | ||
| for (String identifier : identifiers) { | ||
| if (!isValidIdentifier(identifier)) { | ||
| throw new IllegalArgumentException("Invalid SQL identifier: " + identifier); | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Throw when the table name is invalid.
These calls ignore the boolean return value, so invalid table names still flow into
FROM/INSERT_INTO/UPDATE/DELETE_FROM. The duplicate call inupdate()should also be removed.Proposed fix
public class DynamicSqlProvider { + + private void validateTableName(String tableName) { + if (!SQLIdentifierValidator.isValidIdentifier(tableName)) { + throw new IllegalArgumentException("表名格式不正确: " + tableName); + } + } public String select(Map<String, Object> params) { String tableName = (String) params.get("tableName"); - SQLIdentifierValidator.isValidIdentifier(tableName); + validateTableName(tableName); @@ public String insert(Map<String, Object> params) { String tableName = (String) params.get("tableName"); - SQLIdentifierValidator.isValidIdentifier(tableName); + validateTableName(tableName); @@ public String update(Map<String, Object> params) { String tableName = (String) params.get("tableName"); - SQLIdentifierValidator.isValidIdentifier(tableName); - - SQLIdentifierValidator.isValidIdentifier(tableName); + validateTableName(tableName); @@ public String delete(Map<String, Object> params) { String tableName = (String) params.get("tableName"); - SQLIdentifierValidator.isValidIdentifier(tableName); + validateTableName(tableName);Also applies to: 56-58, 74-78, 100-102
🤖 Prompt for AI Agents