Skip to content

Commit 386a02f

Browse files
TommyLemonTommyLemon
committed
【安全】：加强对 JOIN 相关键值对的校验；加强对命名的校验
1 parent 35aee2c commit 386a02f

File tree

4 files changed

+85
-32
lines changed

4 files changed

+85
-32
lines changed

‎APIJSONORM/src/main/java/apijson/StringUtil.java‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -399,29 +399,36 @@ public static boolean isNumberOrAlpha(String s) {
399399
* @return
400400
*/
401401
public static boolean isName(String s) {
402-
return s != null && PATTERN_NAME.matcher(s).matches();
402+
if (s == null || s.isEmpty()) {
403+
return false;
404+
}
405+
406+
String first = s.substring(0, 1);
407+
if ("_".equals(first) == false && PATTERN_ALPHA.matcher(first).matches() == false) {
408+
return false;
409+
}
410+
411+
return s.length() <= 1 ? true : PATTERN_NAME.matcher(s.substring(1)).matches();
403412
}
404413
/**判断是否为首字母大写的代码名称
405414
* @param s
406415
* @return
407416
*/
408417
public static boolean isBigName(String s) {
409-
s = getString(s);
410-
if (s.isEmpty() || PATTERN_ALPHA_BIG.matcher(s.substring(0, 1)).matches() == false) {
418+
if (s == null || s.isEmpty() || PATTERN_ALPHA_BIG.matcher(s.substring(0, 1)).matches() == false) {
411419
return false;
412420
}
413-
return s.length() <= 1 ? true : isName(s.substring(1));
421+
return s.length() <= 1 ? true : PATTERN_NAME.matcher(s.substring(1)).matches();
414422
}
415423
/**判断是否为首字母小写的代码名称
416424
* @param s
417425
* @return
418426
*/
419427
public static boolean isSmallName(String s) {
420-
s = getString(s);
421-
if (s.isEmpty() || PATTERN_ALPHA_SMALL.matcher(s.substring(0, 1)).matches() == false) {
428+
if (s == null || s.isEmpty() || PATTERN_ALPHA_SMALL.matcher(s.substring(0, 1)).matches() == false) {
422429
return false;
423430
}
424-
return s.length() <= 1 ? true : isName(s.substring(1));
431+
return s.length() <= 1 ? true : PATTERN_NAME.matcher(s.substring(1)).matches();
425432
}
426433

427434

‎APIJSONORM/src/main/java/apijson/orm/AbstractParser.java‎

Lines changed: 54 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1062,7 +1062,7 @@ else if (join != null){
10621062

10631063
Set<Entry<String, Object>> set = joinMap == null ? null : joinMap.entrySet();
10641064
if (set == null || set.isEmpty()) {
1065-
Log.e(TAG, "doJoin set == null || set.isEmpty() >> return null;");
1065+
Log.e(TAG, "onJoinParse set == null || set.isEmpty() >> return null;");
10661066
return null;
10671067
}
10681068

@@ -1092,7 +1092,7 @@ else if (join != null){
10921092

10931093
int index = path.indexOf("/");
10941094
if (index < 0) {
1095-
throw new IllegalArgumentException(JSONRequest.KEY_JOIN + ":value 中value不合法！"
1095+
throw new IllegalArgumentException(JSONRequest.KEY_JOIN + ":value 中 value 值 " + path + " 不合法！"
10961096
+ "必须为 &/Table0/key0,</Table1/key1,... 或 { '&/Table0/key0':{}, '</Table1/key1':{},... } 这种形式！");
10971097
}
10981098
String joinType = path.substring(0, index); //& | ! < > ( ) <> () *
@@ -1105,37 +1105,70 @@ else if (join != null){
11051105
String tableKey = index < 0 ? null : path.substring(0, index); //User:owner
11061106
apijson.orm.Entry<String, String> entry = Pair.parseEntry(tableKey, true);
11071107
String table = entry.getKey(); //User
1108+
if (StringUtil.isName(table) == false) {
1109+
throw new IllegalArgumentException(JSONRequest.KEY_JOIN + ":value 中 value 的 Table 值 " + table + " 不合法！"
1110+
+ "必须为 &/Table0/key0,</Table1:alias1/key1,... 这种形式！且 Table0 必须满足大写字母开头的表对象英文单词 key 格式！");
1111+
}
1112+
11081113
String alias = entry.getValue(); //owner
1109-
String key = StringUtil.isEmpty(table, true) ? null : path.substring(index + 1);//id@
1110-
if (StringUtil.isEmpty(key, true)) {
1111-
throw new IllegalArgumentException(JSONRequest.KEY_JOIN + ":value 中value不合法！"
1112-
+ "必须为 &/Table0/key0,</Table1/key1,... 这种形式！");
1114+
if (StringUtil.isNotEmpty(alias, true) && StringUtil.isName(alias) == false) {
1115+
throw new IllegalArgumentException(JSONRequest.KEY_JOIN + ":value 中 value 的 alias 值 " + alias + " 不合法！"
1116+
+ "必须为 &/Table0/key0,</Table1:alias1/key1,... 这种形式！且 Table:alias 的 alias 必须满足英文单词变量名格式！");
11131117
}
1118+
1119+
String key = StringUtil.isEmpty(table, true) ? null : path.substring(index + 1);//id@
11141120

11151121
//取出Table对应的JSONObject，及内部引用赋值 key:value
1116-
tableObj = request.getJSONObject(tableKey);
1122+
try {
1123+
tableObj = request.getJSONObject(tableKey);
1124+
}
1125+
catch (Exception e2) {
1126+
throw new IllegalArgumentException(JSONRequest.KEY_JOIN + ":'" + path + "' 对应的 " + tableKey + ":value 中 value 类型不合法！必须是 {} 这种 JSONObject 格式！" + e2.getMessage());
1127+
}
1128+
11171129
targetPath = tableObj == null ? null : tableObj.getString(key);
11181130
if (StringUtil.isEmpty(targetPath, true)) {
1119-
throw new IllegalArgumentException("/" + path + ":value 中value必须为引用赋值的路径 '/targetTable/targetKey' ！");
1131+
throw new IllegalArgumentException("/" + path + ":value 中 value 值 " + targetPath + " 不合法！必须为引用赋值的路径 '/targetTable/targetKey' ！");
11201132
}
11211133

11221134
//取出引用赋值路径targetPath对应的Table和key
11231135
index = targetPath.lastIndexOf("/");
11241136
targetKey = index < 0 ? null : targetPath.substring(index + 1);
1125-
if (StringUtil.isEmpty(targetKey, true)) {
1126-
throw new IllegalArgumentException("/" + path + ":'/targetTable/targetKey' 中targetKey不能为空！");
1137+
if (StringUtil.isName(targetKey) == false) {
1138+
throw new IllegalArgumentException("/" + path + ":'/targetTable/targetKey' 中 targetKey 值 " + targetKey + " 不合法！必须满足英文单词变量名格式！");
11271139
}
11281140

11291141
targetPath = targetPath.substring(0, index);
11301142
index = targetPath.lastIndexOf("/");
1131-
targetTable = index < 0 ? targetPath : targetPath.substring(index + 1);
1132-
1143+
String targetTableKey = index < 0 ? targetPath : targetPath.substring(index + 1);
11331144

1145+
// 主表不允许别名
1146+
// apijson.orm.Entry<String, String> targetEntry = Pair.parseEntry(targetTableKey, true);
1147+
// targetTable = targetEntry.getKey(); //User
1148+
// if (StringUtil.isName(targetTable) == false) {
1149+
// throw new IllegalArgumentException("/" + path + ":'/targetTable/targetKey' 中 targetTable 值 " + targetTable + " 不合法！必须满足大写字母开头的表对象英文单词 key 格式！");
1150+
// }
1151+
//
1152+
// String targetAlias = targetEntry.getValue(); //owner
1153+
// if (StringUtil.isNotEmpty(targetAlias, true) && StringUtil.isName(targetAlias) == false) {
1154+
// throw new IllegalArgumentException("/" + path + ":'/targetTable:targetAlias/targetKey' 中 targetAlias 值 " + targetAlias + " 不合法！必须满足英文单词变量名格式！");
1155+
// }
1156+
1157+
targetTable = targetTableKey; // 主表不允许别名
1158+
if (StringUtil.isName(targetTable) == false) {
1159+
throw new IllegalArgumentException("/" + path + ":'/targetTable/targetKey' 中 targetTable 值 " + targetTable + " 不合法！必须满足大写字母开头的表对象英文单词 key 格式！");
1160+
}
1161+
11341162
//对引用的JSONObject添加条件
1135-
targetObj = request.getJSONObject(targetTable);
1163+
try {
1164+
targetObj = request.getJSONObject(targetTableKey);
1165+
}
1166+
catch (Exception e2) {
1167+
throw new IllegalArgumentException("/" + path + ":'/targetTable/targetKey' 中路径对应的 '" + targetTableKey + "':value 中 value 类型不合法！必须是 {} 这种 JSONObject 格式！" + e2.getMessage());
1168+
}
1169+
11361170
if (targetObj == null) {
1137-
throw new IllegalArgumentException(targetTable + "." + targetKey
1138-
+ ":'/targetTable/targetKey' 中路径对应的对象不存在！");
1171+
throw new IllegalArgumentException("/" + path + ":'/targetTable/targetKey' 中路径对应的对象 '" + targetTableKey + "':{} 不存在或值为 null ！必须是 {} 这种 JSONObject 格式！");
11391172
}
11401173

11411174
tableObj.put(key, tableObj.remove(key)); //保证和SQLExcecutor缓存的Config里where顺序一致，生成的SQL也就一致
@@ -1147,11 +1180,16 @@ else if (join != null){
11471180
j.setJoinType(joinType);
11481181
j.setTable(table);
11491182
j.setAlias(alias);
1150-
j.setTargetName(targetTable);
1183+
j.setTargetTable(targetTable);
1184+
// j.setTargetAlias(targetAlias);
11511185
j.setTargetKey(targetKey);
11521186
j.setKeyAndType(key);
11531187
j.setRequest(getJoinObject(table, tableObj, key));
11541188
j.setOuter((JSONObject) e.getValue());
1189+
1190+
if (StringUtil.isName(j.getKey()) == false) {
1191+
throw new IllegalArgumentException(JSONRequest.KEY_JOIN + ":value 中 value 的 key@ 中 key 值 " + j.getKey() + " 不合法！必须满足英文单词变量名格式！");
1192+
}
11551193

11561194
joinList.add(j);
11571195

‎APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2489,7 +2489,8 @@ public String getJoinString() throws Exception {
24892489
String sql = null;
24902490
SQLConfig jc;
24912491
String jt;
2492-
String tn;
2492+
String tt;
2493+
String ta;
24932494
for (Join j : joinList) {
24942495
if (j.isAppJoin()) { // APP JOIN，只是作为一个标记，执行完主表的查询后自动执行副表的查询 User.id IN($commentIdList)
24952496
continue;
@@ -2502,7 +2503,7 @@ public String getJoinString() throws Exception {
25022503
jc.setPrepared(isPrepared());
25032504

25042505
jt = StringUtil.isEmpty(jc.getAlias(), true) ? jc.getTable() : jc.getAlias();
2505-
tn = j.getTargetName();
2506+
tt = j.getTargetTable();
25062507

25072508
//如果要强制小写，则可在子类重写这个方法再 toLowerCase
25082509
// if (DATABASE_POSTGRESQL.equals(getDatabase())) {
@@ -2522,7 +2523,7 @@ public String getJoinString() throws Exception {
25222523
sql = ( "<".equals(type) ? " LEFT" : (">".equals(type) ? " RIGHT" : " CROSS") )
25232524
+ " JOIN ( " + jc.getSQL(isPrepared()) + " ) AS "
25242525
+ quote + jt + quote + " ON " + quote + jt + quote + "." + quote + j.getKey() + quote + " = "
2525-
+ quote + tn + quote + "." + quote + j.getTargetKey() + quote;
2526+
+ quote + tt + quote + "." + quote + j.getTargetKey() + quote;
25262527
jc.setMain(false).setKeyPrefix(true);
25272528

25282529
pvl.addAll(jc.getPreparedValueList());
@@ -2537,7 +2538,7 @@ public String getJoinString() throws Exception {
25372538
case "(": // ANTI JOIN: A & ! B
25382539
case ")": // FOREIGN JOIN: B & ! A
25392540
sql = " INNER JOIN " + jc.getTablePath()
2540-
+ " ON " + quote + jt + quote + "." + quote + j.getKey() + quote + " = " + quote + tn + quote + "." + quote + j.getTargetKey() + quote;
2541+
+ " ON " + quote + jt + quote + "." + quote + j.getKey() + quote + " = " + quote + tt + quote + "." + quote + j.getTargetKey() + quote;
25412542
break;
25422543
default:
25432544
throw new UnsupportedOperationException(

‎APIJSONORM/src/main/java/apijson/orm/Join.java‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ public class Join {
2525
private String table; //User
2626
private String alias; //owner
2727
private String key; //id
28-
private String targetName; // Moment
28+
private String targetTable; // Moment
29+
private String targetAlias; //main
2930
private String targetKey; // userId
3031

3132
private JSONObject outter;
@@ -91,11 +92,17 @@ public String getKey() {
9192
public void setKey(String key) {
9293
this.key = key;
9394
}
94-
public String getTargetName() {
95-
return targetName;
95+
public void setTargetTable(String targetTable) {
96+
this.targetTable = targetTable;
9697
}
97-
public void setTargetName(String targetName) {
98-
this.targetName = targetName;
98+
public String getTargetTable() {
99+
return targetTable;
100+
}
101+
public void setTargetAlias(String targetAlias) {
102+
this.targetAlias = targetAlias;
103+
}
104+
public String getTargetAlias() {
105+
return targetAlias;
99106
}
100107
public String getTargetKey() {
101108
return targetKey;

0 commit comments

Comments
 (0)