Skip to content

Commit 005bc85

Browse files
TommyLemonTommyLemon
committed
Server:Parser新增maxObjectCount和maxArrayCount限制
1 parent f61b49d commit 005bc85

File tree

3 files changed

+64
-8
lines changed

3 files changed

+64
-8
lines changed

‎APIJSON-Java-Server/APIJSONORM/src/main/java/zuo/biao/apijson/server/AbstractObjectParser.java‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ public AbstractObjectParser(@NotNull JSONObject request, String parentPath, Stri
9999
this.table = Pair.parseEntry(name, true).getKey();
100100
this.isTable = zuo.biao.apijson.JSONObject.isTableKey(table);
101101

102+
this.objectCount = 0;
103+
this.arrayCount = 0;
104+
this.sqlCount = 0;
105+
102106
boolean isEmpty = request.isEmpty();//empty有效 User:{}
103107
if (isEmpty) {
104108
this.tri = false;
@@ -216,6 +220,9 @@ public boolean isBreakParse() {
216220
*/
217221
protected Map<String, JSONObject> childMap;
218222

223+
private int objectCount;
224+
private int arrayCount;
225+
private int sqlCount;
219226
/**解析成员
220227
* response重新赋值
221228
* @return null or this
@@ -266,6 +273,7 @@ public AbstractObjectParser parse() throws Exception {
266273
String key;
267274
Object value;
268275
int index = 0;
276+
269277
for (Entry<String, Object> entry : set) {
270278
if (isBreakParse()) {
271279
break;
@@ -278,7 +286,7 @@ public AbstractObjectParser parse() throws Exception {
278286
key = entry.getKey();
279287

280288
try {
281-
if (value instanceof JSONObject && key.startsWith("@") == false && key.endsWith("@") == false) {//JSONObject，往下一级提取
289+
if (value instanceof JSONObject && key.startsWith("@") == false && key.endsWith("@") == false) {//JSONObject，往下一级提取
282290
if (childMap != null) {//添加到childMap，最后再解析
283291
childMap.put(key, (JSONObject)value);
284292
}
@@ -478,6 +486,13 @@ public JSON onChildParse(int index, String key, JSONObject value) throws Excepti
478486
boolean isEmpty;
479487

480488
if (zuo.biao.apijson.JSONObject.isArrayKey(key)) {//APIJSON Array
489+
arrayCount ++;
490+
491+
int maxArrayCount = parser.getMaxArrayCount();
492+
if (arrayCount > maxArrayCount) {
493+
throw new IllegalArgumentException(path + " 内 key[]: {} 的数量必须在 0-" + maxArrayCount + " 内 !");
494+
}
495+
481496
if (isMain) {
482497
throw new IllegalArgumentException(parentPath + "/" + key + ":{} 不合法！"
483498
+ "数组 []:{} 中第一个 key:{} 必须是主表 TableKey:{} ！不能为 arrayKey[]:{} ！");
@@ -487,6 +502,13 @@ public JSON onChildParse(int index, String key, JSONObject value) throws Excepti
487502
isEmpty = child == null || ((JSONArray) child).isEmpty();
488503
}
489504
else {//APIJSON Object
505+
objectCount ++;
506+
507+
int maxObjectCount = parser.getMaxObjectCount();
508+
if (objectCount > maxObjectCount) {
509+
throw new IllegalArgumentException(path + " 内 key: {} 的数量必须在 0-" + maxObjectCount + " 内 !");
510+
}
511+
490512
if (type == TYPE_ITEM && JSONRequest.isTableKey(Pair.parseEntry(key, true).getKey()) == false) {
491513
throw new IllegalArgumentException(parentPath + "/" + key + ":{} 不合法！"
492514
+ "数组 []:{} 中每个 key:{} 都必须是表 TableKey:{} 或 数组 arrayKey[]:{} ！");
@@ -589,6 +611,12 @@ public AbstractObjectParser setSQLConfig(int count, int page, int position) thro
589611
}
590612

591613
if (sqlConfig == null) {
614+
sqlCount ++;
615+
int maxSQLCount = parser.getMaxSQLCount();
616+
if (sqlCount > maxSQLCount) {
617+
throw new IllegalArgumentException(path + " 内生成的 SQL 必须在 0-" + maxSQLCount + " 内 !");
618+
}
619+
592620
sqlConfig = newSQLConfig();
593621
}
594622
sqlConfig.setCount(count).setPage(page).setPosition(position);
@@ -598,6 +626,8 @@ public AbstractObjectParser setSQLConfig(int count, int page, int position) thro
598626
return this;
599627
}
600628

629+
630+
601631

602632
protected SQLConfig sqlConfig = null;//array item复用
603633
/**SQL查询，for array item

‎APIJSON-Java-Server/APIJSONORM/src/main/java/zuo/biao/apijson/server/AbstractParser.java‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,7 @@ public JSONObject parseResponse(String request) {
239239
return parseResponse(requestObject);
240240
}
241241

242+
private int depth;
242243
/**解析请求json并获取对应结果
243244
* @param request
244245
* @return requestObject
@@ -297,6 +298,7 @@ public JSONObject parseResponse(JSONObject request) {
297298
Exception error = null;
298299
sqlExecutor = createSQLExecutor();
299300
try {
301+
depth = 0;
300302
requestObject = onObjectParse(request, null, null, null, false);
301303
} catch (Exception e) {
302304
e.printStackTrace();
@@ -686,7 +688,7 @@ public JSONObject onObjectParse(final JSONObject request
686688
*/
687689
@Override
688690
public JSONArray onArrayParse(JSONObject request, String parentPath, String name, boolean isSubquery) throws Exception {
689-
Log.i(TAG, "\n\n\n getArray parentPath = " + parentPath
691+
Log.i(TAG, "\n\n\n onArrayParse parentPath = " + parentPath
690692
+ "; name = " + name + "; request = " + JSON.toJSONString(request));
691693
//不能允许GETS，否则会被通过"[]":{"@role":"ADMIN"},"Table":{},"tag":"Table"绕过权限并能批量查询
692694
if (RequestMethod.isGetMethod(requestMethod, false) == false) {
@@ -1025,17 +1027,33 @@ public int getDefaultQueryCount() {
10251027
return DEFAULT_QUERY_COUNT;
10261028
}
10271029
@Override
1028-
public int getMaxQueryCount() {
1029-
return MAX_QUERY_COUNT;
1030-
}
1031-
@Override
10321030
public int getMaxQueryPage() {
10331031
return MAX_QUERY_PAGE;
10341032
}
10351033
@Override
1034+
public int getMaxQueryCount() {
1035+
return MAX_QUERY_COUNT;
1036+
}
1037+
@Override
10361038
public int getMaxUpdateCount() {
10371039
return MAX_UPDATE_COUNT;
10381040
}
1041+
@Override
1042+
public int getMaxSQLCount() {
1043+
return MAX_SQL_COUNT;
1044+
}
1045+
@Override
1046+
public int getMaxObjectCount() {
1047+
return MAX_OBJECT_COUNT;
1048+
}
1049+
@Override
1050+
public int getMaxArrayCount() {
1051+
return MAX_ARRAY_COUNT;
1052+
}
1053+
@Override
1054+
public int getMaxQueryDepth() {
1055+
return MAX_QUERY_DEPTH;
1056+
}
10391057

10401058

10411059
/**根据路径取值

‎APIJSON-Java-Server/APIJSONORM/src/main/java/zuo/biao/apijson/server/Parser.java‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,13 @@
2626
public interface Parser<T> {
2727

2828
int DEFAULT_QUERY_COUNT = 10;
29-
int MAX_QUERY_COUNT = 100;
3029
int MAX_QUERY_PAGE = 100;
30+
int MAX_QUERY_COUNT = 100;
3131
int MAX_UPDATE_COUNT = 10;
32+
int MAX_SQL_COUNT = 100;
33+
int MAX_OBJECT_COUNT = 3;
34+
int MAX_ARRAY_COUNT = 3;
35+
int MAX_QUERY_DEPTH = 3;
3236

3337

3438
@NotNull
@@ -99,9 +103,13 @@ public interface Parser<T> {
99103
ObjectParser createObjectParser(JSONObject request, String parentPath, String name, SQLConfig arrayConfig, boolean isSubquery) throws Exception;
100104

101105
int getDefaultQueryCount();
102-
int getMaxQueryCount();
103106
int getMaxQueryPage();
107+
int getMaxQueryCount();
104108
int getMaxUpdateCount();
109+
int getMaxSQLCount();
110+
int getMaxObjectCount();
111+
int getMaxArrayCount();
112+
int getMaxQueryDepth();
105113

106114
void putQueryResult(String path, Object result);
107115

0 commit comments

Comments
 (0)