Server:解决 @combine:"userId,..." 或 @combine:"userId{},..." 绕过权限校验，优化报错信息

TommyLemon · TommyLemon · commit fe52024646e1 · 2018-06-14T23:05:12.000+08:00
diff --git a/APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractSQLConfig.java b/APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractSQLConfig.java
@@ -1379,14 +1379,16 @@ public static AbstractSQLConfig newSQLConfig(RequestMethod method, String table,
 						}
 						else if (w.startsWith("|")) {
 							if (method == PUT) {
-								throw new IllegalArgumentException("字符 " + w + " 不合法！PUT请求的 @combine:\"key0,key1,...\" 不允许传 |key 或 !key !");
+								throw new IllegalArgumentException(table + ":{} 里的 @combine:value 中的value里条件 " + ws[i] + " 不合法！"
+										+ "PUT请求的 @combine:\"key0,key1,...\" 不允许传 |key 或 !key !");
 							}
 							w = w.substring(1);
 							orList.add(w);
 						}
 						else if (w.startsWith("!")) {
 							if (method == PUT) {
-								throw new IllegalArgumentException("字符 " + w + " 不合法！PUT请求的 @combine:\"key0,key1,...\" 不允许传 |key 或 !key !");
+								throw new IllegalArgumentException(table + ":{} 里的 @combine:value 中的value里条件 " + ws[i] + " 不合法！"
+										+ "PUT请求的 @combine:\"key0,key1,...\" 不允许传 |key 或 !key !");
 							}
 							w = w.substring(1);
 							notList.add(w);
@@ -1395,11 +1397,20 @@ else if (w.startsWith("!")) {
 							orList.add(w);
 						}
 
+						if (w.isEmpty()) {
+							throw new IllegalArgumentException(table + ":{} 里的 @combine:value 中的value里条件 " + ws[i] + " 不合法！不允许为空值！");
+						}
+						else {
+							if (KEY_ID.equals(w) || KEY_ID_IN.equals(w) || KEY_USER_ID.equals(w) || KEY_USER_ID_IN.equals(w)) {
+								throw new UnsupportedOperationException(table + ":{} 里的 @combine:value 中的value里 " + ws[i] + " 不合法！"
+										+ "不允许传 [" + KEY_ID + ", " + KEY_ID_IN + ", " + KEY_USER_ID + ", " + KEY_USER_ID_IN + "] 其中任何一个！");
+							}
+						}
+
 						whereList.add(w);
 					}
 					if (request.containsKey(w) == false) {
-						throw new IllegalArgumentException("条件 " + w + " 不在同一表对象 TableKey:{} 里面！"
-								+ "或者是 id 或 id{} ，这两个key不允许在 @combine:value 的value里设置！");
+						throw new IllegalArgumentException(table + ":{} 里的 @combine:value 中的value里 " + ws[i] + " 对应的 " + w + " 不在它里面！");
 					}
 				}
 

Original file line number	Diff line number	Diff line change
`@@ -1379,14 +1379,16 @@ public static AbstractSQLConfig newSQLConfig(RequestMethod method, String table,`
`1379`	`1379`	`}`
`1380`	`1380`	`else if (w.startsWith("\|")) {`
`1381`	`1381`	`if (method == PUT) {`
`1382`		`- throw new IllegalArgumentException("字符 " + w + " 不合法！PUT请求的 @combine:\"key0,key1,...\" 不允许传 \|key 或 !key !");`
	`1382`	`+ throw new IllegalArgumentException(table + ":{} 里的 @combine:value 中的value里条件 " + ws[i] + " 不合法！"`
	`1383`	`+ + "PUT请求的 @combine:\"key0,key1,...\" 不允许传 \|key 或 !key !");`
`1383`	`1384`	`}`
`1384`	`1385`	`w = w.substring(1);`
`1385`	`1386`	`orList.add(w);`
`1386`	`1387`	`}`
`1387`	`1388`	`else if (w.startsWith("!")) {`
`1388`	`1389`	`if (method == PUT) {`
`1389`		`- throw new IllegalArgumentException("字符 " + w + " 不合法！PUT请求的 @combine:\"key0,key1,...\" 不允许传 \|key 或 !key !");`
	`1390`	`+ throw new IllegalArgumentException(table + ":{} 里的 @combine:value 中的value里条件 " + ws[i] + " 不合法！"`
	`1391`	`+ + "PUT请求的 @combine:\"key0,key1,...\" 不允许传 \|key 或 !key !");`
`1390`	`1392`	`}`
`1391`	`1393`	`w = w.substring(1);`
`1392`	`1394`	`notList.add(w);`
`@@ -1395,11 +1397,20 @@ else if (w.startsWith("!")) {`
`1395`	`1397`	`orList.add(w);`
`1396`	`1398`	`}`
`1397`	`1399`
	`1400`	`+ if (w.isEmpty()) {`
	`1401`	`+ throw new IllegalArgumentException(table + ":{} 里的 @combine:value 中的value里条件 " + ws[i] + " 不合法！不允许为空值！");`
	`1402`	`+ }`
	`1403`	`+ else {`
	`1404`	`+ if (KEY_ID.equals(w) \|\| KEY_ID_IN.equals(w) \|\| KEY_USER_ID.equals(w) \|\| KEY_USER_ID_IN.equals(w)) {`
	`1405`	`+ throw new UnsupportedOperationException(table + ":{} 里的 @combine:value 中的value里 " + ws[i] + " 不合法！"`
	`1406`	`+ + "不允许传 [" + KEY_ID + ", " + KEY_ID_IN + ", " + KEY_USER_ID + ", " + KEY_USER_ID_IN + "] 其中任何一个！");`
	`1407`	`+ }`
	`1408`	`+ }`
	`1409`	`+`
`1398`	`1410`	`whereList.add(w);`
`1399`	`1411`	`}`
`1400`	`1412`	`if (request.containsKey(w) == false) {`
`1401`		`- throw new IllegalArgumentException("条件 " + w + " 不在同一表对象 TableKey:{} 里面！"`
`1402`		`- + "或者是 id 或 id{} ，这两个key不允许在 @combine:value 的value里设置！");`
	`1413`	`+ throw new IllegalArgumentException(table + ":{} 里的 @combine:value 中的value里 " + ws[i] + " 对应的 " + w + " 不在它里面！");`
`1403`	`1414`	`}`
`1404`	`1415`	`}`
`1405`	`1416`