diff --git a/Dockerfile b/Dockerfile index ee99ea95c..e7df54dc3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,7 @@ WORKDIR / EXPOSE 9999 # 添加执行jar包 -ADD daxpay-open-server/target/daxpay-open-server.jar daxpay-server.jar +ADD ./daxpay-open-client/target/daxpay-open-server.jar daxpay-server.jar # 执行启动命令 CMD java $JAVA_OPTS -jar daxpay-server.jar diff --git a/bootx-platform/bootx-platform-core/src/main/java/cn/bootx/platform/core/util/SqlInjectionUtil.java b/bootx-platform/bootx-platform-core/src/main/java/cn/bootx/platform/core/util/SqlInjectionUtil.java deleted file mode 100644 index 00d60f682..000000000 --- a/bootx-platform/bootx-platform-core/src/main/java/cn/bootx/platform/core/util/SqlInjectionUtil.java +++ /dev/null @@ -1,137 +0,0 @@ -package cn.bootx.platform.core.util; - -import cn.bootx.platform.core.exception.DangerSqlException; -import lombok.experimental.UtilityClass; -import lombok.extern.slf4j.Slf4j; - -import java.util.regex.Matcher; -import java.util.regex.Pattern; - -/** - * sql注入处理工具类 参考自 Jeecg Boot - * - * @author zhoujf - */ -@Slf4j -@UtilityClass -public class SqlInjectionUtil { - - private final String XSS_STR = "and |extractvalue|updatexml|geohash|gtid_subset|gtid_subtract|exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+|user()"; - - /** - * 正则 user() 匹配更严谨 - */ - private final String REGULAR_EXPRE_USER = "user[\\s]*\\([\\s]*\\)"; - - /** 正则 show tables */ - private final String SHOW_TABLES = "show\\s+tables"; - - /** - * sql注释的正则 - */ - private final Pattern SQL_ANNOTATION = Pattern.compile("/\\*[\\s\\S]*\\*/"); - - /** - * sql注入过滤处理，遇到注入关键字抛异常 - */ - public void filterContent(String value) { - filterContent(value, null); - } - - /** - * sql注入过滤处理，遇到注入关键字抛异常 - * - */ - public void filterContent(String value, String customXssString) { - if (value == null || value.isEmpty()) { - return; - } - // 校验sql注释 不允许有sql注释 - checkSqlAnnotation(value); - // 统一转为小写 - value = value.toLowerCase(); - // SQL注入检测存在绕过风险 - String[] xssArr = XSS_STR.split("\\|"); - for (String s : xssArr) { - if (value.contains(s)) { - log.error("请注意，存在SQL注入关键词---> {}", s); - log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new DangerSqlException("请注意，值可能存在SQL注入风险!--->" + value); - } - } - // 除了XSS_STR这些提前设置好的，还需要额外的校验比如 单引号 - if (customXssString != null) { - String[] xssArr2 = customXssString.split("\\|"); - for (String s : xssArr2) { - if (value.contains(s)) { - log.error("请注意，存在SQL注入关键词---> {}", s); - log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new DangerSqlException("请注意，值可能存在SQL注入风险!--->" + value); - } - } - } - // 除了XSS_STR这些提前设置好的，还需要额外的校验比如 单引号 - if (Pattern.matches(SHOW_TABLES, value) || Pattern.matches(REGULAR_EXPRE_USER, value)) { - throw new DangerSqlException("请注意，值可能存在SQL注入风险!--->" + value); - } - } - - /** - * sql注入过滤处理，遇到注入关键字抛异常 - */ - public void filterContent(String[] values) { - filterContent(values, null); - } - - /** - * sql注入过滤处理，遇到注入关键字抛异常 - */ - public void filterContent(String[] values, String customXssString) { - String[] xssArr = XSS_STR.split("\\|"); - for (String value : values) { - if (value == null || value.isEmpty()) { - return; - } - // 校验sql注释 不允许有sql注释 - checkSqlAnnotation(value); - // 统一转为小写 - value = value.toLowerCase(); - - for (String s : xssArr) { - if (value.contains(s)) { - log.error("请注意，存在SQL注入关键词---> {}", s); - log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new DangerSqlException("请注意，值可能存在SQL注入风险!--->" + value); - } - } - // 除了XSS_STR这些提前设置好的，还需要额外的校验比如 单引号 - if (customXssString != null) { - String[] xssArr2 = customXssString.split("\\|"); - for (String s : xssArr2) { - if (value.contains(s)) { - log.error("请注意，存在SQL注入关键词---> {}", s); - log.error("请注意，值可能存在SQL注入风险!---> {}", value); - throw new DangerSqlException("请注意，值可能存在SQL注入风险!--->" + value); - } - } - } - // 除了XSS_STR这些提前设置好的，还需要额外的校验比如 单引号 - if (Pattern.matches(SHOW_TABLES, value) || Pattern.matches(REGULAR_EXPRE_USER, value)) { - throw new DangerSqlException("请注意，值可能存在SQL注入风险!--->" + value); - } - } - } - - /** - * 校验是否有sql注释 - */ - public void checkSqlAnnotation(String str) { - Matcher matcher = SQL_ANNOTATION.matcher(str); - if (matcher.find()) { - String error = "请注意，值可能存在SQL注入风险---> \\*.*\\"; - log.error(error); - throw new DangerSqlException(error); - } - } - -} diff --git a/bootx-platform/pom.xml b/bootx-platform/pom.xml index d5d238def..68a31cca7 100644 --- a/bootx-platform/pom.xml +++ b/bootx-platform/pom.xml @@ -65,6 +65,23 @@ ${java.version} ${java.version} + + + org.projectlombok + lombok + ${lombok.version} + + + org.mapstruct + mapstruct-processor + ${mapstruct.version} + + + org.projectlombok + lombok-mapstruct-binding + ${lombok-mapstruct.version} + + diff --git a/daxpay-open-channel/pom.xml b/daxpay-open-channel/pom.xml index 669f54a97..9b00dfc51 100644 --- a/daxpay-open-channel/pom.xml +++ b/daxpay-open-channel/pom.xml @@ -74,6 +74,31 @@ + + org.apache.maven.plugins + maven-compiler-plugin + + ${java.version} + ${java.version} + + + org.projectlombok + lombok + ${lombok.version} + + + org.mapstruct + mapstruct-processor + ${mapstruct.version} + + + org.projectlombok + lombok-mapstruct-binding + ${lombok-mapstruct.version} + + + + org.apache.maven.plugins diff --git a/daxpay-open-client/pom.xml b/daxpay-open-client/pom.xml index f805bf918..f2c4175ca 100644 --- a/daxpay-open-client/pom.xml +++ b/daxpay-open-client/pom.xml @@ -15,16 +15,21 @@ 启动端 - 21 - 21 + 21 UTF-8 + 1.18.36 3.1.1 3.1.1 - 8.5.2 + + + org.projectlombok + lombok + provided + org.springframework.boot @@ -69,6 +74,21 @@ daxpay-open-server + + org.apache.maven.plugins + maven-compiler-plugin + + ${java.version} + ${java.version} + + + org.projectlombok + lombok + ${lombok.version} + + + + org.springframework.boot diff --git a/daxpay-open-payment/pom.xml b/daxpay-open-payment/pom.xml index 75d1be22e..6467e1f3d 100644 --- a/daxpay-open-payment/pom.xml +++ b/daxpay-open-payment/pom.xml @@ -140,6 +140,31 @@ + + org.apache.maven.plugins + maven-compiler-plugin + + ${java.version} + ${java.version} + + + org.projectlombok + lombok + ${lombok.version} + + + org.mapstruct + mapstruct-processor + ${mapstruct.version} + + + org.projectlombok + lombok-mapstruct-binding + ${lombok-mapstruct.version} + + + + org.apache.maven.plugins diff --git a/pom.xml b/pom.xml index 21cb214c4..d40ee4b16 100644 --- a/pom.xml +++ b/pom.xml @@ -18,9 +18,46 @@ daxpay-open-client daxpay-open-sdk + 21 21 UTF-8 + 1.18.36 + 1.5.5.Final + 0.2.0 + + + + + + org.apache.maven.plugins + maven-compiler-plugin + 3.14.0 + + ${maven.compiler.source} + ${maven.compiler.target} + + + org.projectlombok + lombok + ${lombok.version} + + + org.mapstruct + mapstruct-processor + ${mapstruct.version} + + + org.projectlombok + lombok-mapstruct-binding + ${lombok-mapstruct.version} + + + + + + +