diff --git a/backend/pom.xml b/backend/pom.xml
index 7539ed412b..9f0f5c4b44 100644
--- a/backend/pom.xml
+++ b/backend/pom.xml
@@ -384,7 +384,7 @@
**/*
- true
+ false
@@ -414,11 +414,11 @@
true
-
+
maven-clean-plugin
diff --git a/backend/src/main/java/io/dataease/commons/filter/SqlFilter.java b/backend/src/main/java/io/dataease/commons/filter/SqlFilter.java
new file mode 100644
index 0000000000..3a913cb270
--- /dev/null
+++ b/backend/src/main/java/io/dataease/commons/filter/SqlFilter.java
@@ -0,0 +1,78 @@
+package io.dataease.commons.filter;
+
+import io.dataease.commons.holder.ThreadLocalContextHolder;
+import io.dataease.commons.wrapper.XssAndSqlHttpServletRequestWrapper;
+import org.apache.commons.lang3.StringUtils;
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import java.io.*;
+
+
+public class SqlFilter implements Filter {
+
+
+
+
+ @Override
+ public void destroy() {
+ // TODO Auto-generated method stub
+
+ }
+
+ @Override
+ public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+
+ String method = "GET";
+ String param = "";
+ XssAndSqlHttpServletRequestWrapper xssRequest = null;
+ if (request instanceof HttpServletRequest) {
+ method = ((HttpServletRequest) request).getMethod();
+ xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);
+ }
+ if ("POST".equalsIgnoreCase(method)) {
+ param = this.getBodyString(xssRequest.getReader());
+ if(StringUtils.isNotBlank(param)){
+ if(xssRequest.checkXSSAndSql(param)){
+ response.setCharacterEncoding("UTF-8");
+ response.setContentType("application/json;charset=UTF-8");
+ PrintWriter out = response.getWriter();
+ String msg = ThreadLocalContextHolder.getData().toString();
+ out.write(msg);
+ return;
+ }
+ }
+ }
+ if (xssRequest.checkParameter()) {
+ response.setCharacterEncoding("UTF-8");
+ response.setContentType("application/json;charset=UTF-8");
+ PrintWriter out = response.getWriter();
+ String msg = ThreadLocalContextHolder.getData().toString();
+ out.write(msg);
+ return;
+ }
+ chain.doFilter(xssRequest, response);
+ }
+
+ @Override
+ public void init(FilterConfig filterConfig) throws ServletException {
+
+ }
+
+ // 获取request请求body中参数
+ public static String getBodyString(BufferedReader br) {
+ String inputLine;
+ String str = "";
+ try {
+ while ((inputLine = br.readLine()) != null) {
+ str += inputLine;
+ }
+ br.close();
+ } catch (IOException e) {
+ System.out.println("IOException: " + e);
+ }
+ return str;
+
+ }
+
+
+}
diff --git a/backend/src/main/java/io/dataease/commons/holder/ThreadLocalContextHolder.java b/backend/src/main/java/io/dataease/commons/holder/ThreadLocalContextHolder.java
new file mode 100644
index 0000000000..6aad695532
--- /dev/null
+++ b/backend/src/main/java/io/dataease/commons/holder/ThreadLocalContextHolder.java
@@ -0,0 +1,24 @@
+package io.dataease.commons.holder;
+
+public class ThreadLocalContextHolder {
+
+
+ private static ThreadLocal