fix: 应用日志接口sql-inject

This commit is contained in:
fit2cloud-chenyw 2023-09-11 20:51:33 +08:00
parent f2df9b655e
commit 849f110f7f
25 changed files with 70 additions and 610 deletions

View File

@ -7,7 +7,7 @@ import io.dataease.auth.annotation.SqlInjectValidator;
import io.dataease.commons.utils.PageUtils;
import io.dataease.commons.utils.Pager;
import io.dataease.controller.handler.annotation.I18n;
import io.dataease.controller.sys.request.KeyGridRequest;
import io.dataease.controller.request.panel.AppLogGridRequest;
import io.dataease.dto.appTemplateMarket.AppLogGridDTO;
import io.dataease.service.panel.applog.AppLogService;
import io.swagger.annotations.Api;
@ -38,7 +38,7 @@ public class AppLogController {
})
@SqlInjectValidator(value = {"apply_time"})
public Pager<List<AppLogGridDTO>> logGrid(@PathVariable int goPage, @PathVariable int pageSize,
@RequestBody KeyGridRequest request) {
@RequestBody AppLogGridRequest request) {
Page<Object> page = PageHelper.startPage(goPage, pageSize, true);
return PageUtils.setPageInfo(page, appLogService.query(request));
}

View File

@ -0,0 +1,11 @@
package io.dataease.controller.request.panel;
import io.dataease.plugins.common.request.KeywordRequest;
import lombok.Data;
@Data
public class AppLogGridRequest extends KeywordRequest {
private Long[] applyTime;
private Long userId;
}

View File

@ -6,7 +6,6 @@ import io.dataease.auth.annotation.SqlInjectValidator;
import io.dataease.commons.utils.DeFileUtils;
import io.dataease.commons.utils.PageUtils;
import io.dataease.commons.utils.Pager;
import io.dataease.controller.sys.base.BaseGridRequest;
import io.dataease.plugins.common.base.domain.MyPlugin;
import io.dataease.plugins.common.request.KeywordRequest;
import io.dataease.service.sys.PluginService;

View File

@ -1,52 +0,0 @@
package io.dataease.controller.sys.base;
import io.dataease.ext.query.GridExample;
import io.swagger.annotations.ApiModel;
import io.swagger.annotations.ApiModelProperty;
import org.apache.commons.collections.CollectionUtils;
import java.io.Serializable;
import java.util.List;
@ApiModel("查询条件")
public class BaseGridRequest implements Serializable {
@ApiModelProperty("条件集合")
private List<ConditionEntity> conditions;
public List<ConditionEntity> getConditions() {
return conditions;
}
public void setConditions(List<ConditionEntity> conditions) {
this.conditions = conditions;
}
public List<String> getOrders() {
return orders;
}
public void setOrders(List<String> orders) {
this.orders = orders;
}
@ApiModelProperty("排序描述")
private List<String> orders;
public GridExample convertExample(){
GridExample gridExample = new GridExample();
if (CollectionUtils.isNotEmpty(conditions)) {
GridExample.Criteria criteria = gridExample.createCriteria();
conditions.forEach(criteria::addCondition);
}
if (CollectionUtils.isNotEmpty(orders)){
String orderByClause = String.join(", ", orders);
gridExample.setOrderByClause(orderByClause);
}
return gridExample;
}
}

View File

@ -1,20 +0,0 @@
package io.dataease.controller.sys.base;
import io.swagger.annotations.ApiModelProperty;
import lombok.Data;
import java.io.Serializable;
@Data
public class ConditionEntity implements Serializable {
@ApiModelProperty(value = "字段")
private String field;
@ApiModelProperty(value = "操作符")
private String operator;
@ApiModelProperty(value = "字段值")
private Object value;
}

View File

@ -1,13 +0,0 @@
package io.dataease.controller.sys.request;
import io.dataease.controller.sys.base.BaseGridRequest;
import io.swagger.annotations.ApiModelProperty;
import lombok.Data;
import java.io.Serializable;
@Data
public class KeyGridRequest extends BaseGridRequest implements Serializable {
@ApiModelProperty("关键字")
private String keyWord;
}

View File

@ -1,9 +1,10 @@
package io.dataease.ext;
import io.dataease.controller.request.panel.AppLogGridRequest;
import io.dataease.dto.appTemplateMarket.AppLogGridDTO;
import io.dataease.service.panel.applog.AppLogQueryParam;
import java.util.List;
public interface ExtAppLogMapper {
List<AppLogGridDTO> query(AppLogQueryParam example);
List<AppLogGridDTO> query(AppLogGridRequest request);
}

View File

@ -14,7 +14,7 @@
<result column="panel_privileges" property="panelPrivileges"/>
<result column="datasource_privileges" property="datasourcePrivileges"/>
</resultMap>
<select id="query" parameterType="io.dataease.service.panel.applog.AppLogQueryParam" resultMap="BaseResultMapDTO">
<select id="query" parameterType="io.dataease.controller.request.panel.AppLogGridRequest" resultMap="BaseResultMapDTO">
select
logInfo.*,
get_auths(logInfo.dataset_group_id,'dataset',#{userId}) as `dataset_privileges`,
@ -53,27 +53,34 @@
left join panel_app_template on panel_app_template_log.app_template_id = panel_app_template.id
) t
where 1=1
<if test="extendCondition != null">
<if test="keyword != null">
and
(
t.app_name like concat('%', #{extendCondition} , '%')
t.app_name like concat('%', #{keyword} , '%')
or
t.panel_name like concat('%', #{extendCondition} , '%')
t.panel_name like concat('%', #{keyword} , '%')
or
t.dataset_group_name like concat('%', #{extendCondition} , '%')
t.dataset_group_name like concat('%', #{keyword} , '%')
or
t.datasource_name like concat('%', #{extendCondition} , '%')
t.datasource_name like concat('%', #{keyword} , '%')
)
</if>
) logInfo
<if test="_parameter != null">
<include refid="io.dataease.ext.query.GridSql.gridCondition"/>
<if test="applyTime != null and applyTime.length > 1">
and (apply_time between #{applyTime.[0]} and #{applyTime.[1]}
</if>
<if test="orderByClause != null">
order by ${orderByClause}
</if>
<if test="orderByClause == null">
<choose>
<when test="orders!=null and orders.size > 0">
order by
<foreach collection="orders" item="item" open='' separator=',' close=''>
${item}
</foreach>
</when>
<otherwise>
order by apply_time desc
</if>
</otherwise>
</choose>
</select>
</mapper>

View File

@ -1,16 +1,14 @@
package io.dataease.ext;
import io.dataease.controller.request.DatasourceUnionRequest;
import io.dataease.dto.RelationDTO;
import io.dataease.dto.DatasourceDTO;
import io.dataease.ext.query.GridExample;
import io.dataease.dto.RelationDTO;
import org.apache.ibatis.annotations.Param;
import java.util.List;
public interface ExtDataSourceMapper {
// List<DatasourceDTO> query(GridExample example);
List<DatasourceDTO> queryUnion(DatasourceUnionRequest request);

View File

@ -18,52 +18,7 @@
</collection>
</resultMap>
<select id="query" parameterType="io.dataease.ext.query.GridExample" resultMap="BaseResultMapDTO">
select datasource.*,
authInfo.privileges as `privileges`
from (select GET_V_AUTH_MODEL_ID_P_USE (#{extendCondition}, 'link') cids) t,datasource
left join (
SELECT
auth_source,
group_concat( DISTINCT sys_auth_detail.privilege_extend ) as `privileges`
FROM
(
`sys_auth`
LEFT JOIN `sys_auth_detail` ON ((
`sys_auth`.`id` = `sys_auth_detail`.`auth_id`
)))
WHERE
sys_auth_detail.privilege_value = 1
AND sys_auth.auth_source_type = 'link'
AND (
(
sys_auth.auth_target_type = 'dept'
AND sys_auth.auth_target IN ( SELECT dept_id FROM sys_user WHERE user_id = #{extendCondition} )
)
OR (
sys_auth.auth_target_type = 'user'
AND sys_auth.auth_target = #{extendCondition}
)
OR (
sys_auth.auth_target_type = 'role'
AND sys_auth.auth_target IN ( SELECT role_id FROM sys_users_roles WHERE user_id = #{extendCondition} )
)
)
GROUP BY
`sys_auth`.`auth_source`
) authInfo
on datasource.id = authInfo.auth_source
<if test="_parameter != null">
<include refid="io.dataease.ext.query.GridSql.gridCondition"/>
</if>
and FIND_IN_SET(datasource.id,cids)
<if test="orderByClause != null">
order by ${orderByClause}
</if>
<if test="orderByClause == null">
order by update_time desc
</if>
</select>
<select id="queryUnion" resultMap="BaseResultMapDTO">
select datasource.*,

View File

@ -12,7 +12,7 @@
</select>
<select id="nodesByExample" parameterType="io.dataease.ext.query.GridExample" resultMap="simpleNode">
<select id="nodesByExample" parameterType="io.dataease.plugins.xpack.dept.dto.request.XpackDeptGridRequest" resultMap="simpleNode">
select dept_id as id, pid from sys_dept where 1=1
<if test="pid != null">
and pid = #{pid}

View File

@ -1,6 +1,5 @@
package io.dataease.ext;
import io.dataease.ext.query.GridExample;
import io.dataease.dto.panel.PanelStoreDto;
import org.apache.ibatis.annotations.Param;

View File

@ -10,7 +10,7 @@
</resultMap>
<select id="query" parameterType="io.dataease.ext.query.GridExample" resultMap="panelStoreMap">
<select id="query" parameterType="java.lang.Long" resultMap="panelStoreMap">
select s.store_id, s.panel_group_id, g.name, g.status
from panel_store s
inner join panel_group g on g.id = s.panel_group_id

View File

@ -1,8 +1,7 @@
package io.dataease.ext;
import io.dataease.plugins.common.base.domain.SysMenu;
import io.dataease.ext.query.GridExample;
import io.dataease.controller.sys.request.SimpleTreeNode;
import io.dataease.plugins.common.base.domain.SysMenu;
import java.util.List;
@ -10,7 +9,6 @@ public interface ExtSysMenuMapper {
List<SimpleTreeNode> allNodes();
List<SimpleTreeNode> nodesByExample(GridExample example);
List<SysMenu> querySysMenu();
}

View File

@ -14,11 +14,7 @@
</select>
<select id="nodesByExample" parameterType="io.dataease.ext.query.GridExample" resultMap="simpleNode">
select menu_id as id, pid from sys_menu
<include refid="io.dataease.ext.query.GridSql.gridCondition" />
and hidden != 1
</select>
<select id="querySysMenu" resultMap="ExtBaseResultMap">

View File

@ -1,7 +1,6 @@
package io.dataease.ext;
import io.dataease.controller.sys.request.UserGridRequest;
import io.dataease.ext.query.GridExample;
import io.dataease.controller.sys.response.SysUserGridResponse;
import java.util.List;

View File

@ -1,303 +0,0 @@
package io.dataease.ext.query;
import io.dataease.controller.sys.base.ConditionEntity;
import org.apache.commons.lang3.StringUtils;
import java.util.ArrayList;
import java.util.List;
public class GridExample {
protected String orderByClause;
protected boolean distinct;
protected List<Criteria> oredCriteria;
protected String extendCondition;
public GridExample() {
oredCriteria = new ArrayList<Criteria>();
}
public String getExtendCondition() {
return extendCondition;
}
public void setExtendCondition(String extendCondition) {
this.extendCondition = extendCondition;
}
public void setOrderByClause(String orderByClause) {
this.orderByClause = orderByClause;
}
public String getOrderByClause() {
return orderByClause;
}
public void setDistinct(boolean distinct) {
this.distinct = distinct;
}
public boolean isDistinct() {
return distinct;
}
public List<Criteria> getOredCriteria() {
return oredCriteria;
}
public void or(Criteria criteria) {
oredCriteria.add(criteria);
}
public Criteria or() {
Criteria criteria = createCriteriaInternal();
oredCriteria.add(criteria);
return criteria;
}
public Criteria createCriteria() {
Criteria criteria = createCriteriaInternal();
if (oredCriteria.size() == 0) {
oredCriteria.add(criteria);
}
return criteria;
}
protected Criteria createCriteriaInternal() {
Criteria criteria = new Criteria();
return criteria;
}
public void clear() {
oredCriteria.clear();
orderByClause = null;
distinct = false;
}
protected abstract static class GeneratedCriteria {
protected List<Criterion> criteria;
protected GeneratedCriteria() {
super();
criteria = new ArrayList<Criterion>();
}
public boolean isValid() {
return criteria.size() > 0;
}
public List<Criterion> getAllCriteria() {
return criteria;
}
public List<Criterion> getCriteria() {
return criteria;
}
protected void addCriterion(String condition) {
if (condition == null) {
throw new RuntimeException("Value for condition cannot be null");
}
criteria.add(new Criterion(condition));
}
protected void addNotNullCriterion(String condition) {
criteria.add(new Criterion(condition, null));
}
protected void addCriterion(String condition, Object value, String property) {
if (value == null) {
throw new RuntimeException("Value for " + property + " cannot be null");
}
criteria.add(new Criterion(condition, value));
}
protected void addSqlCriterion(String condition, Object value, String property) {
if (value == null) {
throw new RuntimeException("Value for " + property + " cannot be null");
}
Criterion criterion = new Criterion(condition, value);
criterion.sqlValue = true;
criteria.add(criterion);
}
protected void addCriterion(String condition, Object value1, Object value2, String property) {
if (value1 == null || value2 == null) {
throw new RuntimeException("Between values for " + property + " cannot be null");
}
criteria.add(new Criterion(condition, value1, value2));
}
public Criteria addCondition(ConditionEntity conditionEntity){
String field = conditionEntity.getField();
Object value = conditionEntity.getValue();
String operator = conditionEntity.getOperator();
if (StringUtils.isEmpty(operator))
operator = "like";
switch (operator){
case "eq":
addCriterion(field+" = ", value, field);
break;
case "ne":
addCriterion(field+" <> ", value, field);
break;
case "like":
addCriterion(field+" like ", "%"+value+"%", field);
break;
case "not like":
addCriterion(field+" not like ", "%"+value+"%", field);
break;
case "in":
List<Object> invalues = (List<Object>)value;
addCriterion(field+" in", invalues, field);
break;
case "not in":
List<Object> notinvalues = (List<Object>)value;
addCriterion(field+" not in", notinvalues, field);
break;
case "between":
List<Object> values = (List<Object>)value;
Object v1 = values.get(0);
Object v2 = values.get(1);
addCriterion(field+" between", v1, v2, field);
break;
case "gt":
addCriterion(field+" > ", value, field);
break;
case "ge":
addCriterion(field+" >= ", value, field);
break;
case "lt":
addCriterion(field+" < ", value, field);
break;
case "le":
addCriterion(field+" <= ", value, field);
break;
case "not null":
addNotNullCriterion(field + " is not null ");
break;
case "extra":
addCriterion(field);
break;
case "sql in":
addCriterion(field+" in ", value, field);
break;
}
return (Criteria) this;
}
}
public static class Criteria extends GeneratedCriteria {
protected Criteria() {
super();
}
}
public static class Criterion {
private String condition;
private Object value;
private Object secondValue;
private boolean noValue;
private boolean singleValue;
private boolean betweenValue;
private boolean listValue;
public boolean isSqlValue() {
return sqlValue;
}
public void setSqlValue(boolean sqlValue) {
this.sqlValue = sqlValue;
}
private boolean sqlValue;
private String typeHandler;
public String getCondition() {
return condition;
}
public Object getValue() {
return value;
}
public Object getSecondValue() {
return secondValue;
}
public boolean isNoValue() {
return noValue;
}
public boolean isSingleValue() {
return singleValue;
}
public boolean isBetweenValue() {
return betweenValue;
}
public boolean isListValue() {
return listValue;
}
public String getTypeHandler() {
return typeHandler;
}
protected Criterion(String condition) {
super();
this.condition = condition;
this.typeHandler = null;
this.noValue = true;
}
protected Criterion(String condition, Object value, String typeHandler) {
super();
this.condition = condition;
this.value = value;
this.typeHandler = typeHandler;
if(value == null){
this.noValue = true;
}else if (value instanceof List<?>) {
this.listValue = true;
} else {
this.singleValue = true;
}
}
protected Criterion(String condition, Object value) {
this(condition, value, null);
}
protected Criterion(String condition, Object value, Object secondValue, String typeHandler) {
super();
this.condition = condition;
this.value = value;
this.secondValue = secondValue;
this.typeHandler = typeHandler;
this.betweenValue = true;
}
protected Criterion(String condition, Object value, Object secondValue) {
this(condition, value, secondValue, null);
}
}
}

View File

@ -1,4 +0,0 @@
package io.dataease.ext.query;
public interface GridSql {
}

View File

@ -1,67 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="io.dataease.ext.query.GridSql">
<sql id="gridCondition">
<where>
<foreach collection="oredCriteria" item="criteria" separator="or">
<if test="criteria.valid">
<trim prefix="(" prefixOverrides="and" suffix=")">
<foreach collection="criteria.criteria" item="criterion">
<choose>
<when test="criterion.noValue">
and ${criterion.condition}
</when>
<when test="criterion.singleValue">
and ${criterion.condition} #{criterion.value}
</when>
<when test="criterion.betweenValue">
and ${criterion.condition} #{criterion.value} and #{criterion.secondValue}
</when>
<when test="criterion.listValue">
and ${criterion.condition}
<foreach close=")" collection="criterion.value" item="listItem" open="(" separator=",">
#{listItem}
</foreach>
</when>
</choose>
</foreach>
</trim>
</if>
</foreach>
</where>
</sql>
<sql id="taskListGridCondition">
<where>
dataset_table.id in (SELECT `sys_auth`.`auth_source` FROM `sys_auth` LEFT JOIN `sys_auth_detail` ON `sys_auth`.`id` = `sys_auth_detail`.`auth_id` LEFT JOIN `dataset_table` ON `dataset_table`.`id` = `sys_auth`.`auth_source` WHERE `sys_auth_detail`.`privilege_type` = '1' and `sys_auth_detail`.`privilege_value` = '1'and `sys_auth`.`auth_source_type` = 'dataset' AND ((`sys_auth`.`auth_target_type` = 'dept' AND `sys_auth`.`auth_target` in ( SELECT dept_id FROM `sys_user` WHERE `sys_user`.`user_id` = #{extendCondition} )) OR (sys_auth.auth_target_type = 'user'AND sys_auth.auth_target = #{extendCondition} ) OR (sys_auth.auth_target_type = 'role' AND `sys_auth`.`auth_target` in ( SELECT role_id FROM `sys_users_roles` WHERE `sys_users_roles`.`user_id` = #{extendCondition} )) OR (1 = ( SELECT is_admin FROM `sys_user` WHERE `sys_user`.`user_id` = #{extendCondition} )))) and
<foreach collection="oredCriteria" item="criteria" separator="or">
<if test="criteria.valid">
<trim prefix="(" prefixOverrides="and" suffix=")">
<foreach collection="criteria.criteria" item="criterion">
<choose>
<when test="criterion.noValue">
and ${criterion.condition}
</when>
<when test="criterion.singleValue">
and ${criterion.condition} #{criterion.value}
</when>
<when test="criterion.betweenValue">
and ${criterion.condition} #{criterion.value} and #{criterion.secondValue}
</when>
<when test="criterion.listValue">
and ${criterion.condition}
<foreach close=")" collection="criterion.value" item="listItem" open="(" separator=",">
#{listItem}
</foreach>
</when>
</choose>
</foreach>
</trim>
</if>
</foreach>
</where>
</sql>
</mapper>

View File

@ -1,21 +1,16 @@
package io.dataease.service.dataset;
import cn.hutool.core.date.DateUtil;
import io.dataease.commons.constants.SysLogConstants;
import io.dataease.commons.utils.AuthUtils;
import io.dataease.commons.utils.ServletUtils;
import io.dataease.controller.dataset.request.DataSetTaskInstanceGridRequest;
import io.dataease.exception.DataEaseException;
import io.dataease.ext.ExtDataSetTaskMapper;
import io.dataease.ext.query.GridExample;
import io.dataease.commons.utils.AuthUtils;
import io.dataease.controller.sys.base.BaseGridRequest;
import io.dataease.controller.sys.base.ConditionEntity;
import io.dataease.dto.dataset.DataSetTaskDTO;
import io.dataease.dto.dataset.DataSetTaskLogDTO;
import io.dataease.exception.DataEaseException;
import io.dataease.ext.ExtDataSetTaskMapper;
import io.dataease.i18n.Translator;
import io.dataease.plugins.common.base.domain.DatasetTableTaskLog;
import io.dataease.plugins.common.base.domain.DatasetTableTaskLogExample;
import io.dataease.plugins.common.base.domain.SysLogWithBLOBs;
import io.dataease.plugins.common.base.mapper.DatasetTableTaskLogMapper;
import io.dataease.plugins.common.base.mapper.DatasetTableTaskMapper;
import org.apache.commons.collections4.CollectionUtils;
@ -34,7 +29,6 @@ import javax.annotation.Resource;
import javax.servlet.http.HttpServletResponse;
import java.io.OutputStream;
import java.net.URLEncoder;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import java.util.UUID;

View File

@ -13,7 +13,6 @@ import io.dataease.controller.request.panel.PanelShareFineDto;
import io.dataease.controller.request.panel.PanelShareRemoveRequest;
import io.dataease.controller.request.panel.PanelShareRequest;
import io.dataease.controller.request.panel.PanelShareSearchRequest;
import io.dataease.controller.sys.base.BaseGridRequest;
import io.dataease.dto.panel.PanelShareDto;
import io.dataease.dto.panel.PanelShareOutDTO;
import io.dataease.dto.panel.PanelSharePo;

View File

@ -1,12 +0,0 @@
package io.dataease.service.panel.applog;
import io.dataease.ext.query.GridExample;
import lombok.Data;
import java.util.List;
@Data
public class AppLogQueryParam extends GridExample {
private String userId;
}

View File

@ -1,12 +1,9 @@
package io.dataease.service.panel.applog;
import com.google.gson.Gson;
import io.dataease.commons.utils.AuthUtils;
import io.dataease.controller.sys.request.KeyGridRequest;
import io.dataease.dto.SysLogDTO;
import io.dataease.controller.request.panel.AppLogGridRequest;
import io.dataease.dto.appTemplateMarket.AppLogGridDTO;
import io.dataease.ext.ExtAppLogMapper;
import io.dataease.ext.query.GridExample;
import io.dataease.plugins.common.base.mapper.PanelAppTemplateLogMapper;
import io.dataease.service.dataset.DataSetGroupService;
import io.dataease.service.datasource.DatasourceService;
@ -21,7 +18,6 @@ import java.util.List;
@Service
public class AppLogService {
private Gson gson = new Gson();
@Resource
private PanelAppTemplateLogMapper appLogMapper;
@Resource
@ -34,17 +30,9 @@ public class AppLogService {
private DatasourceService datasourceService;
public List<AppLogGridDTO> query(KeyGridRequest request) {
GridExample gridExample = request.convertExample();
gridExample.setExtendCondition(request.getKeyWord());
AppLogQueryParam logQueryParam = gson.fromJson(gson.toJson(gridExample), AppLogQueryParam.class);
logQueryParam.setUserId(String.valueOf(AuthUtils.getUser().getUserId()));
List<AppLogGridDTO> voLogs = extAppLogMapper.query(logQueryParam);
return voLogs;
}
public void saveLog(SysLogDTO sysLogDTO) {
public List<AppLogGridDTO> query(AppLogGridRequest request) {
request.setUserId(AuthUtils.getUser().getUserId());
return extAppLogMapper.query(request);
}

View File

@ -12,7 +12,6 @@ import io.dataease.controller.sys.request.*;
import io.dataease.controller.sys.response.SysUserGridResponse;
import io.dataease.controller.sys.response.SysUserRole;
import io.dataease.ext.ExtSysUserMapper;
import io.dataease.ext.query.GridExample;
import io.dataease.i18n.Translator;
import io.dataease.plugins.common.base.domain.*;
import io.dataease.plugins.common.base.mapper.SysUserAssistMapper;

View File

@ -1,12 +0,0 @@
package io.dataease.service.sys.log;
import io.dataease.ext.query.GridExample;
import lombok.Data;
import java.util.List;
@Data
public class LogQueryParam extends GridExample {
private List<String> unionIds;
}