center/dataease-dm
center/dataease-dm
13
0
Fork 0
forked from github/dataease
Code Pull Requests Activity

fix: 行列权限接口sql-inject

Browse Source
This commit is contained in:
fit2cloud-chenyw 2023-09-12 11:09:58 +08:00
parent 849f110f7f
commit f0b0771aea
13 changed files with 26 additions and 409 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
core/backend/src/main/java/io/dataease/plugins/server/ColumnPermissionsController.java
View File

@ -8,8 +8,6 @@ import io.dataease.commons.constants.ResourceAuthLevel;
import io.dataease.commons.utils.PageUtils;
import io.dataease.commons.utils.Pager;
import io.dataease.i18n.Translator;
import io.dataease.plugins.common.entity.XpackConditionEntity;
import io.dataease.plugins.common.entity.XpackGridRequest;
import io.dataease.plugins.config.SpringContextUtil;
import io.dataease.plugins.xpack.auth.dto.request.DataSetColumnPermissionsDTO;
import io.dataease.plugins.xpack.auth.dto.request.DatasetColumnPermissions;
@ -19,8 +17,9 @@ import org.apache.commons.lang3.StringUtils;
import org.springframework.util.CollectionUtils;
import org.springframework.web.bind.annotation.*;
import springfox.documentation.annotations.ApiIgnore;
import java.util.ArrayList;
import java.util.List;
@ApiIgnore
@RestController
@RequestMapping("plugin/dataset/columnPermissions")
@ -36,15 +35,15 @@ public class ColumnPermissionsController {
request.setAuthTargetId(datasetColumnPermissions.getAuthTargetId());
request.setDatasetId(datasetColumnPermissions.getDatasetId());
List<DataSetColumnPermissionsDTO> columnPermissionsDTOS = columnPermissionService.searchPermissions(request);
if(StringUtils.isEmpty(datasetColumnPermissions.getId())){
if(!CollectionUtils.isEmpty(columnPermissionsDTOS)){
if (StringUtils.isEmpty(datasetColumnPermissions.getId())) {
if (!CollectionUtils.isEmpty(columnPermissionsDTOS)) {
throw new Exception(Translator.get("i18n_cp_exist"));
}
}else {
if(!CollectionUtils.isEmpty(columnPermissionsDTOS) && columnPermissionsDTOS.size() > 1){
} else {
if (!CollectionUtils.isEmpty(columnPermissionsDTOS) && columnPermissionsDTOS.size() > 1) {
throw new Exception(Translator.get("i18n_cp_exist"));
}
if(columnPermissionsDTOS.size() == 1 && !columnPermissionsDTOS.get(0).getId().equalsIgnoreCase(datasetColumnPermissions.getId())){
if (columnPermissionsDTOS.size() == 1 && !columnPermissionsDTOS.get(0).getId().equalsIgnoreCase(datasetColumnPermissions.getId())) {
throw new Exception(Translator.get("i18n_cp_exist"));
}
}
@ -56,7 +55,7 @@ public class ColumnPermissionsController {
@PostMapping("/list")
public List<DataSetColumnPermissionsDTO> searchPermissions(@RequestBody DataSetColumnPermissionsDTO request) {
ColumnPermissionService columnPermissionService = SpringContextUtil.getBean(ColumnPermissionService.class);
return columnPermissionService.searchPermissions(request);
return columnPermissionService.searchPermissions(request);
}
@DePermission(type = DePermissionType.DATASET, value = "datasetId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE)
@ -70,17 +69,11 @@ public class ColumnPermissionsController {
@DePermission(type = DePermissionType.DATASET, level = ResourceAuthLevel.DATASET_LEVEL_MANAGE)
@ApiOperation("分页查询")
@PostMapping("/pageList/{datasetId}/{goPage}/{pageSize}")
public Pager<List<DataSetColumnPermissionsDTO>> rowPermissions(@PathVariable String datasetId, @PathVariable int goPage, @PathVariable int pageSize, @RequestBody XpackGridRequest request) {
public Pager<List<DataSetColumnPermissionsDTO>> rowPermissions(@PathVariable String datasetId, @PathVariable int goPage, @PathVariable int pageSize) {
Page<Object> page = PageHelper.startPage(goPage, pageSize, true);
ColumnPermissionService columnPermissionService = SpringContextUtil.getBean(ColumnPermissionService.class);
List<XpackConditionEntity> conditionEntities = request.getConditions() == null ? new ArrayList<>() : request.getConditions();
XpackConditionEntity entity = new XpackConditionEntity();
entity.setField("dataset_column_permissions.dataset_id");
entity.setOperator("eq");
entity.setValue(datasetId);
conditionEntities.add(entity);
request.setConditions(conditionEntities);
return PageUtils.setPageInfo(page, columnPermissionService.queryPermissions(request));
return PageUtils.setPageInfo(page, columnPermissionService.queryPermissions(datasetId));
}
@DePermission(type = DePermissionType.DATASET, value = "datasetId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE)

29
core/backend/src/main/java/io/dataease/plugins/server/RowPermissionsController.java
View File

@ -8,21 +8,18 @@ import io.dataease.commons.constants.ResourceAuthLevel;
import io.dataease.commons.utils.PageUtils;
import io.dataease.commons.utils.Pager;
import io.dataease.i18n.Translator;
import io.dataease.plugins.common.entity.XpackConditionEntity;
import io.dataease.plugins.common.entity.XpackGridRequest;
import io.dataease.plugins.config.SpringContextUtil;
import io.dataease.plugins.xpack.auth.dto.request.DataSetRowPermissionsDTO;
import io.dataease.plugins.xpack.auth.dto.request.DatasetRowPermissions;
import io.dataease.plugins.xpack.auth.service.RowPermissionService;
import io.swagger.annotations.ApiOperation;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.util.CollectionUtils;
import org.springframework.web.bind.annotation.*;
import springfox.documentation.annotations.ApiIgnore;
import java.util.ArrayList;
import java.util.List;
@ApiIgnore
@RestController
@RequestMapping("plugin/dataset/rowPermissions")
@ -39,15 +36,15 @@ public class RowPermissionsController {
request.setAuthTargetId(datasetRowPermissions.getAuthTargetId());
request.setDatasetFieldId(datasetRowPermissions.getDatasetFieldId());
List<DataSetRowPermissionsDTO> rowPermissionsDTOS = rowPermissionService.searchRowPermissions(request);
if(StringUtils.isEmpty(datasetRowPermissions.getId())){
if(!CollectionUtils.isEmpty(rowPermissionsDTOS)){
if (StringUtils.isEmpty(datasetRowPermissions.getId())) {
if (!CollectionUtils.isEmpty(rowPermissionsDTOS)) {
throw new Exception(Translator.get("i18n_rp_exist"));
}
}else {
if(!CollectionUtils.isEmpty(rowPermissionsDTOS) && rowPermissionsDTOS.size() > 1){
} else {
if (!CollectionUtils.isEmpty(rowPermissionsDTOS) && rowPermissionsDTOS.size() > 1) {
throw new Exception(Translator.get("i18n_rp_exist"));
}
if(rowPermissionsDTOS.size() == 1 && !rowPermissionsDTOS.get(0).getId().equalsIgnoreCase(datasetRowPermissions.getId())){
if (rowPermissionsDTOS.size() == 1 && !rowPermissionsDTOS.get(0).getId().equalsIgnoreCase(datasetRowPermissions.getId())) {
throw new Exception(Translator.get("i18n_rp_exist"));
}
}
@ -59,7 +56,7 @@ public class RowPermissionsController {
@PostMapping("/list")
public List<DataSetRowPermissionsDTO> rowPermissions(@RequestBody DataSetRowPermissionsDTO request) {
RowPermissionService rowPermissionService = SpringContextUtil.getBean(RowPermissionService.class);
return rowPermissionService.searchRowPermissions(request);
return rowPermissionService.searchRowPermissions(request);
}
@DePermission(type = DePermissionType.DATASET, value = "datasetId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE)
@ -73,17 +70,11 @@ public class RowPermissionsController {
@DePermission(type = DePermissionType.DATASET, value = "datasetId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE)
@ApiOperation("分页查询")
@PostMapping("/pageList/{datasetId}/{goPage}/{pageSize}")
public Pager<List<DataSetRowPermissionsDTO>> rowPermissions(@PathVariable String datasetId, @PathVariable int goPage, @PathVariable int pageSize, @RequestBody XpackGridRequest request) {
public Pager<List<DataSetRowPermissionsDTO>> rowPermissions(@PathVariable String datasetId, @PathVariable int goPage, @PathVariable int pageSize) {
Page<Object> page = PageHelper.startPage(goPage, pageSize, true);
RowPermissionService rowPermissionService = SpringContextUtil.getBean(RowPermissionService.class);
List<XpackConditionEntity> conditionEntities = request.getConditions() == null ? new ArrayList<>() : request.getConditions();
XpackConditionEntity entity = new XpackConditionEntity();
entity.setField("dataset_row_permissions.dataset_id");
entity.setOperator("eq");
entity.setValue(datasetId);
conditionEntities.add(entity);
request.setConditions(conditionEntities);
return PageUtils.setPageInfo(page, rowPermissionService.queryRowPermissions(request));
return PageUtils.setPageInfo(page, rowPermissionService.queryRowPermissions(datasetId));
}
@DePermission(type = DePermissionType.DATASET, value = "datasetId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE)

2
core/backend/src/main/java/io/dataease/plugins/server/XDeptServer.java
View File

@ -20,7 +20,6 @@ import io.dataease.commons.utils.Pager;
import io.dataease.controller.sys.response.DeptNodeResponse;
import io.dataease.dto.SysLogDTO;
import io.dataease.listener.util.CacheUtils;
import io.dataease.plugins.common.entity.XpackGridRequest;
import io.dataease.plugins.config.SpringContextUtil;
import io.dataease.plugins.xpack.dept.dto.request.*;
import io.dataease.plugins.xpack.dept.dto.response.DeptUserItemDTO;
@ -33,7 +32,6 @@ import io.swagger.annotations.ApiImplicitParams;
import io.swagger.annotations.ApiOperation;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cache.annotation.CacheEvict;
import org.springframework.web.bind.annotation.*;
import springfox.documentation.annotations.ApiIgnore;

2
core/backend/src/main/java/io/dataease/plugins/server/XEmailTaskServer.java
View File

@ -14,8 +14,6 @@ import io.dataease.commons.utils.*;
import io.dataease.i18n.Translator;
import io.dataease.plugins.common.entity.GlobalTaskEntity;
import io.dataease.plugins.common.entity.GlobalTaskInstance;
import io.dataease.plugins.common.entity.XpackConditionEntity;
import io.dataease.plugins.common.entity.XpackGridRequest;
import io.dataease.plugins.config.SpringContextUtil;
import io.dataease.plugins.xpack.email.dto.request.*;
import io.dataease.plugins.xpack.email.dto.response.XpackTaskEntity;

17
sdk/dataease-plugin-common/src/main/java/io/dataease/plugins/common/entity/XpackConditionEntity.java
View File

@ -1,17 +0,0 @@
package io.dataease.plugins.common.entity;
import io.dataease.plugins.common.annotation.PluginResultMap;
import lombok.Data;
import java.io.Serializable;
@Data
@PluginResultMap
public class XpackConditionEntity implements Serializable {
private String field;
private String operator;
private Object value;
}

271
sdk/dataease-plugin-common/src/main/java/io/dataease/plugins/common/entity/XpackGridExample.java
View File

@ -1,271 +0,0 @@
package io.dataease.plugins.common.entity;
import io.dataease.plugins.common.annotation.PluginResultMap;
import org.springframework.util.StringUtils;
import java.util.ArrayList;
import java.util.List;
@PluginResultMap
public class XpackGridExample {
protected String orderByClause;
protected boolean distinct;
protected List<Criteria> oredCriteria;
protected String extendCondition;
public XpackGridExample() {
oredCriteria = new ArrayList<Criteria>();
}
public String getExtendCondition() {
return extendCondition;
}
public void setExtendCondition(String extendCondition) {
this.extendCondition = extendCondition;
}
public void setOrderByClause(String orderByClause) {
this.orderByClause = orderByClause;
}
public String getOrderByClause() {
return orderByClause;
}
public void setDistinct(boolean distinct) {
this.distinct = distinct;
}
public boolean isDistinct() {
return distinct;
}
public List<Criteria> getOredCriteria() {
return oredCriteria;
}
public void or(Criteria criteria) {
oredCriteria.add(criteria);
}
public Criteria or() {
Criteria criteria = createCriteriaInternal();
oredCriteria.add(criteria);
return criteria;
}
public Criteria createCriteria() {
Criteria criteria = createCriteriaInternal();
if (oredCriteria.size() == 0) {
oredCriteria.add(criteria);
}
return criteria;
}
protected Criteria createCriteriaInternal() {
Criteria criteria = new Criteria();
return criteria;
}
public void clear() {
oredCriteria.clear();
orderByClause = null;
distinct = false;
}
protected abstract static class GeneratedCriteria {
protected List<Criterion> criteria;
protected GeneratedCriteria() {
super();
criteria = new ArrayList<Criterion>();
}
public boolean isValid() {
return criteria.size() > 0;
}
public List<Criterion> getAllCriteria() {
return criteria;
}
public List<Criterion> getCriteria() {
return criteria;
}
protected void addCriterion(String condition) {
if (condition == null) {
throw new RuntimeException("Value for condition cannot be null");
}
criteria.add(new Criterion(condition));
}
protected void addCriterion(String condition, Object value, String property) {
if (value == null) {
throw new RuntimeException("Value for " + property + " cannot be null");
}
criteria.add(new Criterion(condition, value));
}
protected void addCriterion(String condition, Object value1, Object value2, String property) {
if (value1 == null || value2 == null) {
throw new RuntimeException("Between values for " + property + " cannot be null");
}
criteria.add(new Criterion(condition, value1, value2));
}
public Criteria addCondition(XpackConditionEntity conditionEntity){
String field = conditionEntity.getField();
Object value = conditionEntity.getValue();
String operator = conditionEntity.getOperator();
if (StringUtils.isEmpty(operator))
operator = "like";
switch (operator){
case "eq":
addCriterion(field+" = ", value, field);
break;
case "ne":
addCriterion(field+" <> ", value, field);
break;
case "like":
addCriterion(field+" like ", "%"+value+"%", field);
break;
case "not like":
addCriterion(field+" not like ", "%"+value+"%", field);
break;
case "in":
List<Object> invalues = (List<Object>)value;
addCriterion(field+" in", invalues, field);
break;
case "not in":
List<Object> notinvalues = (List<Object>)value;
addCriterion(field+" not in", notinvalues, field);
break;
case "between":
List<Object> values = (List<Object>)value;
Object v1 = values.get(0);
Object v2 = values.get(1);
addCriterion(field+" between", v1, v2, field);
break;
case "gt":
addCriterion(field+" > ", value, field);
break;
case "ge":
addCriterion(field+" >= ", value, field);
break;
case "lt":
addCriterion(field+" < ", value, field);
break;
case "le":
addCriterion(field+" <= ", value, field);
break;
}
return (Criteria) this;
}
}
public static class Criteria extends GeneratedCriteria {
protected Criteria() {
super();
}
}
public static class Criterion {
private String condition;
private Object value;
private Object secondValue;
private boolean noValue;
private boolean singleValue;
private boolean betweenValue;
private boolean listValue;
private String typeHandler;
public String getCondition() {
return condition;
}
public Object getValue() {
return value;
}
public Object getSecondValue() {
return secondValue;
}
public boolean isNoValue() {
return noValue;
}
public boolean isSingleValue() {
return singleValue;
}
public boolean isBetweenValue() {
return betweenValue;
}
public boolean isListValue() {
return listValue;
}
public String getTypeHandler() {
return typeHandler;
}
protected Criterion(String condition) {
super();
this.condition = condition;
this.typeHandler = null;
this.noValue = true;
}
protected Criterion(String condition, Object value, String typeHandler) {
super();
this.condition = condition;
this.value = value;
this.typeHandler = typeHandler;
if (value instanceof List<?>) {
this.listValue = true;
} else {
this.singleValue = true;
}
}
protected Criterion(String condition, Object value) {
this(condition, value, null);
}
protected Criterion(String condition, Object value, Object secondValue, String typeHandler) {
super();
this.condition = condition;
this.value = value;
this.secondValue = secondValue;
this.typeHandler = typeHandler;
this.betweenValue = true;
}
protected Criterion(String condition, Object value, Object secondValue) {
this(condition, value, secondValue, null);
}
}
}

29
sdk/dataease-plugin-common/src/main/java/io/dataease/plugins/common/entity/XpackGridRequest.java
View File

@ -1,29 +0,0 @@
package io.dataease.plugins.common.entity;
import lombok.Data;
import org.springframework.util.CollectionUtils;
import java.io.Serializable;
import java.util.List;
@Data
public class XpackGridRequest implements Serializable {
private List<XpackConditionEntity> conditions;
private List<String> orders;
public XpackGridExample convertExample(){
XpackGridExample gridExample = new XpackGridExample();
if (!CollectionUtils.isEmpty(conditions)){
XpackGridExample.Criteria criteria = gridExample.createCriteria();
conditions.forEach(criteria::addCondition);
}
if (!CollectionUtils.isEmpty(orders)) {
String orderByClause = String.join(", ", orders);
gridExample.setOrderByClause(orderByClause);
}
return gridExample;
}
}

4
sdk/dataease-plugin-common/src/main/java/io/dataease/plugins/common/mapper/PluginGridSql.java
View File

@ -1,4 +0,0 @@
package io.dataease.plugins.common.mapper;
public interface PluginGridSql {
}

35
sdk/dataease-plugin-common/src/main/java/io/dataease/plugins/common/mapper/PluginGridSql.xml
View File

@ -1,35 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="io.dataease.plugins.common.mapper.PluginGridSql">
<sql id="gridCondition">
<where>
<foreach collection="oredCriteria" item="criteria" separator="or">
<if test="criteria.valid">
<trim prefix="(" prefixOverrides="and" suffix=")">
<foreach collection="criteria.criteria" item="criterion">
<choose>
<when test="criterion.noValue">
and ${criterion.condition}
</when>
<when test="criterion.singleValue">
and ${criterion.condition} #{criterion.value}
</when>
<when test="criterion.betweenValue">
and ${criterion.condition} #{criterion.value} and #{criterion.secondValue}
</when>
<when test="criterion.listValue">
and ${criterion.condition}
<foreach close=")" collection="criterion.value" item="listItem" open="(" separator=",">
#{listItem}
</foreach>
</when>
</choose>
</foreach>
</trim>
</if>
</foreach>
</where>
</sql>
</mapper>

3
sdk/dataease-plugin-datasource/src/main/java/io/dataease/plugins/datasource/service/DatasourceService.java
View File

@ -1,11 +1,8 @@
package io.dataease.plugins.datasource.service;
import io.dataease.plugins.common.dto.datasource.DataSourceType;
import io.dataease.plugins.common.entity.XpackGridRequest;
import io.dataease.plugins.common.service.PluginComponentService;
import java.util.List;
public abstract class DatasourceService extends PluginComponentService {
abstract public DataSourceType getDataSourceType();

5
sdk/dataease-plugin-interface/src/main/java/io/dataease/plugins/xpack/auth/service/ColumnPermissionService.java
View File

@ -1,6 +1,5 @@
package io.dataease.plugins.xpack.auth.service;
import io.dataease.plugins.common.entity.XpackGridRequest;
import io.dataease.plugins.common.service.PluginComponentService;
import io.dataease.plugins.xpack.auth.dto.request.DataSetColumnPermissionsDTO;
import io.dataease.plugins.xpack.auth.dto.request.DatasetColumnPermissions;
@ -9,9 +8,9 @@ import java.util.List;
public abstract class ColumnPermissionService extends PluginComponentService {
public abstract List<DataSetColumnPermissionsDTO> searchPermissions(DataSetColumnPermissionsDTO request);
public abstract List<DataSetColumnPermissionsDTO> queryPermissions(XpackGridRequest arg0) ;
public abstract List<DataSetColumnPermissionsDTO> queryPermissions(String tableId) ;
public abstract DatasetColumnPermissions save(DatasetColumnPermissions datasetColumnPermissions);
public abstract void delete(String id);
public abstract List<? extends Object> authObjs(DataSetColumnPermissionsDTO request);
public abstract List<?> authObjs(DataSetColumnPermissionsDTO request);
public abstract DataSetColumnPermissionsDTO permissionInfo(DataSetColumnPermissionsDTO datasetRowPermissions);
}

3
sdk/dataease-plugin-interface/src/main/java/io/dataease/plugins/xpack/auth/service/RowPermissionService.java
View File

@ -1,6 +1,5 @@
package io.dataease.plugins.xpack.auth.service;
import io.dataease.plugins.common.entity.XpackGridRequest;
import io.dataease.plugins.common.service.PluginComponentService;
import io.dataease.plugins.xpack.auth.dto.request.DataSetRowPermissionsDTO;
import io.dataease.plugins.xpack.auth.dto.request.DatasetRowPermissions;
@ -9,7 +8,7 @@ import java.util.List;
public abstract class RowPermissionService extends PluginComponentService {
public abstract List<DataSetRowPermissionsDTO> searchRowPermissions(DataSetRowPermissionsDTO request);
public abstract List<DataSetRowPermissionsDTO> queryRowPermissions(XpackGridRequest arg0) ;
public abstract List<DataSetRowPermissionsDTO> queryRowPermissions(String tableId) ;
public abstract void save(DatasetRowPermissions datasetRowPermissions);
public abstract void delete(String id);
public abstract List<? extends Object> authObjs(DataSetRowPermissionsDTO request);

6
sdk/dataease-plugin-interface/src/main/java/io/dataease/plugins/xpack/email/service/EmailXpackService.java
View File

@ -1,10 +1,7 @@
package io.dataease.plugins.xpack.email.service;
import java.util.List;
import io.dataease.plugins.common.entity.GlobalTaskEntity;
import io.dataease.plugins.common.entity.GlobalTaskInstance;
import io.dataease.plugins.common.entity.XpackGridRequest;
import io.dataease.plugins.common.service.PluginMenuService;
import io.dataease.plugins.xpack.email.dto.request.XpackEmailInstanceGridRequest;
import io.dataease.plugins.xpack.email.dto.request.XpackEmailTaskGridRequest;
@ -15,6 +12,8 @@ import io.dataease.plugins.xpack.email.dto.response.XpackTaskEntity;
import io.dataease.plugins.xpack.email.dto.response.XpackTaskGridDTO;
import io.dataease.plugins.xpack.email.dto.response.XpackTaskInstanceDTO;
import java.util.List;
public abstract class EmailXpackService extends PluginMenuService {
public abstract int save(XpackEmailTaskRequest request) throws Exception;
@ -53,7 +52,6 @@ public abstract class EmailXpackService extends PluginMenuService {
public abstract void batchDel(List<Long> taskIds);
public abstract void export(XpackGridRequest request);
public abstract Boolean status(Long taskId);