|
|
|
@ -399,40 +399,6 @@ public class ModelServiceImpl implements ModelService {
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private boolean checkSql(String sql, List<String> allowedTables) {
|
|
|
|
|
if (StringUtils.isEmpty(sql)) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
if (CollUtil.isEmpty(allowedTables)) {
|
|
|
|
|
log.info("checkSql:未配置允许的表");
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
MySqlStatementParser parser = new MySqlStatementParser(sql);
|
|
|
|
|
SQLStatement sqlStatement = SqlParserUtil.parseStatement(parser);
|
|
|
|
|
if (Objects.isNull(sqlStatement)) {
|
|
|
|
|
log.warn("checkSql sql:{}语句解析失败", sql);
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
String sqlType = SqlParserUtil.detectSQLType(sqlStatement);
|
|
|
|
|
if (!"SELECT".equals(sqlType)) {
|
|
|
|
|
log.warn("checkSql:只支持查询类型语句");
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
List<String> tableList = SqlParserUtil.extractTableNames(sqlStatement);
|
|
|
|
|
if (CollUtil.isEmpty(tableList)) {
|
|
|
|
|
log.warn("checkSql:未检测到表");
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
long count = tableList.stream().filter(table -> !allowedTables.contains(table)).count();
|
|
|
|
|
if (count > 0) {
|
|
|
|
|
log.warn("checkSql:表{}不在允许的表列表中", tableList);
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* 执行结果分析:
|
|
|
|
|
* 1. 如果查询出的结果只有一行,判断列数是否大于1,如果大于1,返回真,如果=1,继续判断值是否大于0,如果大于0,返回真,如果=0,返回假
|
|
|
|
|