经验首页 前端设计 程序设计 Java相关 移动开发 数据库/运维 软件/图像 大数据/云计算 其他经验
当前位置：技术经验 » 数据库/运维 » MyBatis » 查看文章
MyBatis?Generator生成的$?sql是否存在注入风险详解
来源：jb51　　时间：2021/12/15 9:11:44　　对本文有异议

代理商sql注入问题排查

经全面排查，代理商中sql层使用'$'获取对象的只有一种类型，代码格式如下：

  1. <sql id="Example_Where_Clause">
  2.    <!-- WARNING - @mbggenerated This element is automatically generated by 
  3.       MyBatis Generator, do not modify. -->
  4.   <where>
  5.       <foreach collection="oredCriteria" item="criteria" separator="or">
  6.          <if test="criteria.valid">
  7.             <trim prefix="(" suffix=")" prefixOverrides="and">
  8.                <foreach collection="criteria.criteria" item="criterion">
  9.                   <choose>
  10.                      <when test="criterion.noValue">
  11.                         and ${criterion.condition}
  12.                      </when>
  13.                      <when test="criterion.singleValue">
  14.                         and ${criterion.condition} #{criterion.value}
  15.                      </when>
  16.                      <when test="criterion.betweenValue">
  17.                         and ${criterion.condition} #{criterion.value} and
  18.                         #{criterion.secondValue}
  19.                      </when>
  20.                      <when test="criterion.listValue">
  21.                         and ${criterion.condition}
  22.                         <foreach collection="criterion.value" item="listItem"
  23.   open="(" close=")" separator=",">
  24.                            #{listItem}
  25.                         </foreach>
  26.                      </when>
  27.                   </choose>
  28.                </foreach>
  29.             </trim>
  30.          </if>
  31.       </foreach>
  32.    </where>
  33. </sql>

接下来我们在测试demo中复现下情况：

准备测试demo

entity

Product.java

普通实体类，对应数据库中product表，表结构见附录：

  1. package com.zhrb.springcloud.entity;
  2. import lombok.Data;
  3. import lombok.ToString;
  4. /**
  5.  * @ClassName Product
  6.  * @Description TODO
  7.   * @Author Administrator
  8.  * @Date 2019/9/3 14:26
  9.  * @Version
  10.   */ @Data @ToString public class Product {
  11.     //主键
  12.   private Long pid;
  13.     //产品名称
  14.   private String productName;
  15.     // 来自哪个数据库，因为微服务架构可以一个服务对应一个数据库，同一个信息被存储到不同数据库
  16.   private String dbSource;
  17. }

ProductExample.java

同代理商环境一样的动态条件类：

  1. package com.zhrb.springcloud.entity;
  2. import java.util.ArrayList;
  3. import java.util.List;
  4. /**
  5.  * @ClassName ProductExample
  6.  * @Description TODO
  7.   * @Author Administrator
  8.  * @Date 2019/9/20 9:07
  9.  * @Version
  10.   */ public class ProductExample {
  11.     /**
  12.  * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  13.   */
  14.   protected String orderByClause;
  15.     /**
  16.  * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  17.   */
  18.   protected boolean distinct;
  19.     /**
  20.  * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  21.   */
  22.   protected List<Criteria> oredCriteria;
  23.     /**
  24.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  25.   */
  26.   public ProductExample() {
  27.         oredCriteria = new ArrayList<Criteria>();
  28.     }
  29.     /**
  30.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  31.   */
  32.   public void setOrderByClause(String orderByClause) {
  33.         this.orderByClause = orderByClause;
  34.     }
  35.     /**
  36.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  37.   */
  38.   public String getOrderByClause() {
  39.         return orderByClause;
  40.     }
  41.     /**
  42.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  43.   */
  44.   public void setDistinct(boolean distinct) {
  45.         this.distinct = distinct;
  46.     }
  47.     /**
  48.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  49.   */
  50.   public boolean isDistinct() {
  51.         return distinct;
  52.     }
  53.     /**
  54.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  55.   */
  56.   public List<Criteria> getOredCriteria() {
  57.         return oredCriteria;
  58.     }
  59.     /**
  60.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  61.   */
  62.   public void or(Criteria criteria) {
  63.         oredCriteria.add(criteria);
  64.     }
  65.     /**
  66.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  67.   */
  68.   public Criteria or() {
  69.         Criteria criteria = createCriteriaInternal();
  70.         oredCriteria.add(criteria);
  71.         return criteria;
  72.     }
  73.     /**
  74.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  75.   */
  76.   public Criteria createCriteria() {
  77.         Criteria criteria = createCriteriaInternal();
  78.         if (oredCriteria.size() == 0) {
  79.             oredCriteria.add(criteria);
  80.         }
  81.         return criteria;
  82.     }
  83.     /**
  84.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  85.   */
  86.   protected Criteria createCriteriaInternal() {
  87.         Criteria criteria = new Criteria();
  88.         return criteria;
  89.     }
  90.     /**
  91.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  92.   */
  93.   public void clear() {
  94.         oredCriteria.clear();
  95.         orderByClause = null;
  96.         distinct = false;
  97.     }
  98.     /**
  99.  * This class was generated by MyBatis Generator. * This class corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  100.   */
  101.   protected abstract static class GeneratedCriteria {
  102.         protected List<Criterion> criteria;
  103.         protected GeneratedCriteria() {
  104.             super();
  105.             criteria = new ArrayList<Criterion>();
  106.         }
  107.         public boolean isValid() {
  108.             return criteria.size() > 0;
  109.         }
  110.         public List<Criterion> getAllCriteria() {
  111.             return criteria;
  112.         }
  113.         public List<Criterion> getCriteria() {
  114.             return criteria;
  115.         }
  116.         protected void addCriterion(String condition) {
  117.             if (condition == null) {
  118.                 throw new RuntimeException("Value for condition cannot be null");
  119.             }
  120.             criteria.add(new Criterion(condition));
  121.         }
  122.         protected void addCriterion(String condition, Object value, String property) {
  123.             if (value == null) {
  124.                 throw new RuntimeException("Value for " + property + " cannot be null");
  125.             }
  126.             criteria.add(new Criterion(condition, value));
  127.         }
  128.         protected void addCriterion(String condition, Object value1, Object value2, String property) {
  129.             if (value1 == null || value2 == null) {
  130.                 throw new RuntimeException("Between values for " + property + " cannot be null");
  131.             }
  132.             criteria.add(new Criterion(condition, value1, value2));
  133.         }
  134.         public Criteria andIdIsNull() {
  135.             addCriterion("PID is null");
  136.             return (Criteria) this;
  137.         }
  138.         public Criteria andIdIsNotNull() {
  139.             addCriterion("PID is not null");
  140.             return (Criteria) this;
  141.         }
  142.         public Criteria andIdEqualTo(String value) {
  143.             addCriterion("PID =", value, "pid");
  144.             return (Criteria) this;
  145.         }
  146.         public Criteria andIdNotEqualTo(String value) {
  147.             addCriterion("PID <>", value, "pid");
  148.             return (Criteria) this;
  149.         }
  150.         public Criteria andIdGreaterThan(String value) {
  151.             addCriterion("PID >", value, "pid");
  152.             return (Criteria) this;
  153.         }
  154.         public Criteria andIdGreaterThanOrEqualTo(String value) {
  155.             addCriterion("PID >=", value, "pid");
  156.             return (Criteria) this;
  157.         }
  158.         public Criteria andIdLessThan(String value) {
  159.             addCriterion("PID <", value, "pid");
  160.             return (Criteria) this;
  161.         }
  162.         public Criteria andIdLessThanOrEqualTo(String value) {
  163.             addCriterion("PID <=", value, "pid");
  164.             return (Criteria) this;
  165.         }
  166.         public Criteria andIdLike(String value) {
  167.             addCriterion("PID like", value, "pid");
  168.             return (Criteria) this;
  169.         }
  170.         public Criteria andIdNotLike(String value) {
  171.             addCriterion("PID not like", value, "pid");
  172.             return (Criteria) this;
  173.         }
  174.         public Criteria andIdIn(List<String> values) {
  175.             addCriterion("PID in", values, "pid");
  176.             return (Criteria) this;
  177.         }
  178.         public Criteria andIdNotIn(List<String> values) {
  179.             addCriterion("PID not in", values, "pid");
  180.             return (Criteria) this;
  181.         }
  182.         public Criteria andIdBetween(String value1, String value2) {
  183.             addCriterion("PID between", value1, value2, "pid");
  184.             return (Criteria) this;
  185.         }
  186.         public Criteria andIdNotBetween(String value1, String value2) {
  187.             addCriterion("PID not between", value1, value2, "pid");
  188.             return (Criteria) this;
  189.         }
  190.     }
  191.     /**
  192.  * This class was generated by MyBatis Generator. * This class corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated do_not_delete_during_merge
  193.  */  public static class Criteria extends GeneratedCriteria {
  194.         protected Criteria() {
  195.             super();
  196.         }
  197.     }
  198.     /**
  199.  * This class was generated by MyBatis Generator. * This class corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  200.   */
  201.   public static class Criterion {
  202.         private String condition;
  203.         private Object value;
  204.         private Object secondValue;
  205.         private boolean noValue;
  206.         private boolean singleValue;
  207.         private boolean betweenValue;
  208.         private boolean listValue;
  209.         private String typeHandler;
  210.         public String getCondition() {
  211.             return condition;
  212.         }
  213.         public Object getValue() {
  214.             return value;
  215.         }
  216.         public Object getSecondValue() {
  217.             return secondValue;
  218.         }
  219.         public boolean isNoValue() {
  220.             return noValue;
  221.         }
  222.         public boolean isSingleValue() {
  223.             return singleValue;
  224.         }
  225.         public boolean isBetweenValue() {
  226.             return betweenValue;
  227.         }
  228.         public boolean isListValue() {
  229.             return listValue;
  230.         }
  231.         public String getTypeHandler() {
  232.             return typeHandler;
  233.         }
  234.         protected Criterion(String condition) {
  235.             super();
  236.             this.condition = condition;
  237.             this.typeHandler = null;
  238.             this.noValue = true;
  239.         }
  240.         protected Criterion(String condition, Object value, String typeHandler) {
  241.             super();
  242.             this.condition = condition;
  243.             this.value = value;
  244.             this.typeHandler = typeHandler;
  245.             if (value instanceof List<?>) {
  246.                 this.listValue = true;
  247.             } else {
  248.                 this.singleValue = true;
  249.             }
  250.         }
  251.         protected Criterion(String condition, Object value) {
  252.             this(condition, value, null);
  253.         }
  254.         protected Criterion(String condition, Object value, Object secondValue, String typeHandler) {
  255.             super();
  256.             this.condition = condition;
  257.             this.value = value;
  258.             this.secondValue = secondValue;
  259.             this.typeHandler = typeHandler;
  260.             this.betweenValue = true;
  261.         }
  262.         protected Criterion(String condition, Object value, Object secondValue) {
  263.             this(condition, value, secondValue, null);
  264.         }
  265.     }
  266. }

控制层ProductController.java

  1. package com.zhrb.springcloud.controller;
  2. import com.zhrb.springcloud.entity.Product;
  3. import com.zhrb.springcloud.entity.ProductExample;
  4. import com.zhrb.springcloud.service.ProductService;
  5. import io.swagger.annotations.Api;
  6. import io.swagger.annotations.ApiOperation;
  7. import org.mybatis.spring.annotation.MapperScan;
  8. import org.springframework.beans.factory.annotation.Autowired;
  9. import org.springframework.web.bind.annotation.*;
  10. import java.util.Collection;
  11. import java.util.List;
  12. /**
  13.  * @ClassName ProductController
  14.  * @Description TODO
  15.   * @Author zhrb
  16.  * @Date 2019/9/3 15:18
  17.  * @Version
  18.   */ @RestController @RequestMapping("/product")
  19. @MapperScan("com.zhrb.springcloud.mapper")
  20. @Api(value = "/product",description = "商品管理 程序员小圈圈",position = 1)
  21. public class ProductController {
  22.     @Autowired
  23.   private ProductService productService;
  24.     
  25.     @ApiOperation(value="测试是否预编译", notes="测试是否预编译")
  26.     @GetMapping(value = "/testList")
  27.     public List<Product> testList() {
  28.         ProductExample example = new ProductExample();
  29.         example.createCriteria().andIdLike("1' or '1=1");
  30.         List<Product> productList = productService.list(example);
  31.         for (Product p :productList){
  32.             p.setProductName(p.getProductName()+"本条数据来自8001");
  33.         }
  34.         return productList;
  35.     }
  36. }

service层

ProductService.java

  1. package com.zhrb.springcloud.service;
  2. import com.zhrb.springcloud.entity.Product;
  3. import com.zhrb.springcloud.entity.ProductExample;
  4. import java.util.List;
  5. /**
  6.  * @ClassName ProductService
  7.  * @Description TODO
  8.   * @Author Administrator
  9.  * @Date 2019/9/3 15:15
  10.  * @Version
  11.   */ public interface ProductService {
  12.     List<Product> list(ProductExample example);
  13. }

ProductServiceImpl.java

  1. package com.zhrb.springcloud.service.impl;
  2. import com.zhrb.springcloud.entity.Product;
  3. import com.zhrb.springcloud.entity.ProductExample;
  4. import com.zhrb.springcloud.mapper.ProductMapper;
  5. import com.zhrb.springcloud.service.ProductService;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.stereotype.Service;
  8. import java.util.List;
  9. /**
  10.  * @ClassName ProductServiceImpl
  11.  * @Description TODO
  12.   * @Author Administrator
  13.  * @Date 2019/9/3 15:16
  14.  * @Version
  15.   */   @Service public class ProductServiceImpl implements ProductService{
  16.     @Autowired
  17.   private ProductMapper productMapper;
  18.     
  19.     @Override
  20.   public List<Product> list(ProductExample example) {
  21.         return productMapper.testList(example);
  22.     }
  23. }

mapper

ProductController.java

  1. package com.zhrb.springcloud.mapper;
  2. import com.zhrb.springcloud.entity.Product;
  3. import com.zhrb.springcloud.entity.ProductExample;
  4. import org.apache.ibatis.annotations.Mapper;
  5. import java.util.List;
  6. /**
  7.  * @ClassName ProductMapper
  8.  * @Description TODO
  9.   * @Author Administrator
  10.  * @Date 2019/9/3 14:55
  11.  * @Version
  12.   */ 
  13.   @Mapper 
  14.   public interface ProductMapper {
  15.    
  16.     List<Product> testList(ProductExample example);
  17. }

ProductController.xml

  1. <?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE  mapper  PUBLIC  "-//mybatis.org//DTD Mapper 3.0//EN"   "http://mybatis.org/dtd/mybatis-3-mapper.dtd"> <mapper namespace="com.zhrb.springcloud.mapper.ProductMapper">
  2.     
  3.     <select id="testList" parameterType="com.zhrb.springcloud.entity.ProductExample" resultType="com.zhrb.springcloud.entity.Product">
  4.         select
  5.         pid, product_name, db_source
  6.         from product
  7.         <if test="_parameter != null" >
  8.             <include refid="Example_Where_Clause" />
  9.         </if>
  10.         <if test="orderByClause != null" >
  11.             order by ${orderByClause}
  12.         </if>
  13.     </select>
  14.     <sql id="Example_Where_Clause" >
  15.         <!--
  16.  WARNING - @mbggenerated This element is automatically generated by MyBatis Generator, do not modify. -->  <where >
  17.             <foreach collection="oredCriteria" item="criteria" separator="or" >
  18.                 <if test="criteria.valid" >
  19.                     <trim prefix="(" suffix=")" prefixOverrides="and" >
  20.                         <foreach collection="criteria.criteria" item="criterion" >
  21.                             <choose >
  22.                                 <when test="criterion.noValue" >
  23.                                     and ${criterion.condition}
  24.                                 </when>
  25.                                 <when test="criterion.singleValue" >
  26.                                     and ${criterion.condition} #{criterion.value}
  27.                                 </when>
  28.                                 <when test="criterion.betweenValue" >
  29.                                     and ${criterion.condition} #{criterion.value} and #{criterion.secondValue}
  30.                                 </when>
  31.                                 <when test="criterion.listValue" >
  32.                                     and ${criterion.condition}
  33.                                     <foreach collection="criterion.value" item="listItem" open="(" close=")" separator="," >
  34.                                         #{listItem}
  35.                                     </foreach>
  36.                                 </when>
  37.                             </choose>
  38.                         </foreach>
  39.                     </trim>
  40.                 </if>
  41.             </foreach>
  42.         </where>
  43.     </sql>
  44. </mapper>

测试

测试1：正常逻辑测试

首先按照正常代码逻辑测试，校验代码是否成功，测试结果截图如下：

可以看到调用成功，证明代码逻辑没问题，接下来进行异常测试：

测试2：测试不存在的表字段

修改ProductExample.java如下（数据库中字段为pid，无id，故先将pid改为id测试不存在字段编译过程）：

  1. package com.zhrb.springcloud.entity;
  2. import java.util.ArrayList;
  3. import java.util.List;
  4. /**
  5.  * @ClassName ProductExample
  6.  * @Description TODO
  7.   * @Author Administrator
  8.  * @Date 2019/9/20 9:07
  9.  * @Version
  10.   */ public class ProductExample {
  11.     /**
  12.  * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  13.   */
  14.   protected String orderByClause;
  15.     /**
  16.  * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  17.   */
  18.   protected boolean distinct;
  19.     /**
  20.  * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  21.   */
  22.   protected List<Criteria> oredCriteria;
  23.     /**
  24.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  25.   */
  26.   public ProductExample() {
  27.         oredCriteria = new ArrayList<Criteria>();
  28.     }
  29.     /**
  30.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  31.   */
  32.   public void setOrderByClause(String orderByClause) {
  33.         this.orderByClause = orderByClause;
  34.     }
  35.     /**
  36.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  37.   */
  38.   public String getOrderByClause() {
  39.         return orderByClause;
  40.     }
  41.     /**
  42.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  43.   */
  44.   public void setDistinct(boolean distinct) {
  45.         this.distinct = distinct;
  46.     }
  47.     /**
  48.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  49.   */
  50.   public boolean isDistinct() {
  51.         return distinct;
  52.     }
  53.     /**
  54.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  55.   */
  56.   public List<Criteria> getOredCriteria() {
  57.         return oredCriteria;
  58.     }
  59.     /**
  60.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  61.   */
  62.   public void or(Criteria criteria) {
  63.         oredCriteria.add(criteria);
  64.     }
  65.     /**
  66.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  67.   */
  68.   public Criteria or() {
  69.         Criteria criteria = createCriteriaInternal();
  70.         oredCriteria.add(criteria);
  71.         return criteria;
  72.     }
  73.     /**
  74.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  75.   */
  76.   public Criteria createCriteria() {
  77.         Criteria criteria = createCriteriaInternal();
  78.         if (oredCriteria.size() == 0) {
  79.             oredCriteria.add(criteria);
  80.         }
  81.         return criteria;
  82.     }
  83.     /**
  84.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  85.   */
  86.   protected Criteria createCriteriaInternal() {
  87.         Criteria criteria = new Criteria();
  88.         return criteria;
  89.     }
  90.     /**
  91.  * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  92.   */
  93.   public void clear() {
  94.         oredCriteria.clear();
  95.         orderByClause = null;
  96.         distinct = false;
  97.     }
  98.     /**
  99.  * This class was generated by MyBatis Generator. * This class corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  100.   */
  101.   protected abstract static class GeneratedCriteria {
  102.         protected List<Criterion> criteria;
  103.         protected GeneratedCriteria() {
  104.             super();
  105.             criteria = new ArrayList<Criterion>();
  106.         }
  107.         public boolean isValid() {
  108.             return criteria.size() > 0;
  109.         }
  110.         public List<Criterion> getAllCriteria() {
  111.             return criteria;
  112.         }
  113.         public List<Criterion> getCriteria() {
  114.             return criteria;
  115.         }
  116.         protected void addCriterion(String condition) {
  117.             if (condition == null) {
  118.                 throw new RuntimeException("Value for condition cannot be null");
  119.             }
  120.             criteria.add(new Criterion(condition));
  121.         }
  122.         protected void addCriterion(String condition, Object value, String property) {
  123.             if (value == null) {
  124.                 throw new RuntimeException("Value for " + property + " cannot be null");
  125.             }
  126.             criteria.add(new Criterion(condition, value));
  127.         }
  128.         protected void addCriterion(String condition, Object value1, Object value2, String property) {
  129.             if (value1 == null || value2 == null) {
  130.                 throw new RuntimeException("Between values for " + property + " cannot be null");
  131.             }
  132.             criteria.add(new Criterion(condition, value1, value2));
  133.         }
  134.         public Criteria andIdIsNull() {
  135.             addCriterion("id is null");
  136.             return (Criteria) this;
  137.         }
  138.         public Criteria andIdIsNotNull() {
  139.             addCriterion("id is not null");
  140.             return (Criteria) this;
  141.         }
  142.         public Criteria andIdEqualTo(String value) {
  143.             addCriterion("id =", value, "id");
  144.             return (Criteria) this;
  145.         }
  146.         public Criteria andIdNotEqualTo(String value) {
  147.             addCriterion("id <>", value, "id");
  148.             return (Criteria) this;
  149.         }
  150.         public Criteria andIdGreaterThan(String value) {
  151.             addCriterion("id >", value, "id");
  152.             return (Criteria) this;
  153.         }
  154.         public Criteria andIdGreaterThanOrEqualTo(String value) {
  155.             addCriterion("id >=", value, "id");
  156.             return (Criteria) this;
  157.         }
  158.         public Criteria andIdLessThan(String value) {
  159.             addCriterion("id <", value, "id");
  160.             return (Criteria) this;
  161.         }
  162.         public Criteria andIdLessThanOrEqualTo(String value) {
  163.             addCriterion("id <=", value, "id");
  164.             return (Criteria) this;
  165.         }
  166.         public Criteria andIdLike(String value) {
  167.             addCriterion("id like", value, "id");
  168.             return (Criteria) this;
  169.         }
  170.         public Criteria andIdNotLike(String value) {
  171.             addCriterion("id not like", value, "id");
  172.             return (Criteria) this;
  173.         }
  174.         public Criteria andIdIn(List<String> values) {
  175.             addCriterion("id in", values, "id");
  176.             return (Criteria) this;
  177.         }
  178.         public Criteria andIdNotIn(List<String> values) {
  179.             addCriterion("id not in", values, "id");
  180.             return (Criteria) this;
  181.         }
  182.         public Criteria andIdBetween(String value1, String value2) {
  183.             addCriterion("id between", value1, value2, "id");
  184.             return (Criteria) this;
  185.         }
  186.         public Criteria andIdNotBetween(String value1, String value2) {
  187.             addCriterion("id not between", value1, value2, "id");
  188.             return (Criteria) this;
  189.         }
  190.     }
  191.     /**
  192.  * This class was generated by MyBatis Generator. * This class corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated do_not_delete_during_merge
  193.  */  public static class Criteria extends GeneratedCriteria {
  194.         protected Criteria() {
  195.             super();
  196.         }
  197.     }
  198.     /**
  199.  * This class was generated by MyBatis Generator. * This class corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  200.   */
  201.   public static class Criterion {
  202.         private String condition;
  203.         private Object value;
  204.         private Object secondValue;
  205.         private boolean noValue;
  206.         private boolean singleValue;
  207.         private boolean betweenValue;
  208.         private boolean listValue;
  209.         private String typeHandler;
  210.         public String getCondition() {
  211.             return condition;
  212.         }
  213.         public Object getValue() {
  214.             return value;
  215.         }
  216.         public Object getSecondValue() {
  217.             return secondValue;
  218.         }
  219.         public boolean isNoValue() {
  220.             return noValue;
  221.         }
  222.         public boolean isSingleValue() {
  223.             return singleValue;
  224.         }
  225.         public boolean isBetweenValue() {
  226.             return betweenValue;
  227.         }
  228.         public boolean isListValue() {
  229.             return listValue;
  230.         }
  231.         public String getTypeHandler() {
  232.             return typeHandler;
  233.         }
  234.         protected Criterion(String condition) {
  235.             super();
  236.             this.condition = condition;
  237.             this.typeHandler = null;
  238.             this.noValue = true;
  239.         }
  240.         protected Criterion(String condition, Object value, String typeHandler) {
  241.             super();
  242.             this.condition = condition;
  243.             this.value = value;
  244.             this.typeHandler = typeHandler;
  245.             if (value instanceof List<?>) {
  246.                 this.listValue = true;
  247.             } else {
  248.                 this.singleValue = true;
  249.             }
  250.         }
  251.         protected Criterion(String condition, Object value) {
  252.             this(condition, value, null);
  253.         }
  254.         protected Criterion(String condition, Object value, Object secondValue, String typeHandler) {
  255.             super();
  256.             this.condition = condition;
  257.             this.value = value;
  258.             this.secondValue = secondValue;
  259.             this.typeHandler = typeHandler;
  260.             this.betweenValue = true;
  261.         }
  262.         protected Criterion(String condition, Object value, Object secondValue) {
  263.             this(condition, value, secondValue, null);
  264.         }
  265.     }
  266. }

测试结果如下：

可以看到，编译出错，证明此时虽然用的是$取值，也经过了预编译，继续看下面。

测试3：like注入测试1

代码及结果截图如下：

从上面的图可以得知：

此种注入，在封装Criteria时把传入的参数整体当做一个对象然后传递下去，本次测试如上图1，打了两个断点，但是没执行到第二个断点处即中断执行，后台日志报错，证明此种注入sql有误无法正常执行。

测试3：like注入测试2

代码及结果截图如下：

like注入测试1中我们debug可以看到参数似乎拼接方式有误，那么本次注入即正常注入方式，debug看参数，如果将

andIdLike 值设置为：‘1' or ‘1=1'

数据上执行的sql理论上是：

  1. SELECT * from product WHERE pid LIKE '1' or '1=1';

在数据库中执行此条sql结果如下：

但是demo执行查询结果为空，并且控制台报错，证明此种注入亦不能注入成功。

结论

经以上demo测试，此种$获取值不会受到sql注入的影响，常规sql注入失败。

附录

数据库表结构：

  1. /*
  2. Navicat MySQL Data Transfer
  3. Source Server         : BWG-104.225.147.76
  4. Source Server Version : 50644
  5. Source Host           : 104.225.147.76:3306
  6. Source Database       : springcloud_db01
  7. Target Server Type    : MYSQL
  8. Target Server Version : 50644
  9. File Encoding         : 65001
  10. Date: 2019-09-20 10:23:41
  11. */
  12. SET FOREIGN_KEY_CHECKS=0;
  13. -- ----------------------------
  14. -- Table structure for product
  15. -- ----------------------------
  16. DROP TABLE IF EXISTS `product`;
  17. CREATE TABLE `product` (
  18.   `pid` bigint(20) NOT NULL AUTO_INCREMENT,
  19.   `product_name` varchar(50) DEFAULT NULL,
  20.   `db_source` varchar(50) DEFAULT NULL,
  21.   PRIMARY KEY (`pid`)
  22. ) ENGINE=InnoDB AUTO_INCREMENT=7 DEFAULT CHARSET=utf8;
  23. -- ----------------------------
  24. -- Records of product
  25. -- ----------------------------
  26. INSERT INTO `product` VALUES ('1', '手机', 'springcloud_db01');
  27. INSERT INTO `product` VALUES ('2', '冰箱', 'springcloud_db01');
  28. INSERT INTO `product` VALUES ('3', '电脑', 'springcloud_db01');
  29. INSERT INTO `product` VALUES ('4', '洗衣机', 'springcloud_db01');
  30. INSERT INTO `product` VALUES ('5', '电视', 'springcloud_db01');
  31. INSERT INTO `product` VALUES ('6', '音响', 'springcloud_db01');

以上为个人经验，希望能给大家一个参考，也希望大家多多支持w3xue。

 友情链接：直通硅谷 　点职佳 　北美留学生论坛

MyBatis热门文章

  • Mybatis使用连表查询的操作代码
  • Mybatis-plus如何查询表中指定字段(不查询全部字段)
  • mybatis/mybatis-plus模糊查询语句特殊字符转义拦截器的实现
  • MyBatis注解开发-@Insert和@InsertProvider的使用
  • springboot+mybatis报错找不到实体类的问题
  • mybatis 忽略实体对象的某个属性(2种方式)
  • mybatis update set 多个字段实例
  • 如何通过一个注解实现MyBatis字段加解密
  • oracle+mybatis-plus+springboot实现分页查询的实例
  • MybatisPlus中的insert操作详解

    • MyBatis推荐文章

  • Mybatis-Plus最优化持久层开发
  • MyBatis 的在使用上的注意事项及其辨析 - Rainbow-Sea
  • 在 Wed 中应用 MyBatis（同时使用MVC架构模式，以及ThreadLocal 事务控制） - Rainbow-Sea
  • MyBatis源码之前言—JDBC编码存在的问题和Mybatis的介绍
  • mybatis plugin源码解析
  • Spring Boot + MyBatis-Plus 实现 MySQL 主从复制动态数据源切换
  • 一种轻量分表方案-MyBatis拦截器分表实践
  • 使用Mybatis自定义插件实现不侵入业务的公共参数自动追加
  • MyBatis-Plus雪花算法实现源码解析
  • Mybatis和其他主流框架的整合使用

    • 本站QQ群：前端 618073944 | Java 606181507 | Python 626812652 | C/C++ 612253063 | 微信 634508462 | 苹果 692586424 | C#/.net 182808419 | PHP 305140648 | 运维 608723728

    W3xue 的所有内容仅供测试，对任何法律问题及风险不承担任何责任。通过使用本站内容随之而来的风险与本站无关。
    关于我们  |  意见建议  |  捐助我们  |  报错有奖  |  广告合作、友情链接（目前9元/月）请联系QQ：27243702 沸活量
    皖ICP备17017327号-2　皖公网安备34020702000426号