BJ_ZTEITS-Developers / parking-cloud-yudao

Commit da96ceab7a24a8f9bc4c8265b0772901da360135

Authored by YunaiV
1 parent cab59d4d

fix(framework): 修复分页排序 SQL 注入风险

Inline Side-by-side
Showing 1 changed file with 106 additions and 0 deletions
yudao-framework/yudao-spring-boot-starter-mybatis/src/test/java/cn/iocoder/yudao/framework/mybatis/core/util/MyBatisUtilsTest.java 0 → 100644
  View file @da96cea
  1 +package cn.iocoder.yudao.framework.mybatis.core.util;
  2 +
  3 +import cn.iocoder.yudao.framework.common.pojo.PageParam;
  4 +import cn.iocoder.yudao.framework.common.pojo.SortingField;
  5 +import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
  6 +import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
  7 +import com.baomidou.mybatisplus.core.metadata.OrderItem;
  8 +import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
  9 +import org.junit.jupiter.api.Test;
  10 +
  11 +import java.util.Arrays;
  12 +import java.util.List;
  13 +
  14 +import static org.junit.jupiter.api.Assertions.assertEquals;
  15 +import static org.junit.jupiter.api.Assertions.assertFalse;
  16 +import static org.junit.jupiter.api.Assertions.assertTrue;
  17 +
  18 +/**
  19 + * {@link MyBatisUtils} 的单元测试
  20 + */
  21 +public class MyBatisUtilsTest {
  22 +
  23 + @Test
  24 + public void testBuildPage_sortingFields() {
  25 + // 准备参数
  26 + PageParam pageParam = new PageParam();
  27 + pageParam.setPageNo(2);
  28 + pageParam.setPageSize(20);
  29 + List<SortingField> sortingFields = Arrays.asList(
  30 + new SortingField("userName", SortingField.ORDER_ASC),
  31 + new SortingField("u.id", SortingField.ORDER_DESC),
  32 + new SortingField("name desc", SortingField.ORDER_DESC));
  33 +
  34 + // 调用
  35 + Page<Object> page = MyBatisUtils.buildPage(pageParam, sortingFields);
  36 +
  37 + // 断言
  38 + assertEquals(2, page.getCurrent());
  39 + assertEquals(20, page.getSize());
  40 + assertEquals(2, page.orders().size());
  41 + assertOrderItem(page.orders().get(0), "user_name", true);
  42 + assertOrderItem(page.orders().get(1), "u.id", false);
  43 + }
  44 +
  45 + @Test
  46 + public void testAddOrder_queryWrapper() {
  47 + // 准备参数
  48 + QueryWrapper<Object> query = new QueryWrapper<>();
  49 + List<SortingField> sortingFields = Arrays.asList(
  50 + new SortingField("userName", SortingField.ORDER_ASC),
  51 + new SortingField("u.id", SortingField.ORDER_DESC),
  52 + new SortingField("name;drop", SortingField.ORDER_ASC));
  53 +
  54 + // 调用
  55 + MyBatisUtils.addOrder(query, sortingFields);
  56 +
  57 + // 断言
  58 + assertEquals(" ORDER BY user_name ASC,u.id DESC", query.getSqlSegment());
  59 + }
  60 +
  61 + @Test
  62 + public void testAddOrder_lambdaQueryWrapper() {
  63 + // 准备参数
  64 + LambdaQueryWrapper<Object> query = new LambdaQueryWrapper<>();
  65 + List<SortingField> sortingFields = Arrays.asList(
  66 + new SortingField("userName", SortingField.ORDER_ASC),
  67 + new SortingField("u.id", SortingField.ORDER_DESC),
  68 + new SortingField("name`", SortingField.ORDER_ASC));
  69 +
  70 + // 调用
  71 + MyBatisUtils.addOrder(query, sortingFields);
  72 +
  73 + // 断言
  74 + assertEquals(" ORDER BY user_name ASC, u.id DESC", query.getSqlSegment());
  75 + }
  76 +
  77 + @Test
  78 + public void testAddOrder_lambdaQueryWrapper_invalidSortingFields() {
  79 + // 准备参数
  80 + LambdaQueryWrapper<Object> query = new LambdaQueryWrapper<>();
  81 + List<SortingField> sortingFields = Arrays.asList(
  82 + new SortingField("name desc", SortingField.ORDER_ASC),
  83 + new SortingField("name;drop", SortingField.ORDER_DESC));
  84 +
  85 + // 调用
  86 + MyBatisUtils.addOrder(query, sortingFields);
  87 +
  88 + // 断言
  89 + assertEquals("", query.getSqlSegment());
  90 + }
  91 +
  92 + @Test
  93 + public void testOrderDirection() {
  94 + assertTrue(MyBatisUtils.isAscOrder(SortingField.ORDER_ASC));
  95 + assertFalse(MyBatisUtils.isAscOrder(SortingField.ORDER_DESC));
  96 + assertEquals("ASC", MyBatisUtils.getOrderDirection(SortingField.ORDER_ASC));
  97 + assertEquals("DESC", MyBatisUtils.getOrderDirection(SortingField.ORDER_DESC));
  98 + assertEquals("DESC", MyBatisUtils.getOrderDirection(null));
  99 + }
  100 +
  101 + private void assertOrderItem(OrderItem orderItem, String column, boolean asc) {
  102 + assertEquals(column, orderItem.getColumn());
  103 + assertEquals(asc, orderItem.isAsc());
  104 + }
  105 +
  106 +}
... ...