MyBatis Generator生成的$ sql是否存在注入风险

代理商sql注入问题排查

经全面排查，代理商中sql层使用’$’获取对象的只有一种类型，代码格式如下：

<sql id="Example_Where_Clause">
   <!-- WARNING - @mbggenerated This element is automatically generated by 
      MyBatis Generator, do not modify. -->
  <where>
      <foreach collection="oredCriteria" item="criteria" separator="or">
         <if test="criteria.valid">
            <trim prefix="(" suffix=")" prefixOverrides="and">
               <foreach collection="criteria.criteria" item="criterion">
                  <choose>
                     <when test="criterion.noValue">
                        and ${criterion.condition}
                     </when>
                     <when test="criterion.singleValue">
                        and ${criterion.condition} #{criterion.value}
                     </when>
                     <when test="criterion.betweenValue">
                        and ${criterion.condition} #{criterion.value} and
                        #{criterion.secondValue}
                     </when>
                     <when test="criterion.listValue">
                        and ${criterion.condition}
                        <foreach collection="criterion.value" item="listItem"
  open="(" close=")" separator=",">
                           #{listItem}
                        </foreach>
                     </when>
                  </choose>
               </foreach>
            </trim>
         </if>
      </foreach>
   </where>
</sql>

接下来我们在测试demo中复现下情况：

准备测试demo

entity

Product.java

普通实体类，对应数据库中product表，表结构见附录：

package com.zhrb.springcloud.entity;

import lombok.Data;
import lombok.ToString;

/**
 * @ClassName Product
 * @Description TODO
  * @Author Administrator
 * @Date 2019/9/3 14:26
 * @Version
  */ @Data @ToString public class Product {

    //主键
  private Long pid;

    //产品名称
  private String productName;

    // 来自哪个数据库，因为微服务架构可以一个服务对应一个数据库，同一个信息被存储到不同数据库
  private String dbSource;
}

ProductExample.java

同代理商环境一样的动态条件类：

package com.zhrb.springcloud.entity;

import java.util.ArrayList;
import java.util.List;

/**
 * @ClassName ProductExample
 * @Description TODO
  * @Author Administrator
 * @Date 2019/9/20 9:07
 * @Version
  */ public class ProductExample {
    /**
 * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  protected String orderByClause;

    /**
 * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  protected boolean distinct;

    /**
 * This field was generated by MyBatis Generator. * This field corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  protected List<Criteria> oredCriteria;

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public ProductExample() {
        oredCriteria = new ArrayList<Criteria>();
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public void setOrderByClause(String orderByClause) {
        this.orderByClause = orderByClause;
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public String getOrderByClause() {
        return orderByClause;
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public void setDistinct(boolean distinct) {
        this.distinct = distinct;
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public boolean isDistinct() {
        return distinct;
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public List<Criteria> getOredCriteria() {
        return oredCriteria;
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public void or(Criteria criteria) {
        oredCriteria.add(criteria);
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public Criteria or() {
        Criteria criteria = createCriteriaInternal();
        oredCriteria.add(criteria);
        return criteria;
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public Criteria createCriteria() {
        Criteria criteria = createCriteriaInternal();
        if (oredCriteria.size() == 0) {
            oredCriteria.add(criteria);
        }
        return criteria;
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  protected Criteria createCriteriaInternal() {
        Criteria criteria = new Criteria();
        return criteria;
    }

    /**
 * This method was generated by MyBatis Generator. * This method corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  public void clear() {
        oredCriteria.clear();
        orderByClause = null;
        distinct = false;
    }

    /**
 * This class was generated by MyBatis Generator. * This class corresponds to the database table CPT_DLS_CONFIG * * @mbggenerated
  */
  protected abstract static class GeneratedCriteria {
        protected List<Criterion> criteria;

        protected GeneratedCriteria() {
            super();
            criteria