基于面向切面的sql注入过滤

基于面向切面的sql注入过滤

人狠话不多, 直接上代码
application.yml

sql:
  inject:
    # 是否对接口传入的参数 进行sql注入检测 1是0否
    open: 1
    # 检测sql注入的正则表达式
    regex: (?:')|(?:--)|(/\*(?:.|[\n\r])*?\*/)|(\b(and|exec|execute|insert|select|delete|update|count|drop|%|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|chr|mid|master|truncate|char|declare|or|--|like)\b)

FilterAspect.java

@Aspect
@Component
@Slf4j
public class FilterAspect {
    @Value("${sql.inject.regex}")
    private String regex;
    @Value("${sql.inject.open}")
    private String open;

    @Pointcut("execution(* com.test.demo.controller.*.*(..))")
    public void myPointcut() {
    }
    @Before("myPointcut()")
    public void doBefore(JoinPoint point) {
        // joinPoint获取参数值
        Object[] args = point.getArgs();
        if ("1".equals(open)) {
            for (Object arg : args) {
                if (Pattern.matches(regex, arg.toString())) {
                    log.error("检测到sql注入攻击");
                    throw new RuntimeException("请检查输入的内容,不要参入一些特殊符号");
                }
            }
        }
    }
}