From a62db612212f796a32a189b032f301ad432b5179 Mon Sep 17 00:00:00 2001
From: Chopper711 <liushuai711@gmail.com>
Date: Wed, 16 Aug 2023 16:37:58 +0800
Subject: [PATCH] =?UTF-8?q?improvement=EF=BC=9A=E8=B0=83=E4=BC=98sql?=
 =?UTF-8?q?=E5=85=B3=E9=94=AE=E8=AF=8D=E8=BF=87=E6=BB=A4=E6=96=B9=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../lili/modules/search/utils/SqlFilter.java  | 50 +++++++------------
 1 file changed, 18 insertions(+), 32 deletions(-)

diff --git a/framework/src/main/java/cn/lili/modules/search/utils/SqlFilter.java b/framework/src/main/java/cn/lili/modules/search/utils/SqlFilter.java
index 87f32ecb..3b266357 100644
--- a/framework/src/main/java/cn/lili/modules/search/utils/SqlFilter.java
+++ b/framework/src/main/java/cn/lili/modules/search/utils/SqlFilter.java
@@ -1,8 +1,9 @@
 package cn.lili.modules.search.utils;
 
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Set;
+import cn.lili.common.utils.StringUtils;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 /**
  * sql 关键字过滤
@@ -15,13 +16,15 @@ import java.util.Set;
 
 public class SqlFilter {
 
-    private static final Set<String> SQL_KEYWORDS = new HashSet<>(Arrays.asList(
-            "SELECT", "FROM", "WHERE", "AND", "OR", "NOT", "INSERT", "UPDATE", "DELETE", "CREATE",
-            "TABLE", "INDEX", "VIEW", "DROP", "ALTER", "COLUMN", "ADD", "SET", "GROUP", "BY",
-            "HAVING", "ORDER", "ASC", "DESC", "LIKE", "IN", "BETWEEN", "IS", "NULL", "TRUE", "FALSE",
-            "JOIN", "LEFT", "RIGHT", "INNER", "OUTER", "FULL", "ON", "AS", "DISTINCT", "COUNT",
-            "MAX", "MIN", "SUM", "AVG", "IF", "RAND", "UPDATEXML", "EXTRACTVALUE", "LOAD_FILE", "SLEEP","OFFSET"
-    ));
+
+    // SQL注入过滤
+    static final String SQL_KEYWORDS_PATTERN =
+            "(?i)(SELECT|FROM|WHERE|CONCAT|AND|OR|NOT|INSERT|UPDATE|DELETE|CREATE" +
+            "|TABLE|INDEX|VIEW|DROP|ALTER|COLUMN|ADD|SET|GROUP|BY" +
+            "|HAVING|ORDER|ASC|DESC|LIKE|IN|BETWEEN|IS|NULL|TRUE|FALSE" +
+            "|JOIN|LEFT|RIGHT|INNER|OUTER|FULL|ON|AS|DISTINCT|COUNT" +
+            "|MAX|MIN|SUM|AVG|IF|RAND|UPDATEXML|EXTRACTVALUE|LOAD_FILE|SLEEP|OFFSET)";
+    static final Pattern keywordPattern = Pattern.compile(SQL_KEYWORDS_PATTERN, Pattern.CASE_INSENSITIVE);
 
 
     /**
@@ -31,29 +34,12 @@ public class SqlFilter {
      * @return
      */
     public static Boolean hit(String sql) {
-        String[] tokens = sql.split("\\s+");
-        for (String token : tokens) {
-            if (!SQL_KEYWORDS.contains(token.toUpperCase())) {
-                return true;
-            }
+        if (StringUtils.isEmpty(sql)) {
+            return false;
         }
-        return false;
+        Matcher matcher = keywordPattern.matcher(sql);
+        return matcher.find();
     }
 
-    /**
-     * 关键字替换
-     *
-     * @param sql
-     * @return
-     */
-    public static String filterSql(String sql) {
-        String[] tokens = sql.split("\\s+");
-        StringBuilder filteredSql = new StringBuilder();
-        for (String token : tokens) {
-            if (!SQL_KEYWORDS.contains(token.toUpperCase())) {
-                filteredSql.append(token).append(" ");
-            }
-        }
-        return filteredSql.toString().trim();
-    }
+
 }