From b4f9d3a8f238e3d40d97f0d947b5b4b302d0c04e Mon Sep 17 00:00:00 2001
From: 疯狂的狮子li <15040126243@163.com>
Date: 星期四, 27 五月 2021 22:06:36 +0800
Subject: [PATCH] update 优化dataScope参数防止注入
---
ruoyi-framework/src/main/java/com/ruoyi/framework/aspectj/DataScopeAspect.java | 38 ++++++++++++++++++++++++++++++--------
1 files changed, 30 insertions(+), 8 deletions(-)
diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/aspectj/DataScopeAspect.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/aspectj/DataScopeAspect.java
index ffd4718..ce23af0 100644
--- a/ruoyi-framework/src/main/java/com/ruoyi/framework/aspectj/DataScopeAspect.java
+++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/aspectj/DataScopeAspect.java
@@ -3,7 +3,6 @@
import cn.hutool.core.lang.Validator;
import cn.hutool.core.util.StrUtil;
import com.ruoyi.common.annotation.DataScope;
-import com.ruoyi.common.core.domain.BaseEntity;
import com.ruoyi.common.core.domain.entity.SysRole;
import com.ruoyi.common.core.domain.entity.SysUser;
import com.ruoyi.common.core.domain.model.LoginUser;
@@ -19,6 +18,7 @@
import org.springframework.stereotype.Component;
import java.lang.reflect.Method;
+import java.util.Map;
/**
* 鏁版嵁杩囨护澶勭悊
@@ -68,6 +68,7 @@
@Before("dataScopePointCut()")
public void doBefore(JoinPoint point) throws Throwable
{
+ clearDataScope(point);
handleDataScope(point);
}
@@ -144,13 +145,8 @@
if (StrUtil.isNotBlank(sqlString.toString()))
{
- Object params = joinPoint.getArgs()[0];
- if (Validator.isNotNull(params) && params instanceof BaseEntity)
- {
- BaseEntity baseEntity = (BaseEntity) params;
- baseEntity.getParams().put(DATA_SCOPE, " AND (" + sqlString.substring(4) + ")");
- }
- }
+ putDataScope(joinPoint, " AND (" + sqlString.substring(4) + ")");
+ }
}
/**
@@ -168,4 +164,30 @@
}
return null;
}
+
+ /**
+ * 鎷兼帴鏉冮檺sql鍓嶅厛娓呯┖params.dataScope鍙傛暟闃叉娉ㄥ叆
+ */
+ private void clearDataScope(final JoinPoint joinPoint)
+ {
+ Object params = joinPoint.getArgs()[0];
+ if (Validator.isNotNull(params))
+ {
+ putDataScope(joinPoint, "");
+ }
+ }
+
+ private static void putDataScope(JoinPoint joinPoint, String sql) {
+ Object params = joinPoint.getArgs()[0];
+ if (Validator.isNotNull(params))
+ {
+ try {
+ Method getParams = params.getClass().getDeclaredMethod("getParams", null);
+ Map<String, Object> invoke = (Map<String, Object>) getParams.invoke(params, null);
+ invoke.put(DATA_SCOPE, sql);
+ } catch (Exception e) {
+ // 鏂规硶鏈壘鍒� 涓嶅鐞�
+ }
+ }
+ }
}
--
Gitblit v1.9.3