ruoyi/RuoYi
1
0
Fork 0
mirror of https://github.com/yangzongzhuan/RuoYi.git synced 2025-10-15 18:18:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

!536 Fix version 4.7.9 SQL Injection

Browse Source 
Merge pull request !536 from mrlihd/fix-479-sqli
This commit is contained in:
若依
2024-12-24 04:00:09 +00:00
committed by Gitee
parent 9c9bbc8e2c 0cdb4c7b9c
commit ddd858ca73
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java
View File

@@ -13,7 +13,7 @@ public class SqlUtil
/** /**
* 定义常用的 sql关键字 * 定义常用的 sql关键字
*/ */
public static String SQL_REGEX = "and |extractvalue|updatexml|sleep|exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |or |union |like |+|/*|user()"; public static String SQL_REGEX = "\u000B|and |extractvalue|updatexml|sleep|exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |or |union |like |+|/*|user()";
/** /**
* 仅支持字母、数字、下划线、空格、逗号、小数点（支持多个字段排序） * 仅支持字母、数字、下划线、空格、逗号、小数点（支持多个字段排序）