Merge remote-tracking branch 'origin/main'

cf-module-report/cf-module-report-api/src/main/java/com/cf/imes/module/report/enums/ErrorCodeConstants.java

@@ -28,6 +28,5 @@ public final class ErrorCodeConstants {
     public static final ErrorCode DATASET_NOT_EXISTS = new ErrorCode(1_003_003_001, "报表数据集不存在或权限不足");
     public static final ErrorCode DATASET_SQL_INJECTION_RISK = new ErrorCode(1_003_003_002, "存在SQL注入风险");
     public static final ErrorCode DATASET_SQL_REQUIRED = new ErrorCode(1_003_003_003, "SQL语句不能为空");
-    public static final ErrorCode DATASET_SQL_ILLEGAL = new ErrorCode(1_003_003_004, "SQL语句非法");
-    public static final ErrorCode DATASET_GET_FIELDS_ERROR = new ErrorCode(1_003_003_005, "获取表字段");
+    public static final ErrorCode DATASET_GET_FIELDS_ERROR = new ErrorCode(1_003_003_004, "获取表字段异常");
 }

cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/ureport/bean/OrderSummaryBeanDatasource.java

@@ -177,6 +177,14 @@ public class OrderSummaryBeanDatasource {
         return resultList;
     }
 
+    /**
+     * 配件明细
+     *
+     * @param dsName
+     * @param datasetName
+     * @param parameters
+     * @return
+     */
     public List<Map<String, Object>> orderPartDetailList(String dsName, String datasetName, Map<String, Object> parameters) {
         log.info("报表数据源[OrderSummaryBeanDatasource][orderPartDetailList][{}][{}]调用开始", dsName, datasetName);
         List<Map<String, Object>> resultList = new ArrayList<>();
@@ -209,6 +217,14 @@ public class OrderSummaryBeanDatasource {
         return resultList;
     }
 
+    /**
+     * 配件汇总
+     *
+     * @param dsName
+     * @param datasetName
+     * @param parameters
+     * @return
+     */
     public List<Map<String, Object>> orderPartSummary(String dsName, String datasetName, Map<String, Object> parameters) {
         log.info("报表数据源[OrderSummaryBeanDatasource][orderPartSummary][{}][{}]调用开始", dsName, datasetName);
         List<Map<String, Object>> resultList = new ArrayList<>();

cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/datasource/ReportDatasourceServiceImpl.java

@@ -31,7 +31,6 @@ import com.cf.imes.module.report.dal.mysql.datasource.ReportDatasourceMapper;
 import com.cf.imes.module.report.enums.template.ReportTemplateTypeEnum;
 import com.cf.imes.module.report.framework.ureport.annotation.CfReportSpringbeanDatasource;
 import com.cf.imes.module.report.service.dataset.ReportDatasetService;
-import com.cf.imes.module.report.util.SqlInjectionUtil;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.BeansException;
@@ -56,7 +55,6 @@ import java.util.Map;
 
 import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASET_GET_FIELDS_ERROR;
-import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASET_SQL_ILLEGAL;
 import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASET_SQL_INJECTION_RISK;
 import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASET_SQL_REQUIRED;
 import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASOURCE_BUILDIN_OPERATION_PERMISSION_ERROR;
@@ -220,10 +218,6 @@ public class ReportDatasourceServiceImpl implements ReportDatasourceService {
             }
             // 获取数据库连接
             conn = MultipleJdbcTemplate.buildConnection(info);
-            // 自定义工具校验sql
-//            if (SqlInjectionUtil.checkEditSql(sql)) {
-//                throw exception(DATASET_SQL_ILLEGAL);
-//            }
             // 检查参数sql注入
             for (Parameter parameter : parameters) {
                 // mybatis-plus util检查参数

cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/template/ReportTemplateServiceImpl.java

@@ -128,8 +128,6 @@ public class ReportTemplateServiceImpl implements ReportTemplateService {
         ReportTemplateDO reportTemplateDO = validateTemplateExists(templateId);
         // 校验模板名唯一性
         validateTemplateNameUnique(createReqVO, isSuperAdmin);
-        // 校验内置模板操作权限
-        validateSystemTemplate(reportTemplateDO);
         ReportTemplateDO copyTemplateDO = BeanUtils.toBean(reportTemplateDO, ReportTemplateDO.class);
         // 重置id
         copyTemplateDO.setId(null);

cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/util/SqlInjectionUtil.java

@@ -1,37 +0,0 @@
-package com.cf.imes.module.report.util;
-
-import java.util.Objects;
-import java.util.regex.Pattern;
-
-/**
- * SQL 注入验证工具类
- * from com.baomidou.mybatisplus.core.toolkit.sql.SqlInjectionUtil
- * @author Gqr
- * @since 2024/7/18 11:09
- */
-public class SqlInjectionUtil {
-    /**
-     * SQL语法检查正则：符合两个关键字（有先后顺序）才算匹配
-     */
-    private static final Pattern SQL_EDIT_PATTERN = Pattern.compile("(insert|delete|update|create|drop|truncate|grant|alter|deny|revoke|call|execute|exec|declare|show|rename|set)" +
-            "\\s+.*(into|from|set|where|table|database|view|index|on|cursor|procedure|trigger|for|password|union|and|or)", Pattern.CASE_INSENSITIVE);
-
-    /**
-     * 使用'、;或注释截断SQL检查正则
-     */
-    private static final Pattern SQL_COMMENT_PATTERN = Pattern.compile("'.*(or|union|--|#|/\\*|;)", Pattern.CASE_INSENSITIVE);
-
-    /**
-     * 检查SQL 不允许修改结构或数据
-     *
-     * @param sql sql语句
-     * @return true 非法 false 合法
-     */
-    public static boolean checkEditSql(String sql) {
-        Objects.requireNonNull(sql);
-        return SQL_COMMENT_PATTERN.matcher(sql).find() || SQL_EDIT_PATTERN.matcher(sql).find();
-    }
-
-    private SqlInjectionUtil() {
-    }
-}