diff --git a/cf-module-report/cf-module-report-api/src/main/java/com/cf/imes/module/report/enums/ErrorCodeConstants.java b/cf-module-report/cf-module-report-api/src/main/java/com/cf/imes/module/report/enums/ErrorCodeConstants.java index 935a60b52..a594ec997 100644 --- a/cf-module-report/cf-module-report-api/src/main/java/com/cf/imes/module/report/enums/ErrorCodeConstants.java +++ b/cf-module-report/cf-module-report-api/src/main/java/com/cf/imes/module/report/enums/ErrorCodeConstants.java @@ -28,6 +28,5 @@ public final class ErrorCodeConstants { public static final ErrorCode DATASET_NOT_EXISTS = new ErrorCode(1_003_003_001, "报表数据集不存在或权限不足"); public static final ErrorCode DATASET_SQL_INJECTION_RISK = new ErrorCode(1_003_003_002, "存在SQL注入风险"); public static final ErrorCode DATASET_SQL_REQUIRED = new ErrorCode(1_003_003_003, "SQL语句不能为空"); - public static final ErrorCode DATASET_SQL_ILLEGAL = new ErrorCode(1_003_003_004, "SQL语句非法"); - public static final ErrorCode DATASET_GET_FIELDS_ERROR = new ErrorCode(1_003_003_005, "获取表字段"); + public static final ErrorCode DATASET_GET_FIELDS_ERROR = new ErrorCode(1_003_003_004, "获取表字段异常"); } diff --git a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/ureport/bean/OrderSummaryBeanDatasource.java b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/ureport/bean/OrderSummaryBeanDatasource.java index be3a35671..48863dc71 100644 --- a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/ureport/bean/OrderSummaryBeanDatasource.java +++ b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/ureport/bean/OrderSummaryBeanDatasource.java @@ -177,6 +177,14 @@ public class OrderSummaryBeanDatasource { return resultList; } + /** + * 配件明细 + * + * @param dsName + * @param datasetName + * @param parameters + * @return + */ public List> orderPartDetailList(String dsName, String datasetName, Map parameters) { log.info("报表数据源[OrderSummaryBeanDatasource][orderPartDetailList][{}][{}]调用开始", dsName, datasetName); List> resultList = new ArrayList<>(); @@ -209,6 +217,14 @@ public class OrderSummaryBeanDatasource { return resultList; } + /** + * 配件汇总 + * + * @param dsName + * @param datasetName + * @param parameters + * @return + */ public List> orderPartSummary(String dsName, String datasetName, Map parameters) { log.info("报表数据源[OrderSummaryBeanDatasource][orderPartSummary][{}][{}]调用开始", dsName, datasetName); List> resultList = new ArrayList<>(); diff --git a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/datasource/ReportDatasourceServiceImpl.java b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/datasource/ReportDatasourceServiceImpl.java index 5df8cbf3a..bf065e7d7 100644 --- a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/datasource/ReportDatasourceServiceImpl.java +++ b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/datasource/ReportDatasourceServiceImpl.java @@ -31,7 +31,6 @@ import com.cf.imes.module.report.dal.mysql.datasource.ReportDatasourceMapper; import com.cf.imes.module.report.enums.template.ReportTemplateTypeEnum; import com.cf.imes.module.report.framework.ureport.annotation.CfReportSpringbeanDatasource; import com.cf.imes.module.report.service.dataset.ReportDatasetService; -import com.cf.imes.module.report.util.SqlInjectionUtil; import lombok.extern.slf4j.Slf4j; import org.apache.commons.lang3.StringUtils; import org.springframework.beans.BeansException; @@ -56,7 +55,6 @@ import java.util.Map; import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception; import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASET_GET_FIELDS_ERROR; -import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASET_SQL_ILLEGAL; import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASET_SQL_INJECTION_RISK; import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASET_SQL_REQUIRED; import static com.cf.imes.module.report.enums.ErrorCodeConstants.DATASOURCE_BUILDIN_OPERATION_PERMISSION_ERROR; @@ -220,10 +218,6 @@ public class ReportDatasourceServiceImpl implements ReportDatasourceService { } // 获取数据库连接 conn = MultipleJdbcTemplate.buildConnection(info); - // 自定义工具校验sql -// if (SqlInjectionUtil.checkEditSql(sql)) { -// throw exception(DATASET_SQL_ILLEGAL); -// } // 检查参数sql注入 for (Parameter parameter : parameters) { // mybatis-plus util检查参数 diff --git a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/template/ReportTemplateServiceImpl.java b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/template/ReportTemplateServiceImpl.java index 48acb4d16..675459299 100644 --- a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/template/ReportTemplateServiceImpl.java +++ b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/service/template/ReportTemplateServiceImpl.java @@ -128,8 +128,6 @@ public class ReportTemplateServiceImpl implements ReportTemplateService { ReportTemplateDO reportTemplateDO = validateTemplateExists(templateId); // 校验模板名唯一性 validateTemplateNameUnique(createReqVO, isSuperAdmin); - // 校验内置模板操作权限 - validateSystemTemplate(reportTemplateDO); ReportTemplateDO copyTemplateDO = BeanUtils.toBean(reportTemplateDO, ReportTemplateDO.class); // 重置id copyTemplateDO.setId(null); diff --git a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/util/SqlInjectionUtil.java b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/util/SqlInjectionUtil.java deleted file mode 100644 index 9cd347341..000000000 --- a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/util/SqlInjectionUtil.java +++ /dev/null @@ -1,37 +0,0 @@ -package com.cf.imes.module.report.util; - -import java.util.Objects; -import java.util.regex.Pattern; - -/** - * SQL 注入验证工具类 - * from com.baomidou.mybatisplus.core.toolkit.sql.SqlInjectionUtil - * @author Gqr - * @since 2024/7/18 11:09 - */ -public class SqlInjectionUtil { - /** - * SQL语法检查正则：符合两个关键字（有先后顺序）才算匹配 - */ - private static final Pattern SQL_EDIT_PATTERN = Pattern.compile("(insert|delete|update|create|drop|truncate|grant|alter|deny|revoke|call|execute|exec|declare|show|rename|set)" + - "\\s+.*(into|from|set|where|table|database|view|index|on|cursor|procedure|trigger|for|password|union|and|or)", Pattern.CASE_INSENSITIVE); - - /** - * 使用'、;或注释截断SQL检查正则 - */ - private static final Pattern SQL_COMMENT_PATTERN = Pattern.compile("'.*(or|union|--|#|/\\*|;)", Pattern.CASE_INSENSITIVE); - - /** - * 检查SQL 不允许修改结构或数据 - * - * @param sql sql语句 - * @return true 非法 false 合法 - */ - public static boolean checkEditSql(String sql) { - Objects.requireNonNull(sql); - return SQL_COMMENT_PATTERN.matcher(sql).find() || SQL_EDIT_PATTERN.matcher(sql).find(); - } - - private SqlInjectionUtil() { - } -} diff --git a/cf-module-report/cf-module-report-biz/src/main/resources/lib/ureport-core-2.3.0-SNAPSHOT.jar b/cf-module-report/cf-module-report-biz/src/main/resources/lib/ureport-core-2.3.0-SNAPSHOT.jar index 4b20744ce..ddb08068b 100644 Binary files a/cf-module-report/cf-module-report-biz/src/main/resources/lib/ureport-core-2.3.0-SNAPSHOT.jar and b/cf-module-report/cf-module-report-biz/src/main/resources/lib/ureport-core-2.3.0-SNAPSHOT.jar differ