Server:子查询防SQL注入并优化@from的别名以及注释等

TommyLemon · TommyLemon · commit b65bb4faa0e8 · 2019-01-13T18:10:59.000+08:00
diff --git a/APIJSON-Java-Server/APIJSONDemo/src/main/java/apijson/demo/server/DemoSQLConfig.java b/APIJSON-Java-Server/APIJSONDemo/src/main/java/apijson/demo/server/DemoSQLConfig.java
@@ -59,14 +59,6 @@ public String getSchema() {
 		String s = super.getSchema();
 		return StringUtil.isEmpty(s, true) ? "sys" : s; //TODO 改成你自己的
 	}
-	
-	@Override
-	public String getSubqueryString(Subquery subquery) throws Exception {
-		//TODO 用 SQLExecutor 的 preparedStatement 返回的
-//		String range = subquery.getRange();
-//		return (range  == null || range.isEmpty() ? "" : range) + "(" + subquery.getConfig().getSQL(false) + ") ";
-		throw new UnsupportedOperationException("未解决 SQL 注入，暂不支持");
-	}
 
 	public DemoSQLConfig() {
 		this(RequestMethod.GET);
diff --git a/APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractSQLConfig.java b/APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractSQLConfig.java
@@ -754,7 +754,7 @@ public SQLConfig setJoinList(List<Join> joinList) {
 	public boolean hasJoin() {
 		return joinList != null && joinList.isEmpty() == false;
 	}
-	
+
 
 	@Override
 	public boolean isTest() {
@@ -1152,7 +1152,7 @@ public String getEqualString(String key, Object value) throws Exception {
 		if (StringUtil.isName(key) == false) {
 			throw new IllegalArgumentException(key + ":value 中key不合法！不支持 ! 以外的逻辑符 ！");
 		}
-		
+
 		return getKey(key) + (not ? "!=" : "=") + (value instanceof Subquery ? getSubqueryString((Subquery) value) : getValue(value));
 	}
 
@@ -1346,12 +1346,12 @@ public String getBetweenString(String key, Object[] values, int type) throws Ill
 			if (values[i] instanceof String == false) {
 				throw new IllegalArgumentException(key + "%:value 中 value 的类型只能为 String 或 String[] ！");
 			}
-			
+
 			vs = StringUtil.split((String) values[i]);
 			if (vs == null || vs.length != 2) {
 				throw new IllegalArgumentException(key + "%:value 中 value 不合法！类型为 String 时必须包括1个逗号 , 且左右两侧都有值！类型为 String[] 里面每个元素要符合前面类型为 String 的规则 ！");
 			}
-			
+
 			condition += (i <= 0 ? "" : (Logic.isAnd(type) ? AND : OR)) + "(" + getBetweenString(key, vs[0], vs[1]) + ")";
 		}
 
@@ -1522,6 +1522,27 @@ public String getContainString(String key, Object[] childs, int type) throws Ill
 	}
 	//<> contain >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 
+
+
+	//key@:{} Subquery <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+
+	@Override
+	public String getSubqueryString(Subquery subquery) throws Exception {
+		String range = subquery.getRange();
+		SQLConfig cfg = subquery.getConfig();
+
+		cfg.setPreparedValueList(new ArrayList<>());
+		String sql = (range  == null || range.isEmpty() ? "" : range) + "(" + cfg.getSQL(isPrepared()) + ") ";
+		
+		preparedValueList.addAll(cfg.getPreparedValueList());
+		
+		return sql;
+	}
+
+	//key@:{} Subquery >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+
+
+
 	/**拼接条件
 	 * @param not
 	 * @param condition
@@ -1689,9 +1710,9 @@ private static String getConditionString(String column, String table, AbstractSQ
 
 		Subquery from = config.getFrom();
 		if (from != null) {
-			table = config.getSubqueryString(from) + " AS " + config.getKey(from.getFrom()) + " "; //TODO Comment:c 转为  AS `Comment:c`
+			table = config.getSubqueryString(from) + " AS " + config.getAlias() + " "; //TODO Comment:c 转为  AS `Comment:c`
 		}
-		
+
 		String condition = table + config.getJoinString() + where + (
 				RequestMethod.isGetMethod(config.getMethod(), true) == false ?
 						"" : config.getGroupString() + config.getHavingString() + config.getOrderString()
diff --git a/APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/Subquery.java b/APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/Subquery.java
@@ -22,13 +22,13 @@
  */
 public class Subquery {
 	
-	private String path; // any, all
-	private String originKey;
-	private JSONObject originValue;
+	private String path; // []/0/User
+	private String originKey; //id{}@
+	private JSONObject originValue; // { "from": "Comment", "Comment": {...} }
 
-	private String from; // any, all
+	private String from; // Comment
 	private String range; // any, all
-	private String key; //id
+	private String key; //id{}
 	private SQLConfig config;
 	
 	@JSONField(serialize = false) //解决泄漏 SQLConfig 里的 dbPassword 等
