Question

作为标题，当我使用SQLException函数时，我得到dbms_random：

SELECT DBMS_RANDOM.value(1, 100) AS datas FROM dual

但SQL在PL / SQL中正确执行。

此外，我使用的连接池是德鲁伊。

异常堆栈如下：

15-Sep-2014 11:02:04.397 SEVERE [http-apr-8080-exec-7] com.jfinal.core.ActionHandler.error /chart/tableData?QUERY_ID=16
 com.jfinal.plugin.activerecord.ActiveRecordException: java.sql.SQLException: sql injection violation, deny object : dbms_random : select distinct (a.demand_id) as demand_id,  a.demand_title as demand_title,   f.product_version_id,   h.name,   to_char(a.qa_time, 'yyyy-mm-dd') as qa_time,   e.op_name as op_name,   dbms_random.value(1, 100) as datas from demand_request a,  assignment b,  group_op_info d,  op_login e,  product_version f,  project  g,  province h where a.demand_id = b.demand_id and b.closer_id = d.op_id and d.op_id = e.op_id and a.project_code = g.proj_code and g.area_id = h.id
    at com.jfinal.plugin.activerecord.DbPro.find(DbPro.java:323)
    at com.jfinal.plugin.activerecord.DbPro.find(DbPro.java:334)
    at com.jfinal.plugin.activerecord.Db.find(Db.java:233)
    at com.qms.db.chart.ChartController.tableData(ChartController.java:23)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at com.jfinal.core.ActionInvocation.invoke(ActionInvocation.java:55)
    at com.jfinal.core.ActionHandler.handle(ActionHandler.java:73)
    at com.jfinal.core.JFinalFilter.doFilter(JFinalFilter.java:72)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:534)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1081)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:658)
    at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:277)
    at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2381)
    at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2370)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)
Caused by: java.sql.SQLException: sql injection violation, deny object : dbms_random : select distinct (a.demand_id) as demand_id,  a.demand_title as demand_title,   f.product_version_id,   h.name,   to_char(a.qa_time, 'yyyy-mm-dd') as qa_time,   e.op_name as op_name,   dbms_random.value(1, 100) as datas from demand_request a,  assignment b,  group_op_info d,  op_login e,  product_version f,  project  g,  province h where a.demand_id = b.demand_id and b.closer_id = d.op_id and d.op_id = e.op_id and a.project_code = g.proj_code and g.area_id = h.id
    at com.alibaba.druid.wall.WallFilter.check(WallFilter.java:714)
    at com.alibaba.druid.wall.WallFilter.connection_prepareStatement(WallFilter.java:240)
    at com.alibaba.druid.filter.FilterChainImpl.connection_prepareStatement(FilterChainImpl.java:448)
    at com.alibaba.druid.proxy.jdbc.ConnectionProxyImpl.prepareStatement(ConnectionProxyImpl.java:342)
    at com.alibaba.druid.pool.DruidPooledConnection.prepareStatement(DruidPooledConnection.java:311)
    at com.jfinal.plugin.activerecord.DbPro.find(DbPro.java:306)
    at com.jfinal.plugin.activerecord.DbPro.find(DbPro.java:321)
    ... 29 more

Answer 1

德鲁伊似乎是一种哄骗。所以检查德鲁伊文件。

Druid WallFilter

然后，改变我的德鲁伊配置并解决问题。

WallConfig wallConfig = new WallConfig();
wallConfig.setFunctionCheck(false);
wall.setConfig(wallConfig);

java.sql.SQLException：sql注入违例，拒绝对象：dbms_random

1 个答案: