Question

我有一个类似sql的

String sql = """SELECT id, name, sex, age, bron_year, address, phone, state, comment, is_hbp, is_dm, is_cva, is_copd, is_chd, is_cancer, is_floating, is_poor, is_disability, is_mental
 FROM statistics_stin WHERE 1=1
 ${p.team_num == 0 ? "" : "AND team_num = ${p.team_num}"}
 ${p.zone == 0 ? "" : "AND team_id = ${p.zone}"}
 ${p.is_hbp == 2 ? "" : "AND is_hbp = ${p.is_hbp}"}
 ${p.is_dm == 2 ? "" : "AND is_dm = ${p.is_dm}"}
 ${p.is_chd == 2 ? "" : "AND is_chd = ${p.is_chd}"}
 ${p.is_cva == 2 ? "" : "AND is_cva = ${p.is_cva}"}
 ${p.is_copd == 2 ? "" : "AND is_copd = ${p.is_copd}"}
 ${p.is_cancer == 2 ? "" : "AND is_cancer = ${p.is_cancer}"}
 ${p.is_floating == 2 ? "" : "AND is_floating = ${p.is_floating}"}
 ${p.is_poor == 2 ? "" : "AND is_poor = ${p.is_poor}"}
 ${p.is_disability == 2 ? "" : "AND is_disability = ${p.is_disability}"}
 ${p.is_mental == 2 ? "" : "AND is_mental = ${p.is_mental}"}
 ${p.is_aged == 2 ? "" : (p.is_aged == 1 ? " AND age >= 65" : " AND age < 65")}
 ${p.is_prep_aged == 2 ? "" : (p.is_prep_aged == 1 ? "AND (age BETWEEN 60 AND 64)" : "AND (age < 60 OR age > 64)")}
 ${p.is_young == 2 ? "" : (p.is_young == 1 ? " AND age < 60" : " AND age >= 60")}
 ORDER BY team_id ASC, id ASC
 LIMIT ${start}, ${page_size}
 """;

然后使用：

def datasource = ctx.lookup("jdbc/mysql");
def executer = Sql.newInstance(datasource);
def rows = executer.rows(sql);

此处p是一个json对象，例如：

p = {is_aged=2, is_cancer=2, is_chd=1, is_copd=2, is_cva=2, is_disability=2, is_dm=2, is_floating=2, is_hbp=1, is_mental=2, is_poor=2, pn=1, team_num=0, zone=0}

这种方式具有sql注入。我知道我可以使用以下参数类型：

executer.rows('SELECT * from statistics_stin WHERE is_chd=:is_chd', [is_chd: 1]);

但是这种情况有很多AND条件，是否使用将由json p决定。

请怎么做？

Answer 1

您有动态SQL绑定的问题，即绑定参数的数量不是恒定的，而是取决于输入。

Tom Kyte提供了一种优雅的解决方案在Groovy中实现得更加优雅

基本思想是简单绑定所有变量，具有输入值且应使用的变量会正常处理，例如

 col1 = :col1

没有输入（将被忽略）的变量被绑定到一个虚拟构造：

 (1=1 or :col2 is NULL)

即快捷方式评估实际上会忽略它们。

这里有两个三列示例

 def p = ["col1" : 1, "col2" : 2, "col3" : 3]

此输入将导致完整查询

SELECT col1, col2, col3
 FROM tab WHERE
 col1 = :col1 AND
 col2 = :col2 AND
 col3 = :col3
ORDER by col1,col2,col3

对于有限输入

 p = [ "col3" : 3]

您收到此查询

SELECT col1, col2, col3
 FROM tab WHERE
 (1=1 or :col1 is NULL) AND
 (1=1 or :col2 is NULL) AND
 col3 = :col3
ORDER by col1,col2,col3

此处是Groovy创建的SQL语句

String sql = """SELECT col1, col2, col3
 FROM tab WHERE   
 ${(!p.col1) ? "(1=1 or :col1 is NULL)" : "col1 = :col1"} AND
 ${(!p.col2) ? "(1=1 or :col2 is NULL)" : "col2 = :col2"} AND
 ${(!p.col3) ? "(1=1 or :col3 is NULL)" : "col3 = :col3"}  
ORDER by col1,col2,col3
"""

您甚至可以摆脱丑陋的1=1谓词；）

Answer 2

另一种选择是在构建查询时构建绑定，然后执行rows

的适当实现

def query = new StringBuilder( "SELECT id, name, sex, age, bron_year, address, phone, state, comment, is_hbp, is_dm, is_cva, is_copd, is_chd, is_cancer, is_floating, is_poor, is_disability, is_mental FROM statistics_stin WHERE 1=1" )
def binds = []
if ( p.team_num == 0 ) {
    query.append( ' AND team_num = ? ' )
    binds << p.team_num
}
if ( p.zone == 0 ) {
    query.append( ' AND team_id = ? ' )
    binds << p.zone == 0
}
...
executer.rows(query.toString(), binds);

如何防止使用Groovy进行sql注入？

2 个答案: