潘钊 / bsth_control · Commits

Commit 6b52b7ba72cfbb085cc1afc134a682172f2c747a

Authored by 娄高锋
1 parent 09464c44
build: skipped

改掉sql拼接（sql注入漏洞）。

Inline Side-by-side
Showing 1 changed file with 72 additions and 29 deletions
src/main/java/com/bsth/service/impl/BusIntervalServiceImpl.java
  View file @6b52b7b
... ... @@ -100,9 +100,14 @@ public class BusIntervalServiceImpl implements BusIntervalService {
100 100  
101 101 try {
102 102  
103   - String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str >= '"+startDate+"' and schedule_date_str <= '"+endDate+"'";
  103 + List<String> objList = new ArrayList<String>();
  104 + String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str >= ? and schedule_date_str <= ?";
  105 + objList.add(startDate);
  106 + objList.add(endDate);
  107 +
104 108 if(line.length() != 0){
105   - sql += " and xl_bm = '"+line+"'";
  109 + sql += " and xl_bm = ?";
  110 + objList.add(line);
106 111 }
107 112 if(times.length() != 0){
108 113 String[] split = times.split("-");
... ... @@ -117,16 +122,19 @@ public class BusIntervalServiceImpl implements BusIntervalService {
117 122 }
118 123 }
119 124 if(company.length() != 0){
120   - sql += " and gs_bm = '"+company+"'";
  125 + sql += " and gs_bm = ?";
  126 + objList.add(company);
121 127 }
122 128 if(subCompany.length() != 0){
123   - sql += " and fgs_bm = '"+subCompany+"'";
  129 + sql += " and fgs_bm = ?";
  130 + objList.add(subCompany);
124 131 }
125 132 if(normal){
126 133 sql += " and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks'";
127 134 }
128 135  
129 136 list = jdbcTemplate.query(sql,
  137 + objList.toArray(),
130 138 new RowMapper<ScheduleRealInfo>(){
131 139 @Override
132 140 public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -222,14 +230,20 @@ public class BusIntervalServiceImpl implements BusIntervalService {
222 230 });
223 231  
224 232 if(model.length() != 0){
225   -// sql = "select * from bsth_c_s_ttinfo_detail where ttinfo = '"+model+"' and bc_type != 'in' and bc_type != 'out'";
226   - sql = "select id from bsth_c_s_sp_info where tt_info = '" + model + "' and bc_type != 'in' and bc_type != 'out'" +
227   - " and bc_type != 'ldks' and schedule_date >= '"+startDate+"' and schedule_date <= '"+endDate+"'";
  233 + List<String> objList2 = new ArrayList<String>();
  234 + sql = "select id from bsth_c_s_sp_info where tt_info = ? and bc_type != 'in' and bc_type != 'out'" +
  235 + " and bc_type != 'ldks' and schedule_date >= ? and schedule_date <= ?";
  236 + objList2.add(model);
  237 + objList2.add(startDate);
  238 + objList2.add(endDate);
  239 +
228 240 if(line.length() != 0){
229   - sql += " and xl_bm = '"+line+"'";
  241 + sql += " and xl_bm = ?";
  242 + objList2.add(line);
230 243 }
231 244  
232 245 ttList = jdbcTemplate.query(sql,
  246 + objList2.toArray(),
233 247 new RowMapper<Long>(){
234 248 @Override
235 249 public Long mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -303,17 +317,22 @@ public class BusIntervalServiceImpl implements BusIntervalService {
303 317 Map<Long, Set<ChildTaskPlan>> schMap = new HashMap<Long, Set<ChildTaskPlan>>();
304 318 List<ChildTaskPlan> list = new ArrayList<ChildTaskPlan>();
305 319  
  320 + List<Object> objList = new ArrayList<Object>();
306 321 String sql = "select id,cc_id,mileage_type,destroy,destroy_reason," +
307 322 " mileage,type1,type2,schedule from bsth_c_s_child_task" +
308 323 " where 1=1";
  324 +
309 325 if(schedule1 != null && schedule1 > 0){
310   - sql += " and schedule >= '"+schedule1+"'";
  326 + sql += " and schedule >= ?";
  327 + objList.add(schedule1);
311 328 }
312 329 if(schedule2 != null && schedule2 > 0){
313   - sql += " and schedule <= '"+schedule2+"'";
  330 + sql += " and schedule <= ?";
  331 + objList.add(schedule2);
314 332 }
315 333  
316 334 list = jdbcTemplate.query(sql,
  335 + objList.toArray(),
317 336 new RowMapper<ChildTaskPlan>(){
318 337 @Override
319 338 public ChildTaskPlan mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -354,10 +373,12 @@ public class BusIntervalServiceImpl implements BusIntervalService {
354 373 String line = map.get("line").toString();
355 374  
356 375 try {
357   -
358   - String sql = "select start_station_name, end_station_name from bsth_c_line where line_code = '"+line+"'";
  376 + List<String> objList = new ArrayList<String>();
  377 + String sql = "select start_station_name, end_station_name from bsth_c_line where line_code = ?";
  378 + objList.add(line);
359 379  
360 380 list = jdbcTemplate.query(sql,
  381 + objList.toArray(),
361 382 new RowMapper<Map<String, Object>>(){
362 383 @Override
363 384 public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -393,16 +414,22 @@ public class BusIntervalServiceImpl implements BusIntervalService {
393 414 String ttId = map.get("ttId").toString();
394 415  
395 416 try {
  417 + List<String> objList = new ArrayList<String>();
396 418 String sql = "select td.lp, lp.lp_name from bsth_c_s_ttinfo_detail td" +
397 419 " left join bsth_c_s_gbi lp on td.lp = lp.id" +
398 420 " left join bsth_c_line cl on cl.id = td.xl where 1=1";
399   - if(line.length() != 0)
400   - sql += " and cl.line_code = '"+line+"'";
401   - if(ttId.length() != 0)
402   - sql += " and td.ttinfo = '"+ttId+"'";
  421 + if(line.length() != 0){
  422 + sql += " and cl.line_code = ?";
  423 + objList.add(line);
  424 + }
  425 + if(ttId.length() != 0){
  426 + sql += " and td.ttinfo = ?";
  427 + objList.add(ttId);
  428 + }
403 429 sql += " group by td.lp, lp.lp_name";
404 430  
405 431 list = jdbcTemplate.query(sql,
  432 + objList.toArray(),
406 433 new RowMapper<Map<String, Object>>(){
407 434 @Override
408 435 public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -2238,11 +2265,14 @@ public class BusIntervalServiceImpl implements BusIntervalService {
2238 2265 endDate = new SimpleDateFormat("yyyy-MM-dd").format(new Date());
2239 2266 }
2240 2267 try {
2241   -
2242   - String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str"
2243   - + " >= '"+startDate+"' and schedule_date_str <= '"+endDate+"'";
  2268 + List<String> objList = new ArrayList<String>();
  2269 + String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str >= ? and schedule_date_str <= ?";
  2270 + objList.add(startDate);
  2271 + objList.add(endDate);
  2272 +
2244 2273 if(line.length() != 0){
2245   - sql += " and xl_bm = '"+line+"'";
  2274 + sql += " and xl_bm = ?";
  2275 + objList.add(line);
2246 2276 }
2247 2277 if(sfqr == 1 && times.length() != 0){
2248 2278 String[] split = times.split("-");
... ... @@ -2257,14 +2287,17 @@ public class BusIntervalServiceImpl implements BusIntervalService {
2257 2287 }
2258 2288 }
2259 2289 if(company.length() != 0){
2260   - sql += " and gs_bm = '"+company+"'";
  2290 + sql += " and gs_bm = ?";
  2291 + objList.add(company);
2261 2292 }
2262 2293 if(subCompany.length() != 0){
2263   - sql += " and fgs_bm = '"+subCompany+"'";
  2294 + sql += " and fgs_bm = ?";
  2295 + objList.add(subCompany);
2264 2296 }
2265 2297 sql += " and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks'";
2266 2298  
2267 2299 list = jdbcTemplate.query(sql,
  2300 + objList.toArray(),
2268 2301 new RowMapper<ScheduleRealInfo>(){
2269 2302 @Override
2270 2303 public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -3052,20 +3085,30 @@ public class BusIntervalServiceImpl implements BusIntervalService {
3052 3085 if(map.get("sfyy")!=null)
3053 3086 sfyy = map.get("sfyy").toString().trim();
3054 3087  
  3088 + List<String> objList = new ArrayList<String>();
3055 3089 String sql = "select id, cl_zbh, fcsj, fcsj_actual, j_gh, j_name, lp_name, qdz_name, " +
3056 3090 "schedule_date_str, xl_name, zdsj, zdsj_actual, fgs_bm, fgs_name, gs_name, xl_dir, xl_bm " +
3057 3091 "from bsth_c_s_sp_info_real " +
3058   - "where schedule_date_str >= '"+startDate+"' and schedule_date_str <= '"+endDate+"' " +
  3092 + "where schedule_date_str >= ? and schedule_date_str <= ? " +
3059 3093 "and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks' and cc_service = 0";
  3094 + objList.add(startDate);
  3095 + objList.add(endDate);
3060 3096  
3061   - if(company.length() != 0)
3062   - sql += " and gs_bm = '"+company+"'";
3063   - if(subCompany.length() != 0)
3064   - sql += " and fgs_bm = '"+subCompany+"'";
3065   - if(line.length() != 0)
3066   - sql += " and xl_bm = '"+line+"'";
  3097 + if(company.length() != 0){
  3098 + sql += " and gs_bm = ?";
  3099 + objList.add(company);
  3100 + }
  3101 + if(subCompany.length() != 0){
  3102 + sql += " and fgs_bm = ?";
  3103 + objList.add(subCompany);
  3104 + }
  3105 + if(line.length() != 0){
  3106 + sql += " and xl_bm = ?";
  3107 + objList.add(line);
  3108 + }
3067 3109  
3068 3110 List<ScheduleRealInfo> list = jdbcTemplate.query(sql,
  3111 + objList.toArray(),
3069 3112 new RowMapper<ScheduleRealInfo>(){
3070 3113 @Override
3071 3114 public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
... ...