潘钊 / bsth_control · Commits

Commit 744f3642de040c85b66bff6eb862d30e0a028266

Authored by 娄高锋
1 parent 275b243c
build: skipped

改掉sql拼接（sql注入漏洞）。

Inline Side-by-side
Showing 1 changed file with 72 additions and 29 deletions
src/main/java/com/bsth/service/impl/BusIntervalServiceImpl.java
  View file @744f364
... ... @@ -100,9 +100,14 @@ public class BusIntervalServiceImpl implements BusIntervalService {
100 100  
101 101 try {
102 102  
103   - String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str >= '"+startDate+"' and schedule_date_str <= '"+endDate+"'";
  103 + List<String> objList = new ArrayList<String>();
  104 + String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str >= ? and schedule_date_str <= ?";
  105 + objList.add(startDate);
  106 + objList.add(endDate);
  107 +
104 108 if(line.length() != 0){
105   - sql += " and xl_bm = '"+line+"'";
  109 + sql += " and xl_bm = ?";
  110 + objList.add(line);
106 111 }
107 112 if(times.length() != 0){
108 113 String[] split = times.split("-");
... ... @@ -117,16 +122,19 @@ public class BusIntervalServiceImpl implements BusIntervalService {
117 122 }
118 123 }
119 124 if(company.length() != 0){
120   - sql += " and gs_bm = '"+company+"'";
  125 + sql += " and gs_bm = ?";
  126 + objList.add(company);
121 127 }
122 128 if(subCompany.length() != 0){
123   - sql += " and fgs_bm = '"+subCompany+"'";
  129 + sql += " and fgs_bm = ?";
  130 + objList.add(subCompany);
124 131 }
125 132 if(normal){
126 133 sql += " and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks'";
127 134 }
128 135  
129 136 list = jdbcTemplate.query(sql,
  137 + objList.toArray(),
130 138 new RowMapper<ScheduleRealInfo>(){
131 139 @Override
132 140 public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -222,14 +230,20 @@ public class BusIntervalServiceImpl implements BusIntervalService {
222 230 });
223 231  
224 232 if(model.length() != 0){
225   -// sql = "select * from bsth_c_s_ttinfo_detail where ttinfo = '"+model+"' and bc_type != 'in' and bc_type != 'out'";
226   - sql = "select id from bsth_c_s_sp_info where tt_info = '" + model + "' and bc_type != 'in' and bc_type != 'out'" +
227   - " and bc_type != 'ldks' and schedule_date >= '"+startDate+"' and schedule_date <= '"+endDate+"'";
  233 + List<String> objList2 = new ArrayList<String>();
  234 + sql = "select id from bsth_c_s_sp_info where tt_info = ? and bc_type != 'in' and bc_type != 'out'" +
  235 + " and bc_type != 'ldks' and schedule_date >= ? and schedule_date <= ?";
  236 + objList2.add(model);
  237 + objList2.add(startDate);
  238 + objList2.add(endDate);
  239 +
228 240 if(line.length() != 0){
229   - sql += " and xl_bm = '"+line+"'";
  241 + sql += " and xl_bm = ?";
  242 + objList2.add(line);
230 243 }
231 244  
232 245 ttList = jdbcTemplate.query(sql,
  246 + objList2.toArray(),
233 247 new RowMapper<Long>(){
234 248 @Override
235 249 public Long mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -303,17 +317,22 @@ public class BusIntervalServiceImpl implements BusIntervalService {
303 317 Map<Long, Set<ChildTaskPlan>> schMap = new HashMap<Long, Set<ChildTaskPlan>>();
304 318 List<ChildTaskPlan> list = new ArrayList<ChildTaskPlan>();
305 319  
  320 + List<Object> objList = new ArrayList<Object>();
306 321 String sql = "select id,cc_id,mileage_type,destroy,destroy_reason," +
307 322 " mileage,type1,type2,schedule from bsth_c_s_child_task" +
308 323 " where 1=1";
  324 +
309 325 if(schedule1 != null && schedule1 > 0){
310   - sql += " and schedule >= '"+schedule1+"'";
  326 + sql += " and schedule >= ?";
  327 + objList.add(schedule1);
311 328 }
312 329 if(schedule2 != null && schedule2 > 0){
313   - sql += " and schedule <= '"+schedule2+"'";
  330 + sql += " and schedule <= ?";
  331 + objList.add(schedule2);
314 332 }
315 333  
316 334 list = jdbcTemplate.query(sql,
  335 + objList.toArray(),
317 336 new RowMapper<ChildTaskPlan>(){
318 337 @Override
319 338 public ChildTaskPlan mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -354,10 +373,12 @@ public class BusIntervalServiceImpl implements BusIntervalService {
354 373 String line = map.get("line").toString();
355 374  
356 375 try {
357   -
358   - String sql = "select start_station_name, end_station_name from bsth_c_line where line_code = '"+line+"'";
  376 + List<String> objList = new ArrayList<String>();
  377 + String sql = "select start_station_name, end_station_name from bsth_c_line where line_code = ?";
  378 + objList.add(line);
359 379  
360 380 list = jdbcTemplate.query(sql,
  381 + objList.toArray(),
361 382 new RowMapper<Map<String, Object>>(){
362 383 @Override
363 384 public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -393,16 +414,22 @@ public class BusIntervalServiceImpl implements BusIntervalService {
393 414 String ttId = map.get("ttId").toString();
394 415  
395 416 try {
  417 + List<String> objList = new ArrayList<String>();
396 418 String sql = "select td.lp, lp.lp_name from bsth_c_s_ttinfo_detail td" +
397 419 " left join bsth_c_s_gbi lp on td.lp = lp.id" +
398 420 " left join bsth_c_line cl on cl.id = td.xl where 1=1";
399   - if(line.length() != 0)
400   - sql += " and cl.line_code = '"+line+"'";
401   - if(ttId.length() != 0)
402   - sql += " and td.ttinfo = '"+ttId+"'";
  421 + if(line.length() != 0){
  422 + sql += " and cl.line_code = ?";
  423 + objList.add(line);
  424 + }
  425 + if(ttId.length() != 0){
  426 + sql += " and td.ttinfo = ?";
  427 + objList.add(ttId);
  428 + }
403 429 sql += " group by td.lp, lp.lp_name";
404 430  
405 431 list = jdbcTemplate.query(sql,
  432 + objList.toArray(),
406 433 new RowMapper<Map<String, Object>>(){
407 434 @Override
408 435 public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -2356,11 +2383,14 @@ public class BusIntervalServiceImpl implements BusIntervalService {
2356 2383 endDate = new SimpleDateFormat("yyyy-MM-dd").format(new Date());
2357 2384 }
2358 2385 try {
2359   -
2360   - String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str"
2361   - + " >= '"+startDate+"' and schedule_date_str <= '"+endDate+"'";
  2386 + List<String> objList = new ArrayList<String>();
  2387 + String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str >= ? and schedule_date_str <= ?";
  2388 + objList.add(startDate);
  2389 + objList.add(endDate);
  2390 +
2362 2391 if(line.length() != 0){
2363   - sql += " and xl_bm = '"+line+"'";
  2392 + sql += " and xl_bm = ?";
  2393 + objList.add(line);
2364 2394 }
2365 2395 if(sfqr == 1 && times.length() != 0){
2366 2396 String[] split = times.split("-");
... ... @@ -2375,14 +2405,17 @@ public class BusIntervalServiceImpl implements BusIntervalService {
2375 2405 }
2376 2406 }
2377 2407 if(company.length() != 0){
2378   - sql += " and gs_bm = '"+company+"'";
  2408 + sql += " and gs_bm = ?";
  2409 + objList.add(company);
2379 2410 }
2380 2411 if(subCompany.length() != 0){
2381   - sql += " and fgs_bm = '"+subCompany+"'";
  2412 + sql += " and fgs_bm = ?";
  2413 + objList.add(subCompany);
2382 2414 }
2383 2415 sql += " and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks'";
2384 2416  
2385 2417 list = jdbcTemplate.query(sql,
  2418 + objList.toArray(),
2386 2419 new RowMapper<ScheduleRealInfo>(){
2387 2420 @Override
2388 2421 public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
... ... @@ -3170,20 +3203,30 @@ public class BusIntervalServiceImpl implements BusIntervalService {
3170 3203 if(map.get("sfyy")!=null)
3171 3204 sfyy = map.get("sfyy").toString().trim();
3172 3205  
  3206 + List<String> objList = new ArrayList<String>();
3173 3207 String sql = "select id, cl_zbh, fcsj, fcsj_actual, j_gh, j_name, lp_name, qdz_name, " +
3174 3208 "schedule_date_str, xl_name, zdsj, zdsj_actual, fgs_bm, fgs_name, gs_name, xl_dir, xl_bm " +
3175 3209 "from bsth_c_s_sp_info_real " +
3176   - "where schedule_date_str >= '"+startDate+"' and schedule_date_str <= '"+endDate+"' " +
  3210 + "where schedule_date_str >= ? and schedule_date_str <= ? " +
3177 3211 "and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks' and cc_service = 0";
  3212 + objList.add(startDate);
  3213 + objList.add(endDate);
3178 3214  
3179   - if(company.length() != 0)
3180   - sql += " and gs_bm = '"+company+"'";
3181   - if(subCompany.length() != 0)
3182   - sql += " and fgs_bm = '"+subCompany+"'";
3183   - if(line.length() != 0)
3184   - sql += " and xl_bm = '"+line+"'";
  3215 + if(company.length() != 0){
  3216 + sql += " and gs_bm = ?";
  3217 + objList.add(company);
  3218 + }
  3219 + if(subCompany.length() != 0){
  3220 + sql += " and fgs_bm = ?";
  3221 + objList.add(subCompany);
  3222 + }
  3223 + if(line.length() != 0){
  3224 + sql += " and xl_bm = ?";
  3225 + objList.add(line);
  3226 + }
3185 3227  
3186 3228 List<ScheduleRealInfo> list = jdbcTemplate.query(sql,
  3229 + objList.toArray(),
3187 3230 new RowMapper<ScheduleRealInfo>(){
3188 3231 @Override
3189 3232 public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
... ...