1.

王通
1 parent 6204c644
Showing 2 changed files with 24 additions and 1 deletions
src/main/java/com/bsth/controller/realcontrol/AdminUtilsController.java
src/main/java/com/bsth/filter/SQLInjectFilter.java
@@ -6,6 +6,7 @@ import java.text.SimpleDateFormat;
 import java.util.*;
  
 import com.bsth.data.BasicData;
+import com.bsth.filter.SQLInjectFilter;
 import com.bsth.service.schedule.utils.SpringUtils;
 import com.bsth.util.MailUtils;
 import com.fasterxml.jackson.core.JsonProcessingException;
@@ -306,4 +307,17 @@ public class AdminUtilsController {
  
         return "error";
     }
+
+    @RequestMapping("/setInjectStr")
+    public String setInjectStr(@RequestParam String injectStr) {
+        Map<String, Object> result = new HashMap<>();
+        try {
+            SQLInjectFilter.setInjStr(injectStr);
+            return "success";
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+
+        return "error";
+    }
 }
 \ No newline at end of file
@@ -12,6 +12,8 @@ import java.util.Enumeration;
 @Component
 public class SQLInjectFilter extends BaseFilter{
  
+	private static String injStr = "'|and|exec|create|insert|select|delete|update|count|*|%|chr|mid|master|truncate|drop|char|declare|+";
+
 	@Override
 	public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
 			throws IOException, ServletException {
@@ -33,7 +35,6 @@ public class SQLInjectFilter extends BaseFilter{
 	}
  
 	private static boolean isSqlInject(String injectStr) {
-		String injStr = "'|and|exec|create|insert|select|delete|update|count|*|%|chr|mid|master|truncate|drop|char|declare|or|+";
 		String injStrArr[] = injStr.split("\\|");
 		injectStr = injectStr.toLowerCase();
 		for (int i = 0; i < injStrArr.length; i++) {
@@ -43,4 +44,12 @@ public class SQLInjectFilter extends BaseFilter{
 		}
 		return false;
 	}
+
+	public static String getInjStr() {
+		return injStr;
+	}
+
+	public static void setInjStr(String injStr) {
+		SQLInjectFilter.injStr = injStr;
+	}
 }