SpringBoot 整合mybatis SQL注入漏洞实践

SpringBoot 整合mybatis 请看

https://www.cnblogs.com/fczlm/p/14272917.html

这里主要记录mybatis的sql注入漏洞的实践测试。

首先在该项目下再创建一个数据库操作接口

@Mapper
public interface FindUserByIdMapper {
    public List<User> findUser(int id);
}

resource创建mybatis/FindUserByIdMapper.xml，这里注意看到的是使用了${userName}来拼接sql语句，这将造成sql注入的问题，正确的做法是#{userName}.既然知道${id}这种做法是不对的，那为什么mybatis为啥不干掉它？

在这里找到答案，有兴趣的自己去看看https://blog.csdn.net/weixin_42765975/article/details/103209330

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
<mapper namespace="com.example.mybaits.mapper.FindUserMapper">
    <select id="findUser" resultType="User">
        SELECT * FROM tbuser where userName='${username}'
    </select>
</mapper>

然后是services相关类

package com.example.mybaits.service;
 
import com.example.mybaits.entity.User;
 
import java.util.List;
 
public interface FindUserService {
    public List<User> findUser(String usrname);
}

package com.example.mybaits.service.impl;
 
import com.example.mybaits.entity.User;
import com.example.mybaits.mapper.FindUserMapper;
import com.example.mybaits.service.FindUserService;
import org.springframework.stereotype.Service;
 
import javax.annotation.Resource;
import java.util.List;
 
@Service
public class FindUserServiceImpl implements FindUserService {
    @Resource
    private FindUserMapper findUserMapper;
    @Override
    public List<User> findUser(String username) {
        return findUserMapper.findUser(username);
    }
}

　　controller类：

@RestController
public class UserController {
    @Autowired
    private UserService userService;

    @Autowired
    private FindUserService findUserService;
    @RequestMapping("/test")
    public List<User> allUser(){
        return userService.allUser();
    }

    @RequestMapping("/test2")
    public List<User> findUder(@RequestParam String username){
        return findUserService.findUser(username);
    }
}