关于数据过滤

ljdkzd

2016年你们派过来指导我们做BeX5开发的人让我们用js     this.comp("XXX").setFilter()   的方法过滤数据，这样会导致SQL注入，请问有什么办法解决？怎么处理数据权限最好？

jishuang

1.sql注入是前端传递sql语句查出才会有这个漏洞！平台用的是ksql是后台生成的是安全的！
而且调用平台的API处理sql的参数最终都是用?的方式setParameter，是防止sql注入的

2.如果是js中的，那就应该尽量避免在js中设置过滤条件，可以自己重写queryAction，把filter参数去掉，自己用一个参数接收自己个前端传递的参数，自己判断参数值在后端拼接不同的where条件


可以升级为3.8最新版本对SQL注入安全方面也做了进一步的处理

ljdkzd

"orderBy":"SLASTMODIFYTIME DESC,1-case when 1=1 then 1 else 1/0 end"

这是平台自带的调用的Action的方式，传后台的的报文里有：1-case when 1=1 then 1 else 1/0 end，请问这是什么东西？为什么会出现在报文里？

jishuang

报文是什么？

ljdkzd

POST /x5/UI2/v_20190801v003_nol_zh_CNs_desktopd_pc/system/service/common/bizAction.j?bsessionid=1F236782422DAAC378098CD7A6FC3575&process=/common/sys/process/task/taskProcess&activity=mainActivity HTTP/1.1
Host: weixin.jsptpd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Referer: https://weixin.jsd.com/x5/UI2/v_/portal/pc/index.w?device=pc
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Content-Length: 2921
Connection: close
Cookie: JSESSIONID=5F0C1C29BF35CAC89044CC4D8F8E3; request-use-base64=false; bsessionid=1F236782422DAA8098CD7A6FC3575

{"contentType":"json","accept":"application/json","process":"/common/sys/process/task/taskProcess","activity":"mainActivity","actionFlag":"__action_0__","executor":"","executeContext":"","action":"queryDefaultSubmitAction","parameters":{"variables":{},"filter":"((SA_SUBMIT.SCREATETIME >= stringToDate('2019-08-01')) AND (SA_SUBMIT.SCREATETIME < stringToDate('2019-09-01')))","offset":10,"limit":3,"columns":"SHINTS,EXECUTORNAMES,STYPENAME,SEMERGENCYNAME,SKINDID,SEXPECTSTARTTIME,SEURL,SSTATUSID,SCREATORPERSONNAME,SREMARK,SA_SUBMIT,SEXECUTEMODE2,SVARIABLE,SWITHDRAW,FLOWSTATUSID,FLOWLASTMODIFYTIME,SLIMITTIME,SCREATOROGNNAME,SEXECUTOROGNID,SLASTMODIFYTIME,SDISTRIBUTETIME,SEXECUTORPOSID,SCONTENT,SPROJECTNAME,SSOURCEID,SAIID,SDATA4,SACTIVITYNAMES,SDATA3,SACTUALFINISHTIME,SDATA2,SDATA1,SRESPONSIBLE,SCREATORFID,SPROCESSNAME,SID,SACTUALSTARTTIME,SCREATORPOSNAME,SFLOWID,SCREATORDEPTID,FLOWTYPENAME,SREMINDMODE,SSUMMARY,SACTIVITY,SAIACTIVE,SPLANNAME,SAISTATUSID,SPROCESS,SLOCK,SCATALOGID,SCURL,SFRONTID,SEXECUTEMODE,SEXECUTORFNAME,SEXECUTORDEPTNAME,SSEQUENCE,SEXECUTORPERSONNAME,SACTIVITYNAME,SCREATORPERSONID,SEXPECTFINISHTIME,SEXECUTORPERSONID,SWARNINGTIME,SCREATORFNAME,SCREATORPOSID,SCREATORDEPTNAME,SCUSTOMERID,FLOWCREATORPERSONNAME,SPREEMPTMODE,SEXECUTORFID,SEXECUTORPOSNAME,SPLANID,SIMPORTANCEID,SCREATOROGNID,SIMPORTANCENAME,SCREATETIME,SEXECUTORNAMES,SNAME,STYPEID,SEMERGENCYID,SPROJECTID,SCODE,SAISTATUSNAME,SSHORTCUT,SCUSTOMERNAME,SSTATUSNAME,SEXECUTETIME,VERSION,FLOWSTATUSNAME,SEXECUTORDEPTID,SEXECUTOROGNNAME,SACTIVE","orderBy":"SLASTMODIFYTIME DESC,1-case when 1=1 then 1 else 1/0 end"},"translateParameter":{"dataType":"row-list","transformIdcolumn":true,"includeState":true,"useNamespace":true,"cellnameByRelation":false,"rowsConfig":{"concept":"SA_SUBMIT","sequence":"SHINTS,EXECUTORNAMES,STYPENAME,SEMERGENCYNAME,SKINDID,SEXPECTSTARTTIME,SEURL,SSTATUSID,SCREATORPERSONNAME,SREMARK,SA_SUBMIT,SEXECUTEMODE2,SVARIABLE,SWITHDRAW,FLOWSTATUSID,FLOWLASTMODIFYTIME,SLIMITTIME,SCREATOROGNNAME,SEXECUTOROGNID,SLASTMODIFYTIME,SDISTRIBUTETIME,SEXECUTORPOSID,SCONTENT,SPROJECTNAME,SSOURCEID,SAIID,SDATA4,SACTIVITYNAMES,SDATA3,SACTUALFINISHTIME,SDATA2,SDATA1,SRESPONSIBLE,SCREATORFID,SPROCESSNAME,SID,SACTUALSTARTTIME,SCREATORPOSNAME,SFLOWID,SCREATORDEPTID,FLOWTYPENAME,SREMINDMODE,SSUMMARY,SACTIVITY,SAIACTIVE,SPLANNAME,SAISTATUSID,SPROCESS,SLOCK,SCATALOGID,SCURL,SFRONTID,SEXECUTEMODE,SEXECUTORFNAME,SEXECUTORDEPTNAME,SSEQUENCE,SEXECUTORPERSONNAME,SACTIVITYNAME,SCREATORPERSONID,SEXPECTFINISHTIME,SEXECUTORPERSONID,SWARNINGTIME,SCREATORFNAME,SCREATORPOSID,SCREATORDEPTNAME,SCUSTOMERID,FLOWCREATORPERSONNAME,SPREEMPTMODE,SEXECUTORFID,SEXECUTORPOSNAME,SPLANID,SIMPORTANCEID,SCREATOROGNID,SIMPORTANCENAME,SCREATETIME,SEXECUTORNAMES,SNAME,STYPEID,SEMERGENCYID,SPROJECTID,SCODE,SAISTATUSNAME,SSHORTCUT,SCUSTOMERNAME,SSTATUSNAME,SEXECUTETIME,VERSION,FLOWSTATUSNAME,SEXECUTORDEPTID,fRemainTime,SEXECUTOROGNNAME,SACTIVE"}}}

jishuang

看queryAction的order by怎么设置的

ljdkzd

jishuang 发表于 2019-8-23 14:48
看queryAction的order by怎么设置的

过滤条件如图片所示

jishuang

runtime\UIServer\WEB-INF\justep.xml中的<request-use-base64>false</request-use-base64> 设置为
<request-use-base64>true</request-use-base64> 然后重启tomcat

ljdkzd

jishuang 发表于 2019-8-23 16:09
runtime%uIServer\WEB-INF\justep.xml中的false 设置为
true 然后重启tomcat

那个加在ORDER BY 后面是做什么用的？

jishuang

这个不是平台添加的