添加4.1版本的sql防注入代码

admin/src/main/java/org/springblade/core/mp/support/SqlKeyword.java

@@ -45,33 +45,90 @@ public class SqlKeyword {
 	/**
 	 * 常规sql字符匹配关键词
 	 */
-	private final static String SQL_REGEX = "(?i)(?<![a-z])('|%|--|insert|delete|select|sleep|count|updatexml|group|union|drop|truncate|alter|grant|execute|exec|xp_cmdshell|call|declare|sql)(?![a-z])";
-
+	private final static String SQL_REGEX = "(?i)(?<![a-z])('|%|--|insert|delete|select|sleep|count|update|updatexml|group|union|drop|truncate|alter|grant|execute|exec|xp_cmdshell|call|declare|sql)(?![a-z])";
 	/**
 	 * 二次匹配防止双写等注入手段
 	 */
-	private final static Pattern PATTERN = Pattern.compile("(?:--|[\"';%]|\\binsert\\b|\\bdelete\\b|\\bselect\\b|\\bcount\\b|\\bupdatexml\\b|\\bsleep\\b|group\\s+by|\\bunion\\b|\\bdrop\\b|\\btruncate\\b|\\balter\\b|\\bgrant\\b|\\bexecute\\b|\\bxp_cmdshell\\b|\\bcall\\b|\\bdeclare\\b|\\bsql\\b)");
+	private final static Pattern PATTERN = Pattern.compile("(?:--|[\"';%]|\\binsert\\b|\\bdelete\\b|\\bselect\\b|\\bcount\\b|\\bupdate\\b|\\bupdatexml\\b|\\bsleep\\b|group\\s+by|\\bunion\\b|\\bdrop\\b|\\btruncate\\b|\\balter\\b|\\bgrant\\b|\\bexecute\\b|\\bxp_cmdshell\\b|\\bcall\\b|\\bdeclare\\b|\\bsql\\b)");
 	/**
 	 * sql注入警告语
 	 */
 	private final static String SQL_INJECTION_MESSAGE = "SQL keyword injection prevention processing!";
+	/**
+	 * sql关键字为空
+	 */
+	private final static String SQL_EMPTY_MESSAGE = "SQL keyword is empty!";
+	/**
+	 * 等于
+	 */
 	private static final String EQUAL = "_equal";
+	/**
+	 * 不等于
+	 */
 	private static final String NOT_EQUAL = "_notequal";
+	/**
+	 * 模糊
+	 */
 	private static final String LIKE = "_like";
+	/**
+	 * 左模糊
+	 */
 	private static final String LIKE_LEFT = "_likeleft";
+	/**
+	 * 右模糊
+	 */
 	private static final String LIKE_RIGHT = "_likeright";
+	/**
+	 * 不包含
+	 */
 	private static final String NOT_LIKE = "_notlike";
+	/**
+	 * 大于等于
+	 */
 	private static final String GE = "_ge";
+	/**
+	 * 小于等于
+	 */
 	private static final String LE = "_le";
+	/**
+	 * 大于
+	 */
 	private static final String GT = "_gt";
+	/**
+	 * 小于
+	 */
 	private static final String LT = "_lt";
+	/**
+	 * 日期大于等于
+	 */
 	private static final String DATE_GE = "_datege";
+	/**
+	 * 日期大于
+	 */
 	private static final String DATE_GT = "_dategt";
+	/**
+	 * 日期等于
+	 */
 	private static final String DATE_EQUAL = "_dateequal";
+	/**
+	 * 日期小于
+	 */
 	private static final String DATE_LT = "_datelt";
+	/**
+	 * 日期小于等于
+	 */
 	private static final String DATE_LE = "_datele";
+	/**
+	 * 为空
+	 */
 	private static final String IS_NULL = "_null";
+	/**
+	 * 不为空
+	 */
 	private static final String NOT_NULL = "_notnull";
+	/**
+	 * 忽略
+	 */
 	private static final String IGNORE = "_ignore";
 
 	/**
@@ -133,7 +190,7 @@ public class SqlKeyword {
 	 *
 	 * @param column  字段名
 	 * @param keyword 关键字
-	 * @return
+	 * @return string
 	 */
 	private static String getColumn(String column, String keyword) {
 		return StringUtil.humpToUnderline(StringUtil.removeSuffix(column, keyword));
@@ -147,11 +204,13 @@ public class SqlKeyword {
 	 */
 	@SneakyThrows(SQLException.class)
 	public static String filter(String param) {
-		if (param == null) {
-			return null;
+		// 清除特殊字符
+		String cleaned = StringUtil.cleanIdentifier(param);
+		if (cleaned == null) {
+			throw new SQLException(SQL_EMPTY_MESSAGE);
 		}
 		// 将校验到的sql关键词替换为空字符串
-		String sql = param.replaceAll(SQL_REGEX, StringPool.EMPTY);
+		String sql = cleaned.replaceAll(SQL_REGEX, StringPool.EMPTY);
 		// 二次校验，避免双写绕过等情况出现
 		if (match(sql)) {
 			throw new SQLException(SQL_INJECTION_MESSAGE);