安全通告

// SortParameterSecurityFilter.java
package com.example.security;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;
import java.util.Arrays;
import java.util.regex.Pattern;

/**
 * 排序参数 SQL 注入临时防护过滤器（对应 GHSA-g8qc-r85v-gqpp）
 */
public class SortParameterSecurityFilter extends OncePerRequestFilter {

    /** CRUD 套件排序参数名（如有自定义请同步调整） */
    private static final String SORT_PARAMETER_NAME = "sort";

    /** 合法排序字段：仅允许字母、数字、下划线，可携带表别名（如 u.create_time） */
    private static final Pattern PROPERTY_PATTERN = Pattern
        .compile("[a-zA-Z0-9_]+(\\.[a-zA-Z0-9_]+)*");

    /** 合法排序方向 */
    private static final Pattern DIRECTION_PATTERN = Pattern.compile("(?i:asc|desc)");

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
        String[] values = request.getParameterValues(SORT_PARAMETER_NAME);
        if (values != null) {
            for (String value : values) {
                if (!isValid(value)) {
                    response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
                    response.setContentType("application/json;charset=UTF-8");
                    response.getWriter().write("{\"code\":400,\"msg\":\"无效的排序参数\"}");
                    return;
                }
            }
        }
        filterChain.doFilter(request, response);
    }

    /** 校验单个排序参数值，例如：name,desc / u.create_time,asc / id */
    private boolean isValid(String value) {
        if (value == null || value.isBlank()) {
            return true;
        }
        return Arrays.stream(value.split(","))
            .allMatch(segment -> PROPERTY_PATTERN.matcher(segment).matches()
                || DIRECTION_PATTERN.matcher(segment).matches());
    }
}

// SortSecurityFilterConfiguration.java
package com.example.security;

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;

@Configuration
public class SortSecurityFilterConfiguration {

    @Bean
    public FilterRegistrationBean<SortParameterSecurityFilter> sortParameterSecurityFilter() {
        FilterRegistrationBean<SortParameterSecurityFilter> registration = new FilterRegistrationBean<>(
            new SortParameterSecurityFilter());
        registration.addUrlPatterns("/*");
        // 尽早执行，在业务处理前完成校验
        registration.setOrder(Ordered.HIGHEST_PRECEDENCE + 100);
        return registration;
    }
}