问题是这样的,现在需要做一个流程表单管理,新建表单的时候创建这个表单的数据表。 StringBuffer sql = new StringBuffer(); String TRGName = "TRG_"+formKey;//触发器名 sql.append("CREATE OR REPLACE TRIGGER "+TRGName+" "); sql.append("BEFORE INSERT ON "+formKey+" "); sql.append("FOR EACH ROW "); sql.append("BEGIN "); sql.append(" SELECT "+seqName+".NEXTVAL INTO:NEW."+PKName+" FROM DUAL; "); sql.append("END;"); return sql.toString(); 语句在plsql中运行是正常的。 java.sql.SQLException: sql injection violation, TODO TRIGGER TRIGGER : CREATE OR REPLACE TRIGGER TRG_leave BEFORE INSERT ON leave FOR EACH ROW BEGIN SELECT leave_ID.NEXTVAL INTO:NEW.ID FROM DUAL; END; at com.alibaba.druid.wall.WallFilter.check(WallFilter.java:617) at com.alibaba.druid.wall.WallFilter.statement_executeUpdate(WallFilter.java:482) at com.alibaba.druid.filter.FilterChainImpl.statement_executeUpdate(FilterChainImpl.java:2373) at com.alibaba.druid.filter.FilterAdapter.statement_executeUpdate(FilterAdapter.java:2486) at com.alibaba.druid.filter.FilterEventAdapter.statement_executeUpdate(FilterEventAdapter.java:327) at com.alibaba.druid.filter.FilterChainImpl.statement_executeUpdate(FilterChainImpl.java:2373) at com.alibaba.druid.proxy.jdbc.StatementProxyImpl.executeUpdate(StatementProxyImpl.java:225) at com.alibaba.druid.pool.DruidPooledStatement.executeUpdate(DruidPooledStatement.java:169) at com.qrsoft.jbpm.taskform.TaskForm.createTable(TaskForm.java:93) at com.qrsoft.jbpm.taskform.TaskForm.createTable(TaskForm.java:37) at com.qrsoft.jbpm.taskform.TaskFormController.createTable(TaskFormController.java:53) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at com.jfinal.core.ActionInvocation.invoke(ActionInvocation.java:55) at com.jfinal.ext.interceptor.SessionInViewInterceptor.intercept(SessionInViewInterceptor.java:44) at com.jfinal.core.ActionInvocation.invoke(ActionInvocation.java:51) at com.qrsoft.shiro.ShiroInterceptor.intercept(ShiroInterceptor.java:53) at com.jfinal.core.ActionInvocation.invoke(ActionInvocation.java:51) at com.jfinal.ext.plugin.shiro.ShiroInterceptor.intercept(ShiroInterceptor.java:52) at com.jfinal.core.ActionInvocation.invoke(ActionInvocation.java:51) at com.jfinal.core.ActionHandler.handle(ActionHandler.java:73) at com.jfinal.ext.handler.ContextPathHandler.handle(ContextPathHandler.java:47) at com.jfinal.plugin.druid.DruidStatViewHandler.handle(DruidStatViewHandler.java:58) at com.qrsoft.shiro.SessionHandler.handle(SessionHandler.java:14) at com.jfinal.ext.handler.FakeStaticHandler.handle(FakeStaticHandler.java:45) at com.qrsoft.jbase.jfinal.ext.xss.XssHandler.handle(XssHandler.java:35) at com.jfinal.core.JFinalFilter.doFilter(JFinalFilter.java:72) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1307) at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61) at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108) at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125) at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66) at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449) at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365) at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90) at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83) at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:383) at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362) at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1307) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:453) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137) at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:560) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1072) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:382) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1006) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116) at org.eclipse.jetty.server.Server.handle(Server.java:365) at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:485) at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:926) at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:988) at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:635) at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235) at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82) at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:628) at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608) at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543) at java.lang.Thread.run(Unknown Source) Caused by: com.alibaba.druid.sql.parser.ParserException: TODO TRIGGER TRIGGER at com.alibaba.druid.sql.parser.SQLStatementParser.parseCreate(SQLStatementParser.java:1193) at com.alibaba.druid.sql.dialect.oracle.parser.OracleStatementParser.parseStatementList(OracleStatementParser.java:176) at com.alibaba.druid.sql.parser.SQLStatementParser.parseStatementList(SQLStatementParser.java:106) at com.alibaba.druid.wall.WallProvider.checkInternal(WallProvider.java:613) at com.alibaba.druid.wall.WallProvider.check(WallProvider.java:572) at com.alibaba.druid.wall.WallFilter.check(WallFilter.java:605) ... 64 more 查了很多资料都没找到问题,所以请大家看看。。 |
|
好复杂 看不懂
|
|
40分 |
代码中做了防SQL注入的校验,你可以把代码放到oracle程序包里做。
|
我用的直接是 Connection 对象啊,这样也能被拦截?? |
|
你们的代码做了防SQL注入检查,只要是执行SQL,就会校验SQL是否安全,你说的Connection实例其实是经过封装的。
|