sql injection security problems(sql 注入)

Hello, I hava found that there two sql injetions in your program, So I create this issue to help you improve the security of program

first place: http://demo.j2eefast.com/fast/sys/role/list and the parameter is deptId
second place http://demo.j2eefast.com/fast/sys/role/authUser/list and the parameter is roleId

## 1.how I found this vulnerability？
in the mapper file: src/main/resources/mapper/sys/SysUserMapper.xml you use  **${}**  join the sql statements.

![${} in the sql statements](https://images.gitee.com/uploads/images/2021/0316/202004_6b55d659_7842133.png "屏幕截图.png")

**'${compId}'** is may be vulnerable to sql injection. And then I look into the file src/main/java/com/j2eefast/framework/sys/service/SysUserService.java and found that you use String to make it a string type. this leads to the sql injection. 
![compId is a String type](https://images.gitee.com/uploads/images/2021/0316/202242_39c903b5_7842133.png "屏幕截图.png")

## 2.how to reproduce?

1. login with username 00008 and request people management function the request and response is:
![输入图片说明](https://images.gitee.com/uploads/images/2021/0316/203104_44690811_7842133.png "屏幕截图.png")

the parameter compId is vulnerable to sql injection. use these sql statements I can get the databse info, when the case is true, the server will response the info while the false case will be null.

1. 判断database name's length is 6;
1'+or+length(database())=6+and+'1'='1

![输入图片说明](https://images.gitee.com/uploads/images/2021/0316/203715_59f4a599_7842133.png "屏幕截图.png")

2. the first letter of database name is f

![输入图片说明](https://images.gitee.com/uploads/images/2021/0316/204031_c1a18c42_7842133.png "屏幕截图.png")

3. when the case is false, the info will be null.
![输入图片说明](https://images.gitee.com/uploads/images/2021/0316/204120_bd4436dd_7842133.png "屏幕截图.png")

4. finally I found that the database name is fastdb.
## 3.how to repair?

1. use #{} but ${}
2. use type cast make compId a int type.

## 4.error info

![输入图片说明](https://images.gitee.com/uploads/images/2021/0316/204602_b83273e6_7842133.png "屏幕截图.png")

dromara/J2eeFAST

内容风险标识

评论 (1)

dromara/J2eeFAST .gitee-modal { width: 500px !important; }

内容风险标识