Skip to content

Commit fe65470

Browse files
TommyLemonTommyLemon
committed
SQL 函数白名单新增 length；key$ 模糊搜索不允许连续的 %；AbstractSQLExecutor 新增 getKey 方法；新增待实现关键词 @null；删除 Structure.java, Operation 中 NECESSARY, DISALLOW 等已废弃的部分代码
1 parent 786d326 commit fe65470

File tree

6 files changed

+25
-292
lines changed

6 files changed

+25
-292
lines changed

‎APIJSONORM/src/main/java/apijson/JSONObject.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,7 @@ public JSONObject setUserIdIn(List<Object> list) {
133133
public static final String KEY_DROP = "@drop"; //丢弃，不返回，TODO 应该通过 fastjson 的 ignore 之类的机制来处理，避免导致下面的对象也不返回
134134
// public static final String KEY_KEEP = "@keep"; //一定会返回，为 null 或 空对象时，会使用默认值(非空)，解决其它对象因为不关联的第一个对为空导致也不返回
135135
public static final String KEY_DEFULT = "@default"; //TODO 自定义默认值 { "@default":true }，@default 可完全替代 @keep
136+
public static final String KEY_NULL = "@null"; //TODO 值为 null 的键值对 "@null":"tag,pictureList"，允许 is NULL 条件判断， SET tag = NULL 修改值为 NULL 等
136137

137138
public static final String KEY_ROLE = "@role"; //角色，拥有对某些数据的某些操作的权限
138139
public static final String KEY_DATABASE = "@database"; //数据库类型，默认为MySQL

‎APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ public abstract class AbstractSQLConfig implements SQLConfig {
143143
SQL_FUNCTION_MAP.put("locate", ""); // LOCATE(s1, s) 从字符串 s 中获取 s1 的开始位置
144144
SQL_FUNCTION_MAP.put("lcase", ""); // LCASE(s) 将字符串 s 的所有字母变成小写字母
145145
SQL_FUNCTION_MAP.put("left", ""); // LEFT(s, n) 返回字符串 s 的前 n 个字符
146+
SQL_FUNCTION_MAP.put("length", ""); // LENGTH(s) 返回字符串 s 的字符数
146147
SQL_FUNCTION_MAP.put("lower", ""); // LOWER(s) 将字符串 s 的所有字母变成小写字母
147148
SQL_FUNCTION_MAP.put("lpad", ""); // LPAD(s1, len, s2) 在字符串 s1 的开始处填充字符串 s2，使字符串长度达到 len
148149
SQL_FUNCTION_MAP.put("ltrim", ""); // LTRIM(s) 去掉字符串 s 开始处的空格
@@ -1013,6 +1014,8 @@ public String getColumnString() throws Exception {
10131014
}
10141015
@JSONField(serialize = false)
10151016
public String getColumnString(boolean inSQLJoin) throws Exception {
1017+
List<String> column = getColumn();
1018+
10161019
switch (getMethod()) {
10171020
case HEAD:
10181021
case HEADS: //StringUtil.isEmpty(column, true) || column.contains(",") 时SQL.count(column)会return "*"
@@ -2011,10 +2014,15 @@ public String getSearchString(String key, Object[] values, int type) throws Ille
20112014

20122015
String condition = "";
20132016
for (int i = 0; i < values.length; i++) {
2014-
if (values[i] instanceof String == false) {
2015-
throw new IllegalArgumentException(key + "$:value 中value的类型只能为String或String[]！");
2017+
Object v = values[i];
2018+
if (v instanceof String == false) {
2019+
throw new IllegalArgumentException(key + "$:value 中 value 的类型只能为 String 或 String[]！");
2020+
}
2021+
if (((String) v).contains("%%")) {
2022+
throw new IllegalArgumentException(key + "$:value 中 value 值 " + v + " 中包含 %% ！不允许有连续的 % ！");
20162023
}
2017-
condition += (i <= 0 ? "" : (Logic.isAnd(type) ? AND : OR)) + getLikeString(key, values[i]);
2024+
2025+
condition += (i <= 0 ? "" : (Logic.isAnd(type) ? AND : OR)) + getLikeString(key, v);
20182026
}
20192027

20202028
return getCondition(Logic.isNot(type), condition);

‎APIJSONORM/src/main/java/apijson/orm/AbstractSQLExecutor.java‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,8 @@ public JSONObject execute(@NotNull SQLConfig config, boolean unknowType) throws
249249

250250

251251
// final boolean cache = config.getCount() != 1;
252-
resultList = new ArrayList<>();
252+
// TODO 设置初始容量为查到的数据量，解决频繁扩容导致的延迟，貌似只有 rs.last 取 rs.getRow() ? 然后又得 rs.beforeFirst 重置位置以便下方取值
253+
resultList = new ArrayList<>(config.getCount() <= 0 ? Parser.MAX_QUERY_COUNT : config.getCount());
253254
// Log.d(TAG, "select cache = " + cache + "; resultList" + (resultList == null ? "=" : "!=") + "null");
254255

255256
int index = -1;
@@ -504,7 +505,7 @@ protected JSONObject onPutColumn(@NotNull SQLConfig config, @NotNull ResultSet r
504505
//已改为 rsmd.getTableName(columnIndex) 支持副表不传 @column ， 但如何判断是副表？childMap != null
505506
// String lable = rsmd.getColumnLabel(columnIndex);
506507
// int dotIndex = lable.indexOf(".");
507-
String lable = rsmd.getColumnLabel(columnIndex);//dotIndex < 0 ? lable : lable.substring(dotIndex + 1);
508+
String lable = getKey(config, rs, rsmd, tablePosition, table, columnIndex, childMap);
508509

509510
String childTable = childMap == null ? null : rsmd.getTableName(columnIndex); //dotIndex < 0 ? null : lable.substring(0, dotIndex);
510511

@@ -567,6 +568,12 @@ protected List<JSONObject> onPutTable(@NotNull SQLConfig config, @NotNull Result
567568
return resultList;
568569
}
569570

571+
572+
573+
protected String getKey(@NotNull SQLConfig config, @NotNull ResultSet rs, @NotNull ResultSetMetaData rsmd
574+
, final int tablePosition, @NotNull JSONObject table, final int columnIndex, Map<String, JSONObject> childMap) throws Exception {
575+
return rsmd.getColumnLabel(columnIndex); // dotIndex < 0 ? lable : lable.substring(dotIndex + 1);
576+
}
570577

571578
protected Object getValue(@NotNull SQLConfig config, @NotNull ResultSet rs, @NotNull ResultSetMetaData rsmd
572579
, final int tablePosition, @NotNull JSONObject table, final int columnIndex, String lable, Map<String, JSONObject> childMap) throws Exception {

‎APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java‎

Lines changed: 1 addition & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,9 @@
1212
import static apijson.RequestMethod.HEADS;
1313
import static apijson.RequestMethod.POST;
1414
import static apijson.RequestMethod.PUT;
15-
import static apijson.orm.Operation.DISALLOW;
1615
import static apijson.orm.Operation.EXIST;
1716
import static apijson.orm.Operation.INSERT;
1817
import static apijson.orm.Operation.MUST;
19-
import static apijson.orm.Operation.NECESSARY;
2018
import static apijson.orm.Operation.REFUSE;
2119
import static apijson.orm.Operation.REMOVE;
2220
import static apijson.orm.Operation.REPLACE;
@@ -96,6 +94,7 @@ public abstract class AbstractVerifier<T> implements Verifier<T>, IdCallback {
9694
@NotNull
9795
public static final Map<String, SortedMap<Integer, JSONObject>> REQUEST_MAP;
9896

97+
// 正则匹配的别名快捷方式，例如用 "PHONE" 代替 "^((13[0-9])|(15[^4,\\D])|(18[0-2,5-9])|(17[0-9]))\\d{8}$"
9998
@NotNull
10099
public static final Map<String, Pattern> COMPILE_MAP;
101100
static {
@@ -110,8 +109,6 @@ public abstract class AbstractVerifier<T> implements Verifier<T>, IdCallback {
110109
OPERATION_KEY_LIST.add(REMOVE.name());
111110
OPERATION_KEY_LIST.add(MUST.name());
112111
OPERATION_KEY_LIST.add(REFUSE.name());
113-
OPERATION_KEY_LIST.add(NECESSARY.name());
114-
OPERATION_KEY_LIST.add(DISALLOW.name());
115112

116113

117114
SYSTEM_ACCESS_MAP = new HashMap<String, Map<RequestMethod, RequestRole[]>>();
@@ -776,8 +773,6 @@ public static JSONObject parse(@NotNull final RequestMethod method, String name,
776773
String remove = StringUtil.getNoBlankString(target.getString(REMOVE.name()));
777774
String must = StringUtil.getNoBlankString(target.getString(MUST.name()));
778775
String refuse = StringUtil.getNoBlankString(target.getString(REFUSE.name()));
779-
String necessary = StringUtil.getNoBlankString(target.getString(NECESSARY.name()));
780-
String disallow = StringUtil.getNoBlankString(target.getString(DISALLOW.name()));
781776

782777

783778
// 移除字段<<<<<<<<<<<<<<<<<<<
@@ -798,15 +793,6 @@ public static JSONObject parse(@NotNull final RequestMethod method, String name,
798793
+ " 里面不能缺少 " + s + " 等[" + must + "]内的任何字段！");
799794
}
800795
}
801-
802-
String[] necessarys = StringUtil.split(necessary);
803-
List<String> necessaryList = necessarys == null ? new ArrayList<String>() : Arrays.asList(necessarys);
804-
for (String s : necessaryList) {
805-
if (real.get(s) == null) {//可能传null进来，这里还会通过 real.containsKey(s) == false) {
806-
throw new IllegalArgumentException(method + "请求，" + name
807-
+ " 里面不能缺少 " + s + " 等[" + necessary + "]内的任何字段！");
808-
}
809-
}
810796
//判断必要字段是否都有>>>>>>>>>>>>>>>>>>>
811797

812798

@@ -879,21 +865,6 @@ public static JSONObject parse(@NotNull final RequestMethod method, String name,
879865
refuseList.addAll(Arrays.asList(refuses));
880866
}
881867
}
882-
883-
List<String> disallowList = new ArrayList<String>();
884-
if ("!".equals(disallow)) {//所有非necessary，改成 !necessary 更好
885-
for (String key : rkset) {//对@key放行，@role,@column,自定义@position等
886-
if (key != null && key.startsWith("@") == false
887-
&& necessaryList.contains(key) == false && objKeySet.contains(key) == false) {
888-
disallowList.add(key);
889-
}
890-
}
891-
} else {
892-
String[] disallows = StringUtil.split(disallow);
893-
if (disallows != null && disallows.length > 0) {
894-
disallowList.addAll(Arrays.asList(disallows));
895-
}
896-
}
897868
//解析不允许的字段>>>>>>>>>>>>>>>>>>>
898869

899870

@@ -903,10 +874,6 @@ public static JSONObject parse(@NotNull final RequestMethod method, String name,
903874
throw new IllegalArgumentException(method + "请求，" + name
904875
+ " 里面不允许传 " + rk + " 等" + StringUtil.getString(refuseList) + "内的任何字段！");
905876
}
906-
if (disallowList.contains(rk)) { //不允许的字段
907-
throw new IllegalArgumentException(method + "请求，" + name
908-
+ " 里面不允许传 " + rk + " 等" + StringUtil.getString(disallowList) + "内的任何字段！");
909-
}
910877

911878
if (rk == null) { //无效的key
912879
real.remove(rk);

‎APIJSONORM/src/main/java/apijson/orm/Operation.java‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
package apijson.orm;
77

8-
/**对请求JSON的操作
8+
/**对请求 JSON 的操作
99
* @author Lemon
1010
*/
1111
public enum Operation {
@@ -14,21 +14,12 @@ public enum Operation {
1414
* "key0,key1,key2..."
1515
*/
1616
MUST,
17-
/**
18-
* @deprecated 用 MUST 代替，最早可能 4.5.0 移除
19-
*/
20-
NECESSARY,
2117

2218
/**
2319
* 不允许传的字段，结构是
2420
* "key0,key1,key2..."
2521
*/
2622
REFUSE,
27-
/**
28-
* @deprecated 用 REFUSE 代替，最早可能 4.5.0 移除
29-
*/
30-
DISALLOW,
31-
3223

3324
/**TODO 是否应该把数组类型写成 BOOLEANS, NUMBERS 等复数单词，以便抽取 enum ？扩展用 VERIFY 或 INSERT/UPDATE 远程函数等
3425
* 验证是否符合预设的类型:
@@ -47,7 +38,7 @@ public enum Operation {
4738
* "id": "NUMBER", //id 类型必须为 NUMBER
4839
* "pictureList": "URL[]", //pictureList 类型必须为 URL[]
4940
* }
50-
* @see {@link Structure#type(String, String, Object, boolean)}
41+
* @see {@link AbstractVerifier#verifyType(String, String, Object, boolean)}
5142
*/
5243
TYPE,
5344

@@ -61,7 +52,7 @@ public enum Operation {
6152
* }
6253
* 例如
6354
* {
64-
* "phone~": "PHONE", //phone 必须满足 PHONE 的格式
55+
* "phone~": "PHONE", //phone 必须满足 PHONE 的格式，配置见 {@link AbstractVerifier#COMPILE_MAP}
6556
* "status{}": [1,2,3], //status 必须在给出的范围内
6657
* "balance&{}":">0,<=10000" //必须满足 balance>0 & balance<=10000
6758
* }

0 commit comments

Comments
 (0)