Skip to content

Commit 2ce6262

Browse files
TommyLemonTommyLemon
committed
Server:优化写安全及便利：解决服务端Request表中配置的额外Table(通过add,put等)在不加别名时也会被禁止；解决客户端可通过Table:alias绕过禁止Table校验；解决客户端不传必要的Table也能操作
1 parent d821577 commit 2ce6262

1 file changed

Lines changed: 35 additions & 18 deletions

File tree

  • APIJSON(Server)/APIJSON(Eclipse_JEE)/src/main/java/zuo/biao/apijson/server

‎APIJSON(Server)/APIJSON(Eclipse_JEE)/src/main/java/zuo/biao/apijson/server/Structure.java‎

Lines changed: 35 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import java.util.ArrayList;
2020
import java.util.Arrays;
21+
import java.util.HashSet;
2122
import java.util.LinkedHashSet;
2223
import java.util.List;
2324
import java.util.Map.Entry;
@@ -120,15 +121,17 @@ public static JSONObject parseRequest(final RequestMethod method, final String n
120121
}
121122

122123

123-
124-
125124
//解析
126125
return parse(name, target, request, new OnParseCallback() {
127126

128127
@Override
129128
public JSONObject onParseJSONObject(String key, JSONObject tobj, JSONObject robj) throws Exception {
130129
// Log.i(TAG, "parseRequest.parse.onParseJSONObject key = " + key + "; robj = " + robj);
131-
if (robj != null && Parser.isTableKey(key)) {
130+
if (robj == null) {
131+
if (tobj != null) {//不允许不传Target中指定的Table
132+
throw new IllegalArgumentException("请设置 " + key + " ！");
133+
}
134+
} else if (Parser.isTableKey(key)) {
132135
if (method == POST) {
133136
if (robj.containsKey(QueryConfig.ID)) {
134137
throw new IllegalArgumentException("POST " + key + " 请求不能设置" + QueryConfig.ID + "！");
@@ -217,12 +220,13 @@ public static JSONObject parse(String name, JSONObject target, JSONObject real
217220
//获取配置>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
218221

219222

223+
Set<String> tableKeySet = new HashSet<String>();
220224

221225

222-
real = operate(TYPE_VERIFY, verify, real);
223-
real = operate(TYPE_ADD, add, real);
224-
real = operate(TYPE_PUT, put, real);
225-
real = operate(TYPE_REPLACE, replace, real);
226+
real = operate(TYPE_VERIFY, verify, real, tableKeySet);
227+
real = operate(TYPE_ADD, add, real, tableKeySet);
228+
real = operate(TYPE_PUT, put, real, tableKeySet);
229+
real = operate(TYPE_REPLACE, replace, real, tableKeySet);
226230

227231

228232
//移除字段<<<<<<<<<<<<<<<<<<<
@@ -274,11 +278,10 @@ public static JSONObject parse(String name, JSONObject target, JSONObject real
274278

275279

276280

277-
List<String> tableKeyList = new ArrayList<String>();
278281
Set<Entry<String, Object>> set = new LinkedHashSet<>(target.entrySet());
282+
zuo.biao.apijson.server.Entry<String, String> pair;
279283
if (set.isEmpty() == false) {
280284

281-
zuo.biao.apijson.server.Entry<String, String> pair;
282285
String key;
283286
Object tvalue;
284287
Object rvalue;
@@ -298,7 +301,7 @@ public static JSONObject parse(String name, JSONObject target, JSONObject real
298301

299302
pair = Pair.parseEntry(key, true);
300303
if (pair != null && Parser.isTableKey(pair.getKey())) {
301-
tableKeyList.add(key);
304+
tableKeySet.add(key);
302305
}
303306
} else if (tvalue instanceof JSONArray) {//JSONArray
304307
tvalue = callback.onParseJSONArray(key, (JSONArray) tvalue, (JSONArray) rvalue);
@@ -317,7 +320,8 @@ public static JSONObject parse(String name, JSONObject target, JSONObject real
317320

318321
//不允许操作未指定Table<<<<<<<<<<<<<<<<<<<<<<<<<
319322
for (String rk : rkset) {
320-
if (Parser.isTableKey(rk) && tableKeyList.contains(rk) == false) {
323+
pair = Pair.parseEntry(rk, true);//非GET类操作不允许Table:alias别名
324+
if (pair != null && Parser.isTableKey(pair.getKey()) && tableKeySet.contains(rk) == false) {
321325
throw new UnsupportedOperationException("不允许操作 " + rk + " ！");
322326
}
323327
}
@@ -334,10 +338,12 @@ public static JSONObject parse(String name, JSONObject target, JSONObject real
334338
* @param operate
335339
* @param targetChild
336340
* @param real
341+
* @param tableKeySet
337342
* @return
338343
* @throws Exception
339344
*/
340-
private static JSONObject operate(int type, JSONObject targetChild, JSONObject real) throws Exception {
345+
private static JSONObject operate(int type, JSONObject targetChild, JSONObject real
346+
, Set<String> tableKeySet) throws Exception {
341347
if (targetChild == null) {
342348
return real;
343349
}
@@ -349,10 +355,6 @@ private static JSONObject operate(int type, JSONObject targetChild, JSONObject r
349355
return real;
350356
}
351357

352-
if (type == TYPE_PUT) {
353-
real.putAll(targetChild);
354-
return real;
355-
}
356358

357359
Set<Entry<String, Object>> set = new LinkedHashSet<>(targetChild.entrySet());
358360
String tk;
@@ -432,14 +434,16 @@ private static JSONObject operate(int type, JSONObject targetChild, JSONObject r
432434

433435
}
434436

437+
} else if (type == TYPE_PUT) {
438+
putTargetChild(real, tk, tv, tableKeySet);
435439
} else {
436440
if (real.containsKey(tk)) {
437441
if (type == TYPE_REPLACE) {
438-
real.put(tk, tv);
442+
putTargetChild(real, tk, tv, tableKeySet);
439443
}
440444
} else {
441445
if (type == TYPE_ADD) {
442-
real.put(tk, tv);
446+
putTargetChild(real, tk, tv, tableKeySet);
443447
}
444448
}
445449
}
@@ -449,6 +453,19 @@ private static JSONObject operate(int type, JSONObject targetChild, JSONObject r
449453
}
450454

451455

456+
/**
457+
* @param real
458+
* @param tk
459+
* @param tv
460+
* @param tableKeySet
461+
*/
462+
private static void putTargetChild(JSONObject real, String tk, Object tv, Set<String> tableKeySet) {
463+
real.put(tk, tv);
464+
zuo.biao.apijson.server.Entry<String, String> pair = Pair.parseEntry(tk, true);
465+
if (pair != null && Parser.isTableKey(pair.getKey())) {
466+
tableKeySet.add(tk);
467+
}
468+
}
452469

453470

454471
public static final int TYPE_DEFAULT = 0;

0 commit comments

Comments
 (0)