|
|
@ -1,7 +1,5 @@
|
|
|
package com.yihu.jw.gateway.filter;
|
|
|
|
|
|
import com.alibaba.fastjson.JSON;
|
|
|
import com.alibaba.fastjson.JSONObject;
|
|
|
import com.fasterxml.jackson.databind.ObjectMapper;
|
|
|
import com.netflix.zuul.ZuulFilter;
|
|
|
import com.netflix.zuul.context.RequestContext;
|
|
|
@ -30,7 +28,6 @@ import org.springframework.web.multipart.commons.CommonsMultipartResolver;
|
|
|
|
|
|
import javax.servlet.http.HttpServletRequest;
|
|
|
import java.io.IOException;
|
|
|
import java.util.Arrays;
|
|
|
import java.util.Enumeration;
|
|
|
import java.util.Iterator;
|
|
|
|
|
|
@ -268,8 +265,7 @@ public class BasicZuulFilter extends ZuulFilter {
|
|
|
String badStr = "and |exec |execute |insert |select |delete |update |drop |chr |mid |master |truncate |" +
|
|
|
"declare | sitename |net user|xp_cmdshell|or |exec |execute |create |" +
|
|
|
"table |from |grant |use |group_concat|column_name|" +
|
|
|
"information_schema.columns|table_schema|union |where |select |update |order |by |like |" +
|
|
|
"--|%";//过滤掉的sql关键字，可以手动添加
|
|
|
"information_schema.columns|table_schema|union |where |select |update |order |by |like |" ;//过滤掉的sql关键字，可以手动添加
|
|
|
String[] badStrs = badStr.split("\\|");
|
|
|
for (int i = 0; i < badStrs.length; i++) {
|
|
|
if (str.indexOf(badStrs[i]) >= 0) {
|
wangzhinan