Mybatis批量更新运行异常,数据库 postgres(Sql在数据库中运行正常)在线等

2019-06-12 11:30:53 455 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

从SQL注入到系统提权：Oracle与PostgreSQL数据库攻防实战详解 SQL注入作为Web安全领域最经典的漏洞之一，其本质在于攻击者通过构造恶意输入，篡改后端数据库查询逻辑，从而绕过应用程序的预期行为。其原理在于应用程序未对用户输入进行充分的过滤和校验，将输入数据与SQL指令进行了拼接，导致数据库引擎错误地执行了攻击者注入的代码。这项技术的危害远不止数据泄露，它往往是攻击链的起点，为后续的权限提升（提权）打开大门。在实战中，攻击者利用数据库的特定功能（如文件读写、命令执行）结合系统配置弱点，可以实现从数据库层到操作系统层的横向移动与权限突破。本文聚焦于Oracle和Postg 阅读详情

Mapper配置:
<update id="cancelImport" parameterType="java.util.List">
update fm_attach_detail attach
<set>
remark = fromData.remark,
valid = fromData.valid,
modify_user = fromData.modifyUser::INTEGER
</set>
from (values
<foreach collection="list" item="item" index="index" open="" close="" separator=",">
<trim prefix="(" suffix=")">
#{item.id}, #{item.refId},#{item.remark},#{item.modifyUser},#{item.valid}
</trim>
</foreach>
) as fromData(id, refId, remark, modifyUser, valid)
<where>
attach.valid = '0' AND fromData.id::INTEGER = attach.id AND attach.ref_id= fromData.refId
</where>
</update>
部分异常信息:
org.springframework.jdbc.UncategorizedSQLException:
### Error updating database. Cause: java.sql.SQLException: sql injection violation, syntax error: error pos 235, line 3, column 98, token COMMA : update fm_attach_detail attach
SET remark = fromData.remark, valid = fromData.valid, modify_user = fromData.modifyUser::INTEGER
from (values ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) ) as fromData(id, refId, remark, modifyUser, valid)
WHERE attach.valid = '0' AND fromData.id::INTEGER = attach.id AND attach.ref_id= fromData.refId
### SQL: update fm_attach_detail attach SET remark = fromData.remark, valid = fromData.valid, modify_user = fromData.modifyUser::INTEGER from (values ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) ) as fromData(id, refId, remark, modifyUser, valid) WHERE attach.valid = '0' AND fromData.id::INTEGER = attach.id AND attach.ref_id= fromData.refId
### Cause: java.sql.SQLException: sql injection violation, syntax error: error pos 235, line 3, column 98, token COMMA : update fm_attach_detail attach
SET remark = fromData.remark, valid = fromData.valid, modify_user = fromData.modifyUser::INTEGER
from (values ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) ) as fromData(id, refId, remark, modifyUser, valid)
WHERE attach.valid = '0' AND fromData.id::INTEGER = attach.id AND attach.ref_id= fromData.refId
; uncategorized SQLException for SQL []; SQL state [null]; error code [0]; sql injection violation, syntax error: error pos 235, line 3, column 98, token COMMA : update fm_attach_detail attach
SET remark = fromData.remark, valid = fromData.valid, modify_user = fromData.modifyUser::INTEGER
from (values ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) ) as fromData(id, refId, remark, modifyUser, valid)
WHERE attach.valid = '0' AND fromData.id::INTEGER = attach.id AND attach.ref_id= fromData.refId; nested exception is java.sql.SQLException: sql injection violation, syntax error: error pos 235, line 3, column 98, token COMMA : update fm_attach_detail attach
SET remark = fromData.remark, valid = fromData.valid, modify_user = fromData.modifyUser::INTEGER
from (values ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) , ( ?, ?,?,?,? ) ) as fromData(id, refId, remark, modifyUser, valid)
WHERE attach.valid = '0' AND fromData.id::INTEGER = attach.id AND attach.ref_id= fromData.refId
at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:90)
at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:82)
at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:82)
at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:73)
at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:446)
at com.sun.proxy.$Proxy99.update(Unknown Source)
at org.mybatis.spring.SqlSessionTemplate.update(SqlSessionTemplate.java:294)
at org.apache.ibatis.binding.MapperMethod.execute(MapperMethod.java:62)
at org.apache.ibatis.binding.MapperProxy.invoke(MapperProxy.java:59)
at com.sun.proxy.$Proxy111.cancelImport(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:136)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213)
at com.sun.proxy.$Proxy112.cancelImport(Unknown Source)
at com.tuns.ins.business.fm.impl.AttachDetailServiceImpl.batchUpdateData(AttachDetailServiceImpl.java:103)
at com.tuns.ins.business.fm.impl.AttachDetailServiceImpl$$FastClassBySpringCGLIB$$f4ee1105.invoke(<generated>)
at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:669)
at com.tuns.ins.business.fm.impl.AttachDetailServiceImpl$$EnhancerBySpringCGLIB$$ec0bee9c.batchUpdateData(<generated>)
at com.tuns.ins.webgate.fm.ReceiveWebgate.cancelKnotBackImport(ReceiveWebgate.java:125)
at com.tuns.ins.webgate.fm.ReceiveWebgate$$FastClassBySpringCGLIB$$29183179.invoke(<generated>)
at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
at org.springframework.aop.framework.adapter.MethodBeforeAdviceInterceptor.invoke(MethodBeforeAdviceInterceptor.java:52)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673)
at com.tuns.ins.webgate.fm.ReceiveWebgate$$EnhancerBySpringCGLIB$$4a7f085e.cancelKnotBackImport(<generated>)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.boot.web.filter.ApplicationContextHeaderFilter.doFilterInternal(ApplicationContextHeaderFilter.java:55)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:96)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at com.alibaba.druid.support.http.WebStatFilter.doFilter(WebStatFilter.java:123)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.

...全文