| commit | author | age | ||
| 9bcb19 | 1 | /* |
| I | 2 | Copyright [2020] [https://www.xiaonuo.vip] |
| 3 | ||
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); | |
| 5 | you may not use this file except in compliance with the License. | |
| 6 | You may obtain a copy of the License at | |
| 7 | ||
| 8 | http://www.apache.org/licenses/LICENSE-2.0 | |
| 9 | ||
| 10 | Unless required by applicable law or agreed to in writing, software | |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, | |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 13 | See the License for the specific language governing permissions and | |
| 14 | limitations under the License. | |
| 15 | ||
| 16 | Snowy采用APACHE LICENSE 2.0开源协议，您在使用过程中，需要注意以下几点： | |
| 17 | ||
| 18 | 1.请不要删除和修改根目录下的LICENSE文件。 | |
| 19 | 2.请不要删除和修改Snowy源码头部的版权声明。 | |
| 20 | 3.请保留源码和相关描述文件的项目出处，作者声明等。 | |
| 21 | 4.分发源码时候，请注明软件出处 https://gitee.com/xiaonuobase/snowy | |
| 22 | 5.在修改包名，模块名称，项目代码等时，请注明软件出处 https://gitee.com/xiaonuobase/snowy | |
| 23 | 6.若您的项目无法满足以上几点，可申请商业授权，获取Snowy商业授权许可，请在官网购买授权，地址为 https://www.xiaonuo.vip | |
| 24 | */ | |
| 25 | package vip.xiaonuo.sys.core.mybatis.sqlfilter; | |
| 26 | ||
| 27 | import com.baomidou.mybatisplus.core.toolkit.PluginUtils; | |
| 28 | import org.apache.ibatis.executor.statement.StatementHandler; | |
| 29 | import org.apache.ibatis.mapping.MappedStatement; | |
| 30 | import org.apache.ibatis.mapping.SqlCommandType; | |
| 31 | import org.apache.ibatis.plugin.Interceptor; | |
| 32 | import org.apache.ibatis.plugin.Intercepts; | |
| 33 | import org.apache.ibatis.plugin.Invocation; | |
| 34 | import org.apache.ibatis.plugin.Signature; | |
| 35 | import org.apache.ibatis.reflection.MetaObject; | |
| 36 | import org.apache.ibatis.reflection.SystemMetaObject; | |
| 37 | import org.springframework.util.AntPathMatcher; | |
| 38 | import vip.xiaonuo.core.consts.SpringSecurityConstant; | |
| 39 | import vip.xiaonuo.core.context.constant.ConstantContextHolder; | |
| 40 | import vip.xiaonuo.core.exception.DemoException; | |
| 41 | import vip.xiaonuo.core.util.HttpServletUtil; | |
| 42 | ||
| 43 | import java.sql.Connection; | |
| 44 | ||
| 45 | /** | |
| 46 | * 演示环境的sql过滤器，只放开select语句，其他语句都不放过 | |
| 47 | * | |
| 48 | * @author yubaoshan | |
| 49 | * @date 2020/5/5 12:21 | |
| 50 | */ | |
| 51 | @Intercepts({@Signature(type = StatementHandler.class, method = "prepare", args = {Connection.class, Integer.class})}) | |
| 52 | public class DemoProfileSqlInterceptor implements Interceptor { | |
| 53 | ||
| 54 | @Override | |
| 55 | public Object intercept(Invocation invocation) throws Throwable { | |
| 56 | ||
| 57 | // 演示环境没开，直接跳过此过滤器 | |
| 58 | if (!ConstantContextHolder.getDemoEnvFlag()) { | |
| 59 | return invocation.proceed(); | |
| 60 | } | |
| 61 | ||
| 62 | StatementHandler statementHandler = PluginUtils.realTarget(invocation.getTarget()); | |
| 63 | MetaObject metaStatementHandler = SystemMetaObject.forObject(statementHandler); | |
| 64 | MappedStatement mappedStatement = (MappedStatement) metaStatementHandler.getValue("delegate.mappedStatement"); | |
| 65 | ||
| 66 | if (SqlCommandType.SELECT.equals(mappedStatement.getSqlCommandType())) { | |
| 67 | return invocation.proceed(); | |
| 68 | } else { | |
| 69 | ||
| 70 | //放开不进行安全过滤的接口 | |
| 71 | for (String notAuthResource : SpringSecurityConstant.NONE_SECURITY_URL_PATTERNS) { | |
| 72 | AntPathMatcher antPathMatcher = new AntPathMatcher(); | |
| 73 | if (antPathMatcher.match(notAuthResource, HttpServletUtil.getRequest().getRequestURI())) { | |
| 74 | return invocation.proceed(); | |
| 75 | } | |
| 76 | } | |
| 77 | throw new DemoException(); | |
| 78 | } | |
| 79 | } | |
| 80 | ||
| 81 | } | |
