Skip to content

Commit cc94639

Browse files
JoyChou93JoyChou93
committed
add mybatis sql
1 parent f24df6f commit cc94639

File tree

8 files changed

+214
-22
lines changed

8 files changed

+214
-22
lines changed

‎java-sec-code.iml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,5 +171,14 @@
171171
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-security:2.1.5.RELEASE" level="project" />
172172
<orderEntry type="library" name="Maven: commons-net:commons-net:3.6" level="project" />
173173
<orderEntry type="library" name="Maven: commons-httpclient:commons-httpclient:3.1" level="project" />
174+
<orderEntry type="library" name="Maven: org.mybatis.spring.boot:mybatis-spring-boot-starter:1.3.2" level="project" />
175+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-jdbc:1.5.1.RELEASE" level="project" />
176+
<orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-jdbc:8.5.11" level="project" />
177+
<orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-juli:8.5.11" level="project" />
178+
<orderEntry type="library" name="Maven: org.springframework:spring-jdbc:4.3.6.RELEASE" level="project" />
179+
<orderEntry type="library" name="Maven: org.springframework:spring-tx:4.3.6.RELEASE" level="project" />
180+
<orderEntry type="library" name="Maven: org.mybatis.spring.boot:mybatis-spring-boot-autoconfigure:1.3.2" level="project" />
181+
<orderEntry type="library" name="Maven: org.mybatis:mybatis:3.4.6" level="project" />
182+
<orderEntry type="library" name="Maven: org.mybatis:mybatis-spring:1.3.2" level="project" />
174183
</component>
175184
</module>

‎pom.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,14 @@
169169
<version>3.1</version>
170170
</dependency>
171171

172+
173+
<!-- mybatis -->
174+
<dependency>
175+
<groupId>org.mybatis.spring.boot</groupId>
176+
<artifactId>mybatis-spring-boot-starter</artifactId>
177+
<version>1.3.2</version>
178+
</dependency>
179+
172180
</dependencies>
173181

174182
<dependencyManagement>

‎src/main/java/org/joychou/controller/SQLI.java‎

Lines changed: 114 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
package org.joychou.controller;
22

33

4-
import org.springframework.stereotype.Controller;
5-
import org.springframework.web.bind.annotation.RequestMapping;
6-
import org.springframework.web.bind.annotation.ResponseBody;
4+
import org.joychou.mapper.UserMapper;
5+
import org.joychou.dao.User;
6+
import org.springframework.beans.factory.annotation.Autowired;
7+
import org.springframework.web.bind.annotation.*;
78

89
import javax.servlet.http.HttpServletRequest;
910
import java.sql.*;
@@ -15,44 +16,46 @@
1516
* @desc SQL Injection
1617
*/
1718

18-
@Controller
19+
@RestController
1920
@RequestMapping("/sqli")
2021
public class SQLI {
2122

22-
@RequestMapping("/jdbc")
23-
@ResponseBody
24-
public static String jdbc_sqli(HttpServletRequest request){
23+
private static String driver = "com.mysql.jdbc.Driver";
24+
private static String url = "jdbc:mysql://localhost:3306/java_sec_code";
25+
private static String user = "root";
26+
private static String password = "woshishujukumima";
2527

26-
String name = request.getParameter("name");
27-
String driver = "com.mysql.jdbc.Driver";
28-
String url = "jdbc:mysql://localhost:3306/sectest";
29-
String user = "root";
30-
String password = "woshishujukumima";
28+
@Autowired
29+
private UserMapper userMapper;
30+
31+
32+
/**
33+
* Vul Code.
34+
* http://localhost:8080/sqli/jdbc/vul?username=joychou
35+
*
36+
* @param username username
37+
*/
38+
@RequestMapping("/jdbc/vul")
39+
public static String jdbc_sqli_vul(@RequestParam("username") String username){
3140
String result = "";
3241
try {
3342
Class.forName(driver);
34-
Connection con = DriverManager.getConnection(url,user,password);
43+
Connection con = DriverManager.getConnection(url, user, password);
3544

3645
if(!con.isClosed())
3746
System.out.println("Connecting to Database successfully.");
3847

3948
// sqli vuln code 漏洞代码
4049
Statement statement = con.createStatement();
41-
String sql = "select * from users where name = '" + name + "'";
50+
String sql = "select * from users where username = '" + username + "'";
4251
System.out.println(sql);
4352
ResultSet rs = statement.executeQuery(sql);
4453

45-
// fix code 用预处理修复SQL注入
46-
// String sql = "select * from users where name = ?";
47-
// PreparedStatement st = con.prepareStatement(sql);
48-
// st.setString(1, name);
49-
// System.out.println(st.toString()); // 预处理后的sql
50-
// ResultSet rs = st.executeQuery();
5154

5255
System.out.println("-----------------");
5356

5457
while(rs.next()){
55-
String res_name = rs.getString("name");
58+
String res_name = rs.getString("username");
5659
String res_pwd = rs.getString("password");
5760
result += res_name + ": " + res_pwd + "\n";
5861
System.out.println(res_name + ": " + res_pwd);
@@ -77,4 +80,94 @@ public static String jdbc_sqli(HttpServletRequest request){
7780
return result;
7881
}
7982

83+
84+
/**
85+
* Security Code.
86+
* http://localhost:8080/sqli/jdbc/sec?username=joychou
87+
*
88+
* @param username username
89+
*/
90+
@RequestMapping("/jdbc/sec")
91+
public static String jdbc_sqli_sec(@RequestParam("username") String username){
92+
93+
String result = "";
94+
try {
95+
Class.forName(driver);
96+
Connection con = DriverManager.getConnection(url, user, password);
97+
98+
if(!con.isClosed())
99+
System.out.println("Connecting to Database successfully.");
100+
101+
102+
// fix code
103+
String sql = "select * from users where username = ?";
104+
PreparedStatement st = con.prepareStatement(sql);
105+
st.setString(1, username);
106+
System.out.println(st.toString()); // sql after prepare statement
107+
ResultSet rs = st.executeQuery();
108+
109+
System.out.println("-----------------");
110+
111+
while(rs.next()){
112+
String res_name = rs.getString("username");
113+
String res_pwd = rs.getString("password");
114+
result += res_name + ": " + res_pwd + "\n";
115+
System.out.println(res_name + ": " + res_pwd);
116+
117+
}
118+
rs.close();
119+
con.close();
120+
121+
122+
}catch (ClassNotFoundException e) {
123+
System.out.println("Sorry,can`t find the Driver!");
124+
e.printStackTrace();
125+
}catch (SQLException e) {
126+
e.printStackTrace();
127+
}catch (Exception e) {
128+
e.printStackTrace();
129+
130+
}finally{
131+
System.out.println("-----------------");
132+
System.out.println("Connect database done.");
133+
}
134+
return result;
135+
}
136+
137+
138+
/**
139+
* security code
140+
* http://localhost:8080/sqli/mybatis/sec01?username=joychou
141+
*
142+
* @param username username
143+
*/
144+
@GetMapping("/mybatis/sec01")
145+
public User mybatis_vul1(@RequestParam("username") String username) {
146+
return userMapper.findByUserName(username);
147+
}
148+
149+
150+
151+
/**
152+
* security code
153+
* http://localhost:8080/sqli/mybatis/sec02?id=1
154+
*
155+
* @param id id
156+
*/
157+
@GetMapping("/mybatis/sec02")
158+
public User mybatis_v(@RequestParam("id") Integer id) {
159+
return userMapper.findById(id);
160+
}
161+
162+
163+
/**
164+
* security code
165+
* http://localhost:8080/sqli/mybatis/sec03
166+
**/
167+
@GetMapping("/mybatis/sec03")
168+
public User mybatis_vul2() {
169+
return userMapper.OrderByUsername();
170+
}
171+
172+
80173
}

‎src/main/java/org/joychou/controller/jsonp/JSONP.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ private static String emptyReferer(HttpServletRequest request, HttpServletRespon
5757
/**
5858
* Adding callback or cback on parameter can automatically return jsonp data.
5959
* http://localhost:8080/jsonp/advice?callback=test
60-
* http://localhost:8080/jsonp/advice?cback=test
60+
* http://localhost:8080/jsonp/advice?_callback=test
6161
*
6262
* @return Only return object, AbstractJsonpResponseBodyAdvice can be used successfully.
6363
* Such as JSONOjbect or JavaBean. String type cannot be used.

‎src/main/java/org/joychou/dao/User.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package org.joychou.dao;
2+
3+
import java.io.Serializable;
4+
5+
public class User implements Serializable {
6+
private static final long serialVersionUID = 1L;
7+
private Integer id;
8+
private String username;
9+
private String password;
10+
11+
public Integer getId() {
12+
return id;
13+
}
14+
public void setId(Integer id) {
15+
this.id = id;
16+
}
17+
18+
19+
public String getUsername() {
20+
return username;
21+
}
22+
public void setUsername(String username) {
23+
this.username = username;
24+
}
25+
26+
27+
public String getPassword() {
28+
return password;
29+
}
30+
public void setPassword(String password) {
31+
this.password = password;
32+
}
33+
34+
}

‎src/main/java/org/joychou/mapper/UserMapper.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package org.joychou.mapper;
2+
3+
import org.apache.ibatis.annotations.Mapper;
4+
import org.apache.ibatis.annotations.Param;
5+
import org.apache.ibatis.annotations.Select;
6+
import org.joychou.dao.User;
7+
8+
@Mapper
9+
public interface UserMapper {
10+
11+
// If using simple sql, we can use annotation.
12+
@Select("select * from users where username = #{username}")
13+
User findByUserName(@Param("username") String username);
14+
15+
User findById(Integer id);
16+
17+
User OrderByUsername();
18+
}

‎src/main/resources/application.properties‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11

2+
spring.datasource.url=jdbc:mysql://127.0.0.1:3306/java_sec_code?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=GMT%2B8
3+
spring.datasource.username=root
4+
spring.datasource.password=woshishujukumima
5+
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
6+
mybatis.mapper-locations=classpath:mapper/*.xml
7+
8+
29
# Spring Boot Actuator Vulnerable Config
310
management.security.enabled=false
411
# logging.config=classpath:logback-online.xml

‎src/main/resources/mapper/UserMapper.xml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
3+
4+
<mapper namespace="org.joychou.mapper.UserMapper">
5+
6+
<resultMap type="org.joychou.dao.User" id="User">
7+
<id column="id" property="id" javaType="java.lang.Integer" jdbcType="NUMERIC"/>
8+
<id column="username" property="username" javaType="java.lang.String" jdbcType="VARCHAR"/>
9+
<id column="password" property="password" javaType="java.lang.String" jdbcType="VARCHAR"/>
10+
</resultMap>
11+
12+
<!--<select id="findByUserName" resultMap="User">-->
13+
<!--select * from users where username = #{username}-->
14+
<!--</select>-->
15+
16+
<select id="findById" resultMap="User">
17+
select * from users where id = #{id}
18+
</select>
19+
20+
<select id="OrderByUsername" resultMap="User">
21+
select * from users order by id asc limit 1
22+
</select>
23+
</mapper>

0 commit comments

Comments
 (0)