收录 ty

the menu "classified dictionary"， there is no interface that you described to be called， if you want to test this interface /sys/category/loadOne，pls pass plain string instead of expression

菜单“分类字典”，没有您描述要调用的接口，如果您想测试此接口/sys/category/loadOne，请传递纯字符串而不是表达式

Oh, sorry. It may not be in the "classification dictionary" menu bar, but it does exist, it can query the "classification dictionary" data, by changing the value of the "field" attack, as shown in the normal request result:

the menu "classified dictionary"， there is no interface that you described to be called， if you want to test this interface /sys/category/loadOne，pls pass plain string instead of expression

Hello, I have confirmed that the interface exists. When you perform the following steps, you will find the packet request. Common Cases --> Custom Components --> Tree Dictionary：

i got it , you can try like this:

    @RequestMapping(value = "/loadOne", method = RequestMethod.GET)
 	public Result<SysCategory> loadOne(@RequestParam(name="field") String field,@RequestParam(name="val") String val) {
 		Result<SysCategory> result = new Result<SysCategory>();
 		try {
			//检查字段是不是实体中的
			boolean isClassField = SqlInjectionUtil.isClassField(field, SysCategory.class);
			if (!isClassField) {
				return Result.error("字段无效，请检查!");
			}
	
 			QueryWrapper<SysCategory> query = new QueryWrapper<SysCategory>();
 			query.eq(field, val);
 			List<SysCategory> ls = this.sysCategoryService.list(query);
                        //ignore many code

	/**
	 * 判断给定的字段是不是类中的属性
	 * @param field
	 * @param clazz
	 * @return
	 */
	public static boolean isClassField(String field, Class clazz){
		Field[] fields = clazz.getDeclaredFields();
		for(int i=0;i<fields.length;i++){
			if(fields[i].getName().equalsIgnoreCase(field)){
				return true;
			}
		}
		return false;
	}

i got it , you can try like this:

    @RequestMapping(value = "/loadOne", method = RequestMethod.GET)
 	public Result<SysCategory> loadOne(@RequestParam(name="field") String field,@RequestParam(name="val") String val) {
 		Result<SysCategory> result = new Result<SysCategory>();
 		try {
			//检查字段是不是实体中的
			boolean isClassField = SqlInjectionUtil.isClassField(field, SysCategory.class);
			if (!isClassField) {
				return Result.error("字段无效，请检查!");
			}
	
 			QueryWrapper<SysCategory> query = new QueryWrapper<SysCategory>();
 			query.eq(field, val);
 			List<SysCategory> ls = this.sysCategoryService.list(query);
                        //ignore many code

 /**
  * 判断给定的字段是不是类中的属性
  * @param field
  * @param clazz
  * @return
  */
 public static boolean isClassField(String field, Class clazz){
 	Field[] fields = clazz.getDeclaredFields();
 	for(int i=0;i<fields.length;i++){
 		if(fields[i].getName().equalsIgnoreCase(field)){
 			return true;
 		}
 	}
 	return false;
 }

When I give it some malicious statements, I can query the version of the database, database name and other information, and even the whole database data down, so it is very dangerous.Here is a bit of offense to the official website, do the above verification.

已处理

@zhangdaiscott 请问，对应的commit是哪个？