Skip to content

Commit fed822c

Browse files
zhufuyizhufuyi
committed
feat: for custom query, add whitelist judgment
1 parent 7c90a8d commit fed822c

File tree

12 files changed

+306
-215
lines changed

12 files changed

+306
-215
lines changed

‎internal/dao/userExample.go‎

Lines changed: 3 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -175,41 +175,10 @@ func (d *userExampleDao) GetByID(ctx context.Context, id uint64) (*model.UserExa
175175
return nil, err
176176
}
177177

178-
// GetByColumns get paging records by column information,
179-
// Note: query performance degrades when table rows are very large because of the use of offset.
180-
//
181-
// params includes paging parameters and query parameters
182-
// paging parameters (required):
183-
//
184-
// page: page number, starting from 0
185-
// limit: lines per page
186-
// sort: sort fields, default is id backwards, you can add - sign before the field to indicate reverse order, no - sign to indicate ascending order, multiple fields separated by comma
187-
//
188-
// query parameters (not required):
189-
//
190-
// name: column name
191-
// exp: expressions, which default is "=", support =, !=, >, >=, <, <=, like, in, notin, isnull, isnotnull
192-
// value: column value, if exp=in, multiple values are separated by commas
193-
// logic: logical type, default value is "and", support &, and, ||, or
194-
//
195-
// example: search for a male over 20 years of age
196-
//
197-
// params = &query.Params{
198-
// Page: 0,
199-
// Limit: 20,
200-
// Columns: []query.Column{
201-
// {
202-
// Name: "age",
203-
// Exp: ">",
204-
// Value: 20,
205-
// },
206-
// {
207-
// Name: "gender",
208-
// Value: "male",
209-
// },
210-
// }
178+
// GetByColumns get paging records by column information.
179+
// For more details, please refer to https://go-sponge.com/component/custom-page-query.html
211180
func (d *userExampleDao) GetByColumns(ctx context.Context, params *query.Params) ([]*model.UserExample, int64, error) {
212-
queryStr, args, err := params.ConvertToGormConditions()
181+
queryStr, args, err := params.ConvertToGormConditions(query.WithWhitelistNames(model.UserExampleColumnNames))
213182
if err != nil {
214183
return nil, 0, errors.New("query params error: " + err.Error())
215184
}

‎internal/dao/userExample.go.exp‎

Lines changed: 6 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -181,41 +181,10 @@ func (d *userExampleDao) GetByID(ctx context.Context, id uint64) (*model.UserExa
181181
return nil, err
182182
}
183183

184-
// GetByColumns get paging records by column information,
185-
// Note: query performance degrades when table rows are very large because of the use of offset.
186-
//
187-
// params includes paging parameters and query parameters
188-
// paging parameters (required):
189-
//
190-
// page: page number, starting from 0
191-
// limit: lines per page
192-
// sort: sort fields, default is id backwards, you can add - sign before the field to indicate reverse order, no - sign to indicate ascending order, multiple fields separated by comma
193-
//
194-
// query parameters (not required):
195-
//
196-
// name: column name
197-
// exp: expressions, which default is "=", support =, !=, >, >=, <, <=, like, in, notin, isnull, isnotnull
198-
// value: column value, if exp=in, multiple values are separated by commas
199-
// logic: logical type, default value is "and", support &, and, ||, or
200-
//
201-
// example: search for a male over 20 years of age
202-
//
203-
// params = &query.Params{
204-
// Page: 0,
205-
// Limit: 20,
206-
// Columns: []query.Column{
207-
// {
208-
// Name: "age",
209-
// Exp: ">",
210-
// Value: 20,
211-
// },
212-
// {
213-
// Name: "gender",
214-
// Value: "male",
215-
// },
216-
// }
184+
// GetByColumns get paging records by column information.
185+
// For more details, please refer to https://go-sponge.com/component/custom-page-query.html
217186
func (d *userExampleDao) GetByColumns(ctx context.Context, params *query.Params) ([]*model.UserExample, int64, error) {
218-
queryStr, args, err := params.ConvertToGormConditions()
187+
queryStr, args, err := params.ConvertToGormConditions(query.WithWhitelistNames(model.UserExampleColumnNames))
219188
if err != nil {
220189
return nil, 0, errors.New("query params error: " + err.Error())
221190
}
@@ -256,29 +225,10 @@ func (d *userExampleDao) DeleteByIDs(ctx context.Context, ids []uint64) error {
256225
return nil
257226
}
258227

259-
// GetByCondition get a record by condition
260-
// query conditions:
261-
//
262-
// name: column name
263-
// exp: expressions, which default is "=", support =, !=, >, >=, <, <=, like, in, notin, isnull, isnotnull
264-
// value: column value, if exp=in, multiple values are separated by commas
265-
// logic: logical type, default value is "and", support &, and, ||, or
266-
//
267-
// example: find a male aged 20
268-
//
269-
// condition = &query.Conditions{
270-
// Columns: []query.Column{
271-
// {
272-
// Name: "age",
273-
// Value: 20,
274-
// },
275-
// {
276-
// Name: "gender",
277-
// Value: "male",
278-
// },
279-
// }
228+
// GetByCondition get a record by condition.
229+
// For more details, please refer to https://go-sponge.com/component/custom-page-query.html#_2-condition-parameters-optional
280230
func (d *userExampleDao) GetByCondition(ctx context.Context, c *query.Conditions) (*model.UserExample, error) {
281-
queryStr, args, err := c.ConvertToGorm()
231+
queryStr, args, err := c.ConvertToGorm(query.WithWhitelistNames(model.UserExampleColumnNames))
282232
if err != nil {
283233
return nil, err
284234
}

‎internal/dao/userExample.go.exp.tpl‎

Lines changed: 5 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -187,44 +187,13 @@ func (d *{{.TableNameCamelFCL}}Dao) GetBy{{.ColumnNameCamel}}(ctx context.Contex
187187
return nil, err
188188
}
189189

190-
// GetByColumns get paging records by column information,
191-
// Note: query performance degrades when table rows are very large because of the use of offset.
192-
//
193-
// params includes paging parameters and query parameters
194-
// paging parameters (required):
195-
//
196-
// page: page number, starting from 0
197-
// limit: lines per page
198-
// sort: sort fields, default is {{.ColumnNameCamelFCL}} backwards, you can add - sign before the field to indicate reverse order, no - sign to indicate ascending order, multiple fields separated by comma
199-
//
200-
// query parameters (not required):
201-
//
202-
// name: column name
203-
// exp: expressions, which default is "=", support =, !=, >, >=, <, <=, like, in, notin, isnull, isnotnull
204-
// value: column value, if exp=in, multiple values are separated by commas
205-
// logic: logical type, default value is "and", support &, and, ||, or
206-
//
207-
// example: search for a male over 20 years of age
208-
//
209-
// params = &query.Params{
210-
// Page: 0,
211-
// Limit: 20,
212-
// Columns: []query.Column{
213-
// {
214-
// Name: "age",
215-
// Exp: ">",
216-
// Value: 20,
217-
// },
218-
// {
219-
// Name: "gender",
220-
// Value: "male",
221-
// },
222-
// }
190+
// GetByColumns get paging records by column information.
191+
// For more details, please refer to https://go-sponge.com/component/custom-page-query.html
223192
func (d *{{.TableNameCamelFCL}}Dao) GetByColumns(ctx context.Context, params *query.Params) ([]*model.{{.TableNameCamel}}, int64, error) {
224193
if params.Sort == "" {
225194
params.Sort = "-{{.ColumnName}}"
226195
}
227-
queryStr, args, err := params.ConvertToGormConditions()
196+
queryStr, args, err := params.ConvertToGormConditions(query.WithWhitelistNames(model.{{.TableNameCamel}}ColumnNames))
228197
if err != nil {
229198
return nil, 0, errors.New("query params error: " + err.Error())
230199
}
@@ -266,28 +235,9 @@ func (d *{{.TableNameCamelFCL}}Dao) DeleteBy{{.ColumnNamePluralCamel}}(ctx conte
266235
}
267236

268237
// GetByCondition get a record by condition
269-
// query conditions:
270-
//
271-
// name: column name
272-
// exp: expressions, which default is "=", support =, !=, >, >=, <, <=, like, in, notin, isnull, isnotnull
273-
// value: column value, if exp=in, multiple values are separated by commas
274-
// logic: logical type, default value is "and", support &, and, ||, or
275-
//
276-
// example: find a male aged 20
277-
//
278-
// condition = &query.Conditions{
279-
// Columns: []query.Column{
280-
// {
281-
// Name: "age",
282-
// Value: 20,
283-
// },
284-
// {
285-
// Name: "gender",
286-
// Value: "male",
287-
// },
288-
// }
238+
// For more details, please refer to https://go-sponge.com/component/custom-page-query.html#_2-condition-parameters-optional
289239
func (d *{{.TableNameCamelFCL}}Dao) GetByCondition(ctx context.Context, c *query.Conditions) (*model.{{.TableNameCamel}}, error) {
290-
queryStr, args, err := c.ConvertToGorm()
240+
queryStr, args, err := c.ConvertToGorm(query.WithWhitelistNames(model.{{.TableNameCamel}}ColumnNames))
291241
if err != nil {
292242
return nil, err
293243
}

‎internal/dao/userExample.go.mgo‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,9 +225,13 @@ func (d *userExampleDao) GetByID(ctx context.Context, id string) (*model.UserExa
225225
// Name: "gender",
226226
// Value: "male",
227227
// },
228+
// {
229+
// Name: "post_id:oid", // suffix :oid is required for objectId type
230+
// Value: "65ce48483f11aff697e30d6d",
231+
// },
228232
// }
229233
func (d *userExampleDao) GetByColumns(ctx context.Context, params *query.Params) ([]*model.UserExample, int64, error) {
230-
filter, err := params.ConvertToMongoFilter()
234+
filter, err := params.ConvertToMongoFilter(query.WithWhitelistNames(model.UserExampleColumnNames))
231235
if err != nil {
232236
return nil, 0, errors.New("query params error: " + err.Error())
233237
}

‎internal/dao/userExample.go.mgo.exp‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -230,9 +230,13 @@ func (d *userExampleDao) GetByID(ctx context.Context, id string) (*model.UserExa
230230
// Name: "gender",
231231
// Value: "male",
232232
// },
233+
// {
234+
// Name: "post_id:oid", // suffix :oid is required for objectId type
235+
// Value: "65ce48483f11aff697e30d6d",
236+
// },
233237
// }
234238
func (d *userExampleDao) GetByColumns(ctx context.Context, params *query.Params) ([]*model.UserExample, int64, error) {
235-
filter, err := params.ConvertToMongoFilter()
239+
filter, err := params.ConvertToMongoFilter(query.WithWhitelistNames(model.UserExampleColumnNames))
236240
if err != nil {
237241
return nil, 0, errors.New("query params error: " + err.Error())
238242
}
@@ -297,12 +301,12 @@ func (d *userExampleDao) DeleteByIDs(ctx context.Context, ids []string) error {
297301
// Value: "James",
298302
// },
299303
// {
300-
// Name: "post_id:oid",
304+
// Name: "post_id:oid", // suffix :oid is required for objectId type
301305
// Value: "65ce48483f11aff697e30d6d",
302306
// },
303307
// }
304308
func (d *userExampleDao) GetByCondition(ctx context.Context, c *query.Conditions) (*model.UserExample, error) {
305-
filter, err := c.ConvertToMongo()
309+
filter, err := c.ConvertToMongo(query.WithWhitelistNames(model.UserExampleColumnNames))
306310
if err != nil {
307311
return nil, err
308312
}

‎internal/dao/userExample.go.tpl‎

Lines changed: 3 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -181,44 +181,13 @@ func (d *{{.TableNameCamelFCL}}Dao) GetBy{{.ColumnNameCamel}}(ctx context.Contex
181181
return nil, err
182182
}
183183

184-
// GetByColumns get paging records by column information,
185-
// Note: query performance degrades when table rows are very large because of the use of offset.
186-
//
187-
// params includes paging parameters and query parameters
188-
// paging parameters (required):
189-
//
190-
// page: page number, starting from 0
191-
// limit: lines per page
192-
// sort: sort fields, default is {{.ColumnNameCamelFCL}} backwards, you can add - sign before the field to indicate reverse order, no - sign to indicate ascending order, multiple fields separated by comma
193-
//
194-
// query parameters (not required):
195-
//
196-
// name: column name
197-
// exp: expressions, which default is "=", support =, !=, >, >=, <, <=, like, in, notin, isnull, isnotnull
198-
// value: column value, if exp=in, multiple values are separated by commas
199-
// logic: logical type, default value is "and", support &, and, ||, or
200-
//
201-
// example: search for a male over 20 years of age
202-
//
203-
// params = &query.Params{
204-
// Page: 0,
205-
// Limit: 20,
206-
// Columns: []query.Column{
207-
// {
208-
// Name: "age",
209-
// Exp: ">",
210-
// Value: 20,
211-
// },
212-
// {
213-
// Name: "gender",
214-
// Value: "male",
215-
// },
216-
// }
184+
// GetByColumns get paging records by column information.
185+
// For more details, please refer to https://go-sponge.com/component/custom-page-query.html
217186
func (d *{{.TableNameCamelFCL}}Dao) GetByColumns(ctx context.Context, params *query.Params) ([]*model.{{.TableNameCamel}}, int64, error) {
218187
if params.Sort == "" {
219188
params.Sort = "-{{.ColumnName}}"
220189
}
221-
queryStr, args, err := params.ConvertToGormConditions()
190+
queryStr, args, err := params.ConvertToGormConditions(query.WithWhitelistNames(model.{{.TableNameCamel}}ColumnNames))
222191
if err != nil {
223192
return nil, 0, errors.New("query params error: " + err.Error())
224193
}

‎internal/model/userExample.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,21 @@ func (table *UserExample) TableName() string {
2727
return "user_example"
2828
}
2929

30+
// UserExampleColumnNames Whitelist for custom query fields to prevent sql injection attacks
31+
var UserExampleColumnNames = map[string]bool{
32+
"id": true,
33+
"created_at": true,
34+
"updated_at": true,
35+
"deleted_at": true,
36+
"name": true,
37+
"password": true,
38+
"email": true,
39+
"phone": true,
40+
"avatar": true,
41+
"age": true,
42+
"gender": true,
43+
"status": true,
44+
"login_at": true,
45+
}
46+
3047
// delete the templates code end

‎pkg/gin/middleware/auth/auth.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ type initAuthOptions struct {
3535
signingMethod *SigningMethodHMAC
3636
}
3737

38-
func defaultInirAuthOptions() *initAuthOptions {
38+
func defaultInitAuthOptions() *initAuthOptions {
3939
return &initAuthOptions{
4040
signingMethod: HS256,
4141
}
@@ -66,7 +66,7 @@ func WithInitAuthIssuer(issuer string) InitAuthOption {
6666

6767
// InitAuth initializes jwt options.
6868
func InitAuth(signingKey []byte, expire time.Duration, opts ...InitAuthOption) {
69-
o := defaultInirAuthOptions()
69+
o := defaultInitAuthOptions()
7070
o.apply(opts...)
7171

7272
customSigningKey = signingKey

0 commit comments

Comments
 (0)