Headline
CVE-2022-27360: blade-service/blade-user/src/main/java/org/springblade/system/user/mapper/UserMapper.xml · smallchill/SpringBlade - Gitee.com
SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="org.springblade.system.user.mapper.UserMapper">
<!-- 通用查询映射结果 -->
<resultMap id="userResultMap" type="org.springblade.system.user.entity.User">
<result column="id" property="id"/>
<result column="tenant_id" property="tenantId"/>
<result column="create_user" property="createUser"/>
<result column="create_time" property="createTime"/>
<result column="update_user" property="updateUser"/>
<result column="update_time" property="updateTime"/>
<result column="status" property="status"/>
<result column="is_deleted" property="isDeleted"/>
<result column="code" property="code"/>
<result column="account" property="account"/>
<result column="password" property="password"/>
<result column="name" property="name"/>
<result column="real_name" property="realName"/>
<result column="email" property="email"/>
<result column="phone" property="phone"/>
<result column="birthday" property="birthday"/>
<result column="sex" property="sex"/>
<result column="role_id" property="roleId"/>
<result column="dept_id" property="deptId"/>
</resultMap>
<!-- 通用查询结果列 -->
<sql id="baseColumnList">
select id,
create\_user AS createUser,
create\_time AS createTime,
update\_user AS updateUser,
update\_time AS updateTime,
status,
is\_deleted AS isDeleted,
account, password, name, real\_name, email, phone, birthday, sex, role\_id, dept\_id
</sql>
<select id="selectUserPage" resultMap="userResultMap">
select \* from blade\_user where is\_deleted = 0
</select>
<select id="getUser" resultMap="userResultMap">
SELECT
\*
FROM
blade\_user
WHERE
tenant\_id = #{param1} and account = #{param2} and password = #{param3} and is\_deleted = 0
</select>
<select id="getRoleName" resultType="java.lang.String">
SELECT
role\_name
FROM
blade\_role
WHERE
id IN
<foreach collection="array" item="ids" index="index" open="(" close=")" separator=",">
#{ids}
</foreach>
and is\_deleted = 0
</select>
<select id="getRoleAlias" resultType="java.lang.String">
SELECT
role\_alias
FROM
blade\_role
WHERE
id IN
<foreach collection="array" item="ids" index="index" open="(" close=")" separator=",">
#{ids}
</foreach>
and is\_deleted = 0
</select>
<select id="getDeptName" resultType="java.lang.String">
SELECT
dept\_name
FROM
blade\_dept
WHERE
id IN
<foreach collection="array" item="ids" index="index" open="(" close=")" separator=",">
#{ids}
</foreach>
and is\_deleted = 0
</select>
<select id="exportUser" resultType="org.springblade.system.user.excel.UserExcel">
SELECT id, tenant\_id, account, name, real\_name, email, phone, birthday, role\_id, dept\_id, post\_id FROM blade\_user ${ew.customSqlSegment}
</select>
</mapper>