解决使用Druid+Mybatis导致Error updating database. Cause: java.sql.SQLException: sql injection violation

解决使用Druid+Mybatis导致Error updating database. Cause: java.sql.SQLException: sql injection violation, multi-statement not allow

问题描述

通过mybatisplus的xml手写了个批量更新语句,多个更新sql时导致这个报错

<update id="batchUpdateDetails" parameterType="java.util.List">
        <foreach collection="list" item="Detail" separator=";">
        update t__detail
            <set>
                platform_id = null,
                app = #{Detail.app,jdbcType=VARCHAR},
            </set>
            where id = #{Detail.id,jdbcType=INTEGER}
        </foreach>
    </update>

在这里插入图片描述

解决

[url添加 allowMultiQueries=true 后缀,添加druid配置]

	mysql:
        driverClassName: com.mysql.cj.jdbc.Driver
          username: root
          password: 12345
          url: jdbc:mysql://localhost:3306/phone_mng?serverTimezone=Asia/Shanghai&useUnicode=true&characterEncoding=utf-8&useSSL=false&**allowMultiQueries=true**
          druid:
            wall:
              multi-statement-allow: true
2025-09-18 09:47:38.200 [reactor-http-nio-2] DEBUG io.netty.buffer.AbstractByteBuf - -Dio.netty.buffer.checkAccessible: true 2025-09-18 09:47:38.200 [reactor-http-nio-2] DEBUG io.netty.buffer.AbstractByteBuf - -Dio.netty.buffer.checkBounds: true 2025-09-18 09:47:38.200 [reactor-http-nio-2] DEBUG io.netty.util.ResourceLeakDetectorFactory - Loaded default ResourceLeakDetector: io.netty.util.ResourceLeakDetector@7e881c36 2025-09-18 09:47:38.243 [reactor-http-nio-2] DEBUG reactor.netty.http.server.HttpServerOperations - [c658418b, L:/192.168.10.122:9000 - R:/192.168.10.221:63369] New http connection, requesting read 2025-09-18 09:47:38.243 [reactor-http-nio-2] DEBUG reactor.netty.transport.TransportConfig - [c658418b, L:/192.168.10.122:9000 - R:/192.168.10.221:63369] Initialized pipeline DefaultChannelPipeline{(reactor.left.httpCodec = io.netty.handler.codec.http.HttpServerCodec), (reactor.left.httpTrafficHandler = reactor.netty.http.server.HttpTrafficHandler), (reactor.right.reactiveBridge = reactor.netty.channel.ChannelOperationsHandler)} 2025-09-18 09:47:38.251 [reactor-http-nio-2] DEBUG io.netty.util.Recycler - -Dio.netty.recycler.maxCapacityPerThread: 4096 2025-09-18 09:47:38.251 [reactor-http-nio-2] DEBUG io.netty.util.Recycler - -Dio.netty.recycler.ratio: 8 2025-09-18 09:47:38.251 [reactor-http-nio-2] DEBUG io.netty.util.Recycler - -Dio.netty.recycler.chunkSize: 32 2025-09-18 09:47:38.251 [reactor-http-nio-2] DEBUG io.netty.util.Recycler - -Dio.netty.recycler.blocking: false 2025-09-18 09:47:38.251 [reactor-http-nio-2] DEBUG io.netty.util.Recycler - -Dio.netty.recycler.batchFastThreadLocalOnly: true 2025-09-18 09:47:38.288 [reactor-http-nio-2] DEBUG reactor.netty.http.server.HttpServerOperations - [c658418b, L:/192.168.10.122:9000 - R:/192.168.10.221:63369] Increasing pending responses, now 1 2025-09-18 09:47:38.299 [reactor-http-nio-2] DEBUG reactor.netty.http.server.HttpServer - [c658418b-1, L:/192.168.10.122:9000 - R:/192.168.10.221:63369] Handler is being applied: org.springframework.http.server.reactive.ReactorHttpHandlerAdapter@721f3cd7 2025-09-18 09:47:38.337 [reactor-http-nio-2] DEBUG o.s.web.server.adapter.HttpWebHandlerAdapter - [c658418b-1] HTTP POST "/master/transportTime/add" 2025-09-18 09:47:38.364 [reactor-http-nio-2] DEBUG o.s.w.r.r.m.a.RequestMappingHandlerMapping - [c658418b-1] Mapped to com.hvlink.controller.TransportTimeController#insert(TransportTimeDTO) 2025-09-18 09:47:38.381 [reactor-http-nio-2] DEBUG o.s.w.r.r.m.a.RequestBodyMethodArgumentResolver - [c658418b-1] Content-Type:application/json 2025-09-18 09:47:38.391 [reactor-http-nio-2] DEBUG o.s.w.r.r.m.a.RequestBodyMethodArgumentResolver - [c658418b-1] 0..1 [com.hvlink.entity.dto.TransportTimeDTO] 2025-09-18 09:47:38.411 [reactor-http-nio-2] DEBUG reactor.netty.channel.FluxReceive - [c658418b-1, L:/192.168.10.122:9000 - R:/192.168.10.221:63369] [terminated=false, cancelled=false, pending=0, error=null]: subscribing inbound receiver 2025-09-18 09:47:38.431 [reactor-http-nio-2] DEBUG o.s.http.codec.json.Jackson2JsonDecoder - [c658418b-1] Decoded [TransportTimeDTO(id=null, companyCode=null, supplierCode=null, factoryCode=null, warehouseCode=null, (truncated)...] 2025-09-18 09:47:38.449 [reactor-http-nio-2] DEBUG o.s.jdbc.datasource.DataSourceTransactionManager - Creating new transaction with name [com.hvlink.service.impl.TransportTimeServiceImpl.insert]: PROPAGATION_REQUIRED,ISOLATION_DEFAULT 2025-09-18 09:47:38.645 [reactor-http-nio-2] INFO com.alibaba.druid.pool.DruidDataSource - {dataSource-1} inited 2025-09-18 09:47:39.108 [reactor-http-nio-2] DEBUG o.s.jdbc.datasource.DataSourceTransactionManager - Acquired Connection [ConnectionID:1 ClientConnectionId: 69f1048c-e727-4578-a768-9bd8edc01bc9] for JDBC transaction 2025-09-18 09:47:39.112 [reactor-http-nio-2] DEBUG o.s.jdbc.datasource.DataSourceTransactionManager - Switching JDBC Connection [ConnectionID:1 ClientConnectionId: 69f1048c-e727-4578-a768-9bd8edc01bc9] to manual commit 2025-09-18 09:47:39.140 [reactor-http-nio-2] DEBUG org.mybatis.spring.SqlSessionUtils - Creating a new SqlSession 2025-09-18 09:47:39.152 [reactor-http-nio-2] DEBUG org.mybatis.spring.SqlSessionUtils - Registering transaction synchronization for SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@17d2ae20] 2025-09-18 09:47:39.189 [reactor-http-nio-2] DEBUG o.m.spring.transaction.SpringManagedTransaction - JDBC Connection [ConnectionID:1 ClientConnectionId: 69f1048c-e727-4578-a768-9bd8edc01bc9] will be managed by Spring 2025-09-18 09:47:39.192 [reactor-http-nio-2] DEBUG c.h.m.master.TransportTimeMapper.existsByCodes - ==> Preparing: SELECT CASE WHEN EXISTS ( SELECT 1 FROM tm_transport_time ) THEN 1 ELSE 0 END 2025-09-18 09:47:39.223 [reactor-http-nio-2] DEBUG c.h.m.master.TransportTimeMapper.existsByCodes - ==> Parameters: 2025-09-18 09:47:39.260 [reactor-http-nio-2] DEBUG c.h.m.master.TransportTimeMapper.existsByCodes - <== Total: 1 2025-09-18 09:47:39.272 [reactor-http-nio-2] DEBUG org.mybatis.spring.SqlSessionUtils - Releasing transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@17d2ae20] 2025-09-18 09:47:39.303 [reactor-http-nio-2] DEBUG org.mybatis.spring.SqlSessionUtils - Fetched SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@17d2ae20] from current transaction 2025-09-18 09:47:39.312 [reactor-http-nio-2] DEBUG c.hvlink.mapper.master.TransportTimeMapper.insert - ==> Preparing: INSERT INTO tm_transport_time ( transport_time, is_deleted, create_by, create_time, update_by, update_time ) VALUES ( ?, ?, ?, ?, ?, ? ) 2025-09-18 09:47:39.338 [reactor-http-nio-2] DEBUG c.hvlink.mapper.master.TransportTimeMapper.insert - ==> Parameters: 49.0(Double), false(Boolean), admin(String), 2025-09-18 09:47:39.301(Timestamp), admin(String), 2025-09-18 09:47:39.301(Timestamp) 2025-09-18 09:47:39.374 [reactor-http-nio-2] DEBUG org.mybatis.spring.SqlSessionUtils - Releasing transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@17d2ae20] 2025-09-18 09:47:39.462 [reactor-http-nio-2] DEBUG o.s.beans.factory.xml.XmlBeanDefinitionReader - Loaded 11 bean definitions from class path resource [org/springframework/jdbc/support/sql-error-codes.xml] 2025-09-18 09:47:39.463 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'DB2' 2025-09-18 09:47:39.467 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'Derby' 2025-09-18 09:47:39.467 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'H2' 2025-09-18 09:47:39.468 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'HDB' 2025-09-18 09:47:39.469 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'HSQL' 2025-09-18 09:47:39.470 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'Informix' 2025-09-18 09:47:39.470 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'MS-SQL' 2025-09-18 09:47:39.470 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'MySQL' 2025-09-18 09:47:39.471 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'Oracle' 2025-09-18 09:47:39.471 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'PostgreSQL' 2025-09-18 09:47:39.472 [reactor-http-nio-2] DEBUG o.s.b.factory.support.DefaultListableBeanFactory - Creating shared instance of singleton bean 'Sybase' 2025-09-18 09:47:39.472 [reactor-http-nio-2] DEBUG o.s.jdbc.support.SQLErrorCodesFactory - Looking up default SQLErrorCodes for DataSource [com.hvlink.config.DataSourceConfig$1@23ee2ccf] 2025-09-18 09:47:39.484 [reactor-http-nio-2] DEBUG o.s.jdbc.support.SQLErrorCodesFactory - SQL error codes for 'Microsoft SQL Server' found 2025-09-18 09:47:39.484 [reactor-http-nio-2] DEBUG o.s.jdbc.support.SQLErrorCodesFactory - Caching SQL error codes for DataSource [com.hvlink.config.DataSourceConfig$1@23ee2ccf]: database product name is 'Microsoft SQL Server' 2025-09-18 09:47:39.486 [reactor-http-nio-2] DEBUG o.s.j.support.SQLErrorCodeSQLExceptionTranslator - Unable to translate SQLException with Error code '515', will now try the fallback translator 2025-09-18 09:47:39.486 [reactor-http-nio-2] DEBUG o.s.jdbc.support.SQLStateSQLExceptionTranslator - Extracted SQL state class '23' from value '23000' 2025-09-18 09:47:39.488 [reactor-http-nio-2] DEBUG org.mybatis.spring.SqlSessionUtils - Transaction synchronization deregistering SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@17d2ae20] 2025-09-18 09:47:39.489 [reactor-http-nio-2] DEBUG org.mybatis.spring.SqlSessionUtils - Transaction synchronization closing SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@17d2ae20] 2025-09-18 09:47:39.490 [reactor-http-nio-2] DEBUG o.s.jdbc.datasource.DataSourceTransactionManager - Initiating transaction rollback 2025-09-18 09:47:39.490 [reactor-http-nio-2] DEBUG o.s.jdbc.datasource.DataSourceTransactionManager - Rolling back JDBC transaction on Connection [ConnectionID:1 ClientConnectionId: 69f1048c-e727-4578-a768-9bd8edc01bc9] 2025-09-18 09:47:39.515 [reactor-http-nio-2] DEBUG o.s.jdbc.datasource.DataSourceTransactionManager - Releasing JDBC Connection [ConnectionID:1 ClientConnectionId: 69f1048c-e727-4578-a768-9bd8edc01bc9] after transaction 2025-09-18 09:47:39.523 [reactor-http-nio-2] DEBUG o.s.w.r.r.m.annotation.ResponseBodyResultHandler - [c658418b-1] Using 'application/json' given [application/json, text/plain, */*] and supported [application/json, application/*+json, application/x-ndjson, text/event-stream] 2025-09-18 09:47:39.524 [reactor-http-nio-2] DEBUG o.s.w.r.r.m.annotation.ResponseBodyResultHandler - [c658418b-1] 0..1 [com.hvlink.common.Result<java.lang.String>] 2025-09-18 09:47:39.533 [reactor-http-nio-2] DEBUG o.s.http.codec.json.Jackson2JsonEncoder - [c658418b-1] Encoding [Result(status=500, msg=<EOL><EOL>### Error updating database. Cause: com.microsoft.sqlserver.jdbc.SQLServer (truncated)...] 2025-09-18 09:47:39.564 [reactor-http-nio-2] DEBUG reactor.netty.http.server.HttpServerOperations - [c658418b-1, L:/192.168.10.122:9000 - R:/192.168.10.221:63369] Detected non persistent http connection, preparing to close 2025-09-18 09:47:39.599 [reactor-http-nio-2] DEBUG reactor.netty.http.server.HttpServerOperations - [c658418b-1, L:/192.168.10.122:9000 - R:/192.168.10.221:63369] Last HTTP packet was sent, terminating the channel 2025-09-18 09:47:39.599 [reactor-http-nio-2] DEBUG reactor.netty.channel.ChannelOperations - [c658418b-1, L:/192.168.10.122:9000 - R:/192.168.10.221:63369] [HttpServer] Channel inbound receiver cancelled (operation cancelled). 2025-09-18 09:47:39.634 [reactor-http-nio-2] DEBUG o.s.web.server.adapter.HttpWebHandlerAdapter - [c658418b-1] Completed 200 OK
最新发布
09-19
使用 Druid 数据源版本 1.2.8 时,如果出现 `sql injection violation, multi-statement not allow` 错误,并导致数据库更新操作失败,这通常是由于 DruidSQL 防注入机制限制了多语句执行。Druid 默认禁止在一个 SQL 请求中执行多个语句,以防止 SQL 注入攻击。 ### 解决方案 #### 1. 修改 Druid WallConfig 配置 可以通过配置 `WallConfig` 来允许执行多语句 SQL,具体做法是在配置类中启用 `multiStatementAllow` 和 `noneBaseStatementAllow` 属性[^3]。 ```java @Configuration public class DruidConfig { @Primary @Bean @ConfigurationProperties(prefix = "spring.datasource.druid") public DataSource druidDataSource() { DruidDataSource druidDataSource = new DruidDataSource(); List<Filter> filterList = new ArrayList<>(); filterList.add(wallFilter()); filterList.add(statFilter()); druidDataSource.setProxyFilters(filterList); return druidDataSource; } @Bean public WallFilter wallFilter() { WallFilter wallFilter = new WallFilter(); wallFilter.setConfig(wallConfig()); return wallFilter; } @Bean public StatFilter statFilter() { StatFilter statFilter = new StatFilter(); return statFilter; } @Bean public WallConfig wallConfig() { WallConfig config = new WallConfig(); config.setMultiStatementAllow(true); // 允许一次执行多个 SQL 语句 config.setNoneBaseStatementAllow(true); // 允许非基本语句的 SQL 执行 return config; } } ``` 此方法适用于 Spring Boot 项目中的 Druid 集成场景,通过启用 `WallConfig` 中的 `multiStatementAllow` 选项来绕过多语句限制。 #### 2. 升级或降级 Druid 版本 某些版本的 DruidSQL 注入检查更为严格,尤其是 1.2.5 及以上版本。若当前环境允许,可以尝试升级到更高版本(如 1.2.9 或以上)或回退到更稳定的旧版本(如 1.1.x),部分用户反馈该问题在特定版本中已修复[^5]。 #### 3. 检查 SQL 语句结构 确保执行的 SQL 语句没有不必要的多语句拼接。例如,避免以下形式: ```sql UPDATE table SET col1 = 'val1'; UPDATE another_table SET col2 = 'val2'; ``` 而是将它们拆分为两个独立的请求执行。这种方式不仅更安全,也符合 Druid 的默认行为规范。 #### 4. 使用原生 JDBC 或其他数据源 如果业务逻辑确实需要频繁执行多语句 SQL,并且不希望修改 Druid 行为,可考虑临时切换为原生 JDBC 或 HikariCP 等数据源进行处理。 ---
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值