Druid-排查conditionDoubleConstAllow配置问题(double const condition)

Druid-排查conditionDoubleConstAllow配置问题(double const condition)

报错信息

Caused by: java.sql.SQLException: sql injection violation, dbType postgresql, druid-version 1.2.18, double const condition : SELECT * FROM test where 1=1 AND TRUE AND TRUE

关键词：double const condition
Druid进行SQL检查，发现了重复的常量条件

排查过程

• 下载druid源码 https://github.com/alibaba/druid
• 阅读相关文档 文档
• 代码断点调试排查

编写代码复现问题

@RestController
@Slf4j
public class TestController {
   

    @Autowired
    private JdbcTemplate jdbcTemplate;

    @GetMapping("test")
    public String test(){
   
        String sql = "SELECT * FROM test WHERE 1=1 AND TRUE AND id = 1 ";
        jdbcTemplate.execute(sql);
        return "Test";
    }

}

Druid配置关键信息：wall

spring:
  datasource:
    druid:
      filters: config,wall,stat

运行错误：

java.sql.SQLException: sql injection violation, dbType postgresql, druid-version 1.2.18, part alway true condition not allow : SELECT * FROM test WHERE 1=1 AND TRUE AND id = 1 
	at com.alibaba.druid.wall.WallFilter.checkInternal(WallFilter.java:836)
	at com.alibaba.druid.wall.WallFilter.check(WallFilter.java:801)
	at com.alibaba.druid.wall.WallFilter.statement_execute(WallFilter.java:433)
	at com.alibaba.druid.filter.FilterChainImpl.statement_execute(FilterChainImpl.java:2991)
	at com.alibaba.druid.proxy.jdbc.StatementProxyImpl.execute(StatementProxyImpl.java:143)
	at com.alibaba.druid.pool.DruidPooledStatement.execute(DruidPooledStatement.java:635)
	at org.springframework.jdbc.core.JdbcTemplate$1ExecuteStatementCallback.doInStatement(JdbcTemplate.java:422)
	at org.springframework.jdbc.core.JdbcTemplate.execute(JdbcTemplate.java:381)
	at org.springframework.jdbc.core.JdbcTemplate.execute(JdbcTemplate.java:431)

通过文档 https://github.com/alibaba/druid/wiki/%E9%85%8D%E7%BD%AE-wallfilter 可以看到相关存在相关配置：conditionDoubleConstAllow , 默认为false，既不允许Where条件中有两个以上的常量。

接下来打开源码，搜索conditionDoubleConstAllow，找到以下线索：

1. com.alibaba.druid.wall.WallConfig#conditionDoubleConstAllow
2. com.alibaba.druid.spring.boot.autoconfigure.stat.DruidFilterConfiguration#wallConfig

解决方法一：将配置filters: config,wall,stat 中的wall去掉，既不进行一些防注入检查，修改有效，但安全性降低，暂不采用

解决方法二：重点关注wallConfig()方法：

    private static final String FILTER_WALL_PREFIX = "spring.datasource.druid.filter.wall";
    private static final String FILTER_WALL_CONFIG_PREFIX = FILTER_WALL_PREFIX + ".config";

    @Bean
    @ConfigurationProperties(FILTER_WALL_CONFIG_PREFIX)
    @ConditionalOnProperty(prefix = FILTER_WALL_PREFIX, name = "enabled")
    @ConditionalOnMissingBean
    public WallConfig wallConfig() {