Method and device for detecting SQL injection, electronic equipment and medium
By detecting Mapper objects during Spring program startup, the problem of missing SQL statements caused by developers forgetting to add database fields is solved, program errors are avoided, and missing SQL statements can be detected before the requirements are deployed.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHENZHEN HAIGUI NETWORK TECH CO LTD
- Filing Date
- 2025-06-11
- Publication Date
- 2026-06-02
AI Technical Summary
When developing an application, developers may forget to add fields to the online database, resulting in missing SQL statements and causing program errors.
When starting the Spring application, the Mapper object is obtained through the detection program and detection is performed based on the set detection rules. If a missing SQL statement is found, an exception result is returned and the Spring application is stopped from starting.
This avoids program errors caused by missing SQL statements by detecting and preventing the Spring program from starting at startup, thus alerting developers to any missing SQL statements.
Smart Images
Figure CN120276965B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, apparatus, electronic device, and medium for detecting SQL leaks. Background Technology
[0002] During application development, developers often add fields based on requirements and establish strict release policies, including writing release plans before release, releasing according to the plan, and verifying after release. However, when deploying the application, developers may forget to add the fields to the online database, a phenomenon known as missing SQL statements, which can lead to program errors. Summary of the Invention
[0003] In view of this, the purpose of the present invention is to provide a method, device, electronic device and medium for detecting missing SQL statements, which can prevent program errors caused by missing SQL statements when the system is deployed.
[0004] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0005] In a first aspect, the present invention provides a method for preventing the detection of missing SQL statements, comprising: starting a preset detection program when starting a Spring program; obtaining a Mapper object in the Spring program, and performing detection based on the Mapper object according to the detection rules set in the detection program; if there is a missing SQL statement during the detection process, returning an abnormal result and stopping the start of the Spring program.
[0006] Optionally, when starting the Spring application, a preset detection program can be started, including: obtaining and starting the preset detection program by calling the preset CommandLineRunner interface in the Spring application.
[0007] Optionally, you can obtain the Mapper object in the Spring application, including obtaining the Mapper object in the Spring application through the Resource annotation of the Spring application.
[0008] Optionally, detection can be performed based on the Mapper object according to the detection rules set in the detection program, including: performing database queries based on the Mapper object, and determining whether there are any missing SQL queries based on the database query results.
[0009] Optionally, a database query is performed based on the Mapper object, and the database query results are used to determine whether there are any missing SQL statements. This includes: executing the selectList method of each Mapper object in a loop; if there are no missing SQL statements, the first record of the actual table mapped by the Mapper object is obtained; if there are missing SQL statements, the selectList method of the Mapper object cannot be executed, and the database returns an error detection result.
[0010] Optionally, it also includes generating an error log during the execution of the detection program to alert developers of any missing SQL statements.
[0011] Secondly, the present invention provides a detection device for preventing missing SQL statements, comprising: a detection program startup module, used to start a preset detection program when starting a Spring program; a detection module, used to obtain a Mapper object in the Spring program and perform detection based on the Mapper object according to the detection rules set in the detection program; and a result feedback module, used to return an abnormal result and stop starting the Spring program if there are missing SQL statements during the detection process.
[0012] Optionally, the detection program startup module is specifically used to: obtain and start a preset detection program by calling the preset CommandLineRunner interface in the Spring program.
[0013] Thirdly, the present invention provides an electronic device including a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement the steps of the method provided in any of the first aspects above.
[0014] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, performs the steps of the method provided in any of the first aspects above.
[0015] This invention brings the following beneficial effects:
[0016] The method, apparatus, electronic device, and medium for preventing missing SQL statements provided by this invention first start a preset detection program when the Spring program starts; then, it obtains the Mapper object in the Spring program and performs detection based on the Mapper object according to the detection rules set in the detection program; if missing SQL statements are found during the detection process, an exception result is returned, and the Spring program is stopped from starting. This method can execute the detection program when the Spring program starts, detect the presence of missing SQL statements based on the Mapper object, and stop the Spring program from starting if any are found, thereby preventing program errors caused by missing SQL statements when the program is deployed.
[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.
[0018] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description
[0019] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0020] Figure 1 A flowchart illustrating a method for preventing missing SQL statements provided in an embodiment of the present invention;
[0021] Figure 2 This is a schematic diagram of a detection device for preventing SQL leaks provided in an embodiment of the present invention;
[0022] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation
[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0024] Spring: A framework that enables rapid development of Java EE applications.
[0025] MyBatis: An excellent persistence layer framework that supports custom SQL, stored procedures, and advanced mappings.
[0026] Mybatis-Plus: An enhancement tool for MyBatis. It enhances MyBatis without changing it, and is designed to simplify development and improve efficiency.
[0027] Currently, developers often add fields during application development, but when the application goes live, they may forget to add the fields to the online database, a phenomenon known as missing SQL statements, which can cause program errors.
[0028] Based on this, the present invention provides a detection method, device, electronic device and medium for preventing missing SQL statements, which can avoid program errors caused by missing SQL statements when the requirements are deployed.
[0029] To facilitate understanding of this embodiment, a method for preventing SQL leakage disclosed in this invention will first be described in detail. This method can be executed by an electronic device, such as a smartphone, computer, or tablet computer. See also... Figure 1 The flowchart shown illustrates a method for preventing SQL leakage detection, which mainly includes the following steps S101 to S103:
[0030] Step S101: When starting the Spring application, start the default detection program.
[0031] In one implementation, a Spring application has a startup process, and only after startup is complete does the application provide services. In this embodiment, a detection program is added to the Spring application to detect missing SQL statements during startup.
[0032] In practice, the default detection program can be obtained and started by calling the CommandLineRunner interface in the Spring program. Specifically, Spring provides the CommandLineRunner interface, which developers can implement to customize what to do when the Spring program starts. By implementing the CommandLineRunner interface and adding detection programs, the Spring program can execute the default detection programs at startup.
[0033] Step S102: Obtain the Mapper object in the Spring program and perform detection based on the Mapper object according to the detection rules set in the detection program.
[0034] Step S103: If there are any missing SQL statements during the detection process, return an abnormal result and stop starting the Spring application.
[0035] In one implementation, after starting the detection program, all Mapper objects can be collected. Since database access in Mybatis-Plus projects is typically achieved through Mapper objects, these Mapper objects all inherit from the baseMapper provided by Mybatis-Plus. All Mapper objects in a Mybatis-Plus project are hosted in Spring. Based on Spring's automatic injection feature, specifically the `@Resource` annotation provided by Spring, Spring can collect all Mapper objects. Therefore, in this embodiment of the invention, when retrieving Mapper objects from a Spring program, the `@Resource` annotation of the Spring program can be used to obtain the Mapper objects.
[0036] Furthermore, according to the detection rules set in the detection program, each Mapper object is executed in a loop. If there are no missing SQL statements, the execution process is normal; if there are missing SQL statements, an abnormal result will be returned and the Spring program will stop starting.
[0037] The above-mentioned method for preventing missing SQL provided by the present invention can execute a detection program when starting the Spring program, and detect whether there is missing SQL based on the Mapper object. If there is, the Spring program is stopped from starting, thereby avoiding program errors caused by missing SQL when the requirements are deployed.
[0038] In one implementation, for the aforementioned step S102, that is, when performing detection based on the Mapper object according to the detection rules set in the detection program, the following methods may be adopted, including but not limited to: performing a database query based on the Mapper object, and determining whether there is any missing SQL based on the database query results.
[0039] In practice, the selectList method of each Mapper object is executed in a loop. If there are no missing SQL statements, the first record of the actual table mapped by the Mapper object is obtained. If there are missing SQL statements, the SelectList method of the Mapper object cannot be executed, and the database returns an error detection result.
[0040] The code iterates through `MapperList` (the list of all Mapper objects), executing the `SelectList` method of each Mapper object with the parameter `limit 1`. Under normal circumstances, the code executes without exception and returns the first record in the actual table mapped to the Mapper object. However, if there is a missing SQL statement, the database will return an error indicating that the field was not added. The code will then throw an exception, which will continue to propagate upwards until the Spring application catches the exception and stops starting.
[0041] Example code is shown below:
[0042] for (BaseMapper baseMapper : mapperList) {
[0043] try {
[0044] baseMapper.selectList(new LambdaQueryWrapper<>().last("limit 1"));
[0045] } catch (Exception e) {
[0046] log.error("sql check fail", e);
[0047] throw e;
[0048] }
[0049] In one implementation, the method further includes generating an error log during the execution of the detection program to alert developers of any missing SQL statements.
[0050] In practice, Spring programs can execute a detection program at startup. If the detection fails, the Spring program will fail to start due to an execution exception and generate an error log. Developers can check the error log to find out if there is any missing SQL.
[0051] The method provided in this embodiment of the invention adds a detection program to the Spring program. When it detects a missing SQL statement, it can prevent the Spring program from starting and prompt the developers in the error log to indicate the missing SQL statement. This can prevent the program from crashing due to missing SQL statements when the requirements are deployed.
[0052] In addition to the SQL leakage detection method provided in the foregoing embodiments, this invention also provides a SQL leakage detection device, see [link to related document]. Figure 2The schematic diagram shown illustrates the structure of a detection device for preventing SQL leaks, indicating that the device mainly comprises the following parts:
[0053] The detection program startup module 201 is used to start a preset detection program when the Spring program starts;
[0054] The detection module 202 is used to obtain the Mapper object in the Spring program and perform detection based on the Mapper object according to the detection rules set in the detection program;
[0055] The result feedback module 203 is used to return an abnormal result and stop starting the Spring program if there is a missing SQL during the detection process.
[0056] The detection device for preventing missing SQL provided by the present invention can execute a detection program when starting the Spring program, and detect whether there is missing SQL based on the Mapper object. If there is, the Spring program is stopped from starting, thereby avoiding program errors caused by missing SQL when the requirements are deployed.
[0057] In one implementation, the detection program startup module 201 is specifically used to: obtain and start a preset detection program by calling the preset CommandLineRunner interface in the Spring program.
[0058] In one implementation, the detection module 202 is specifically used to: obtain the Mapper object in the Spring program through the Resource annotation of the Spring program.
[0059] In one implementation, the detection module 202 is specifically used to: perform a database query based on the Mapper object, and determine whether there are any missing SQL queries based on the database query results.
[0060] In one implementation, the detection module 202 is specifically used to: execute the selectList method of each Mapper object in a loop; if there is no missing SQL, the first record of the actual table mapped by the Mapper object is obtained; if there is missing SQL, the SelectList method of the Mapper object cannot be executed, and the database returns an abnormal detection result.
[0061] In one embodiment, the above apparatus further includes a logging module for generating an error log during the execution of the detection program to alert developers of missing SQL statements.
[0062] It should be noted that the device provided in the embodiments of the present invention has the same implementation principle and technical effect as the aforementioned method embodiments. For the sake of brevity, any parts not mentioned in the device embodiments can be referred to the corresponding content in the aforementioned method embodiments.
[0063] This invention also provides an electronic device, specifically, the electronic device includes a processor and a storage device; the storage device stores a computer program, and the computer program, when run by the processor, executes the method described in any of the above embodiments.
[0064] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. The electronic device 100 includes: a processor 30, a memory 31, a bus 32 and a communication interface 33. The processor 30, the communication interface 33 and the memory 31 are connected through the bus 32. The processor 30 is used to execute executable modules, such as computer programs, stored in the memory 31.
[0065] The memory 31 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 33 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.
[0066] Bus 32 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.
[0067] The memory 31 is used to store programs. After receiving an execution instruction, the processor 30 executes the program. The method executed by the device for defining the flow process disclosed in any of the foregoing embodiments of the present invention can be applied to the processor 30 or implemented by the processor 30.
[0068] Processor 30 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 30 or by instructions in software form. Processor 30 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 31. The processor 30 reads the information in memory 31 and, in conjunction with its hardware, completes the steps of the above method.
[0069] The computer program product of the readable storage medium provided in the embodiments of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the foregoing method embodiments. For specific implementation, please refer to the foregoing method embodiments, which will not be repeated here.
[0070] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0071] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A method for detecting missing SQL statements, characterized in that, include: When a Spring application starts, a pre-defined detection program is launched. Spring provides the CommandLineRunner interface, and by implementing the CommandLineRunner interface, the detection program is added. The Spring application executes the pre-defined detection program at startup. Obtain the Mapper object in the Spring program, and perform detection based on the Mapper object according to the detection rules set in the detection program; wherein, the Mapper object in the Spring program is obtained through the Resource annotation of the Spring program; If any missing SQL queries are detected during the detection process, an exception result is returned, and the Spring application stops starting. Specifically, the list of Mapper objects is looped through, and the `SelectList` method of each Mapper object is executed, with the parameter `limit 1`. Under normal circumstances, the code executes without exception and returns the first record of the actual table mapped by the Mapper object. If a missing SQL query is detected, because the database has not added the field, the database returns an error indicating that the field is missing. The code then throws an exception, which continues to propagate upwards until the Spring application catches the exception and stops starting. Database query operations are executed using try-catch blocks, where error logs are recorded, and the caught exception is immediately re-thrown using a `throw` statement. The re-thrown exception continues to propagate upwards until the Spring application catches the exception and stops starting. It also includes generating an error log during the execution of the detection program to alert developers to any missing SQL statements.
2. The method according to claim 1, characterized in that, Based on the Mapper object, detection is performed according to the detection rules set in the detection program, including: A database query is performed based on the Mapper object, and the database query results are used to determine whether there are any missing SQL statements.
3. The method according to claim 2, characterized in that, Perform database queries based on the Mapper object, and determine whether there are any missing SQL queries based on the database query results, including: The selectList method of each Mapper object is executed in a loop. If there are no missing SQL statements, then the first record of the actual table mapped by the Mapper object is obtained; If there are missing SQL statements, the SelectList method of the Mapper object cannot be executed, and the database returns an error result.
4. A detection device for preventing missing SQL statements, characterized in that, include: The detection program startup module is used to start the preset detection program when the Spring program starts; Spring provides the CommandLineRunner interface, and the detection program is added by implementing the CommandLineRunner interface. The Spring program executes the preset detection program when it starts. The detection module is used to obtain the Mapper object in the Spring program and perform detection based on the Mapper object according to the detection rules set in the detection program; wherein, the Mapper object in the Spring program is obtained through the Resource annotation of the Spring program; The result feedback module is used to return an exception and stop the Spring program if a missing SQL statement is found during the detection process. Specifically, it iterates through a list of Mapper objects, executing the `SelectList` method of each Mapper object with a `limit 1` parameter. Under normal circumstances, the code executes without exception and returns the first record of the actual table mapped by the Mapper object. If a missing SQL statement is found, the database returns an error message indicating that the field was not added, causing the code to throw an exception. This exception continues to propagate upwards until the Spring program catches the exception and stops starting. Database query operations are executed using try-catch blocks, which record error logs and immediately re-throw the caught exception using a `throw` statement. The re-thrown exception continues to propagate upwards until the Spring program catches the exception and stops starting. It also includes a logging module, which generates error logs during the execution of the detection program to alert developers to any missing SQL statements.
5. An electronic device, characterized in that, The method includes a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement the steps of the method according to any one of claims 1 to 3.
6. A computer-readable storage medium storing a computer program thereon, characterized in that, The computer program, when executed by a processor, performs the steps of the method described in any one of claims 1 to 3.