build.gradle

@@ -67,7 +67,7 @@ ext {
         //code generator
         "velocity"            : "org.apache.velocity:velocity-engine-core:2.3",
         "freemarker"          : "org.freemarker:freemarker:2.3.33",
-        "beetl"               : "com.ibeetl:beetl:3.16.2.RELEASE",
+        "beetl"               : "com.ibeetl:beetl:3.17.0.RELEASE",
         "swagger-annotations" : "io.swagger:swagger-annotations:1.6.14",
         "enjoy"               : "com.jfinal:enjoy:5.1.3",
         "logback-classic"     : "ch.qos.logback:logback-classic:1.5.6",

changelog-temp.md

@@ -3,6 +3,7 @@
 - fix: 修复逻辑删除填充与乐观锁冲突
 - fix: 修复IllegalSQLInnerInterceptor分析嵌套count语句错误
 - fix: 升级jsqlParser5.0解决 for update 语句错误
+- fix: 修复处自增自减负数情况导致jsqlParser解析优化错误
 - opt: Page属性访问调整为private,重写toString方法
 - opt: 主键生成策略(uuid)不支持的类型打印警告日志
 - opt: MybatisPlusException转化为PersistenceException子类
@@ -14,6 +15,7 @@
 - feat: 升级kotlin2.0.0
 - feat: 升级SpringBoot3.3.2
 - feat: 升级fastjson2.0.52
+- feat: 升级mybatis-spring3.0.4
 - feat: 升级spring-cloud-commons4.1.4
 - feat: 部分支持依赖升级更新
 - feat: 支持GoldenDB数据库

mybatis-plus-core/src/main/java/com/baomidou/mybatisplus/core/toolkit/sql/SqlInjectionUtils.java

@@ -29,7 +29,8 @@ public class SqlInjectionUtils {
      * SQL语法检查正则：符合两个关键字（有先后顺序）才算匹配
      */
     private static final Pattern SQL_SYNTAX_PATTERN = Pattern.compile("(insert|delete|update|select|create|drop|truncate|grant|alter|deny|revoke|call|execute|exec|declare|show|rename|set)" +
-        "\\s+.*(into|from|set|where|table|database|view|index|on|cursor|procedure|trigger|for|password|union|and|or)|(select\\s*\\*\\s*from\\s+)|(and|or)\\s+.*", Pattern.CASE_INSENSITIVE);
+        "\\s+.*(into|from|set|where|table|database|view|index|on|cursor|procedure|trigger|for|password|union|and|or)|(select\\s*\\*\\s*from\\s+)" +
+        "|if\\s*\\(.*\\)|select\\s*\\(.*\\)|substr\\s*\\(.*\\)|substring\\s*\\(.*\\)|char\\s*\\(.*\\)|concat\\s*\\(.*\\)|benchmark\\s*\\(.*\\)|sleep\\s*\\(.*\\)|(and|or)\\s+.*", Pattern.CASE_INSENSITIVE);
     /**
      * 使用'、;或注释截断SQL检查正则
      */
@@ -52,7 +53,6 @@ public class SqlInjectionUtils {
      * 刪除字段转义符单引号双引号
      *
      * @param text 待处理字段
-     * @return
      */
     public static String removeEscapeCharacter(String text) {
         Objects.nonNull(text);

mybatis-plus-core/src/test/java/com/baomidou/mybatisplus/core/toolkit/sql/SqlInjectionUtilsTest.java

@@ -9,10 +9,10 @@ import org.junit.jupiter.api.Test;
  * @author hubin
  * @since 2021-08-15
  */
- class SqlInjectionUtilsTest {
+class SqlInjectionUtilsTest {
 
     @Test
-     void sqlTest() {
+    void sqlTest() {
         assertSql(false, "insert abc");
         assertSql(true, "insert into user (id,name) value (1, 'qm')");
         assertSql(true, "SELECT * FROM user");
@@ -52,14 +52,33 @@ import org.junit.jupiter.api.Test;
         assertSql(false, "drop");
         assertSql(true, "AND age not in (1,2,3)");
         assertSql(true, "and age <> 1");
-        assertSql(false,"ORDER BY field(status,'SUCCESS','FAILED','CLOSED')");
-        assertSql(true,"ORDER BY id,'SUCCESS',''-- FAILED','CLOSED'");
+        assertSql(false, "ORDER BY field(status,'SUCCESS','FAILED','CLOSED')");
+        assertSql(true, "ORDER BY id,'SUCCESS',''-- FAILED','CLOSED'");
         assertSql(true, "or 1 = 1");
         assertSql(true, "and 1 = 1");
         assertSql(true, "hi = 1 or abc");
         assertSql(true, "(hi = 1) and abc");
         assertSql(false, "orAnd");
         assertSql(false, "andOr");
+        assertSql(false, "andOr");
+
+        // 函数验证
+        assertSql(true, "if(2=2)");
+        assertSql(false, "if");
+        assertSql(true, "SUBSTR(name)");
+        assertSql(true, "substr(name)");
+        assertSql(true, "suBStr(name)");
+        assertSql(false, "suBStr");
+        assertSql(true, "SUBSTRING(name)");
+        assertSql(true, "CHAR(name)");
+        assertSql(true, "char(name)");
+        assertSql(true, "concat(name, '0')");
+        assertSql(false, "concat");
+        assertSql(true, "select(table_name) from info");
+        assertSql(true, ",sleep(0.01)");
+        assertSql(false, ",sleep");
+        assertSql(true, "DBMS_LOCK.sleep(0.01)");
+        assertSql(true, "1=1&&(if(substr((select(table_name) from information_schema.TABLES WHERE table_schema=database() limit 0,1),1,1)!='a',sleep(0.01),2))");
     }
 
     private void assertSql(boolean injection, String sql) {

settings.gradle

@@ -9,7 +9,7 @@ buildscript {
     dependencies {
         //noinspection DifferentKotlinGradleVersion
         classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:2.0.10"
-        classpath "io.freefair.gradle:lombok-plugin:8.6"
+        classpath "io.freefair.gradle:lombok-plugin:8.7.1"
         classpath "tech.yanand.maven-central-publish:tech.yanand.maven-central-publish.gradle.plugin:1.1.1"
     }
 }

spring-boot-starter/mybatis-plus-spring-boot3-starter/build.gradle

@@ -4,7 +4,7 @@ compileJava {
 
 dependencies {
     api project(":mybatis-plus")
-    api "org.mybatis:mybatis-spring:3.0.3"
+    api "org.mybatis:mybatis-spring:3.0.4"
     api project(":spring-boot-starter:mybatis-plus-spring-boot-autoconfigure")
     implementation platform("org.springframework.boot:spring-boot-dependencies:${springBoot3Version}")
     annotationProcessor "org.springframework.boot:spring-boot-autoconfigure-processor:${springBoot3Version}"

spring-boot-starter/mybatis-plus-spring-boot3-starter/src/test/java/com/baomidou/mybatisplus/test/pom/GeneratePomTest.java

@@ -61,7 +61,7 @@ class GeneratePomTest {
             Assertions.assertEquals("import", bom.getScope());
             Assertions.assertFalse(bom.isOptional());
             Assertions.assertEquals(dependenciesMap.get("spring-cloud-commons").getVersion(), "4.1.4");
-            Assertions.assertEquals(dependenciesMap.get("mybatis-spring").getVersion(), "3.0.3");
+            Assertions.assertEquals(dependenciesMap.get("mybatis-spring").getVersion(), "3.0.4");
             Assertions.assertEquals(dependenciesMap.get("spring-boot-dependencies").getVersion(), "3.3.2");
         }
     }