alibaba / druid

阿里云计算平台DataWorks(https://help.aliyun.com/document_detail/137663.html) 团队出品,为监控而生的数据库连接池
https://github.com/alibaba/druid/wiki
Apache License 2.0
27.94k stars 8.57k forks source link

postgres cte WITH RECURSIVE ParserException #3747

Closed chaizp closed 2 years ago

chaizp commented 4 years ago

maven:

<groupId>com.alibaba</groupId>
<artifactId>druid-spring-boot-starter</artifactId>
<version>1.1.21</version>

<groupId>org.postgresql</groupId>
<artifactId>postgresql</artifactId>
<version>9.4.1208</version>

postgres 版本:psql (PostgreSQL) 10.1 spring boot 1.5.6.RELEASE

异常信息:

Error querying database. Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'WITH RECURSIVE dept AS (

                SELEC', expect RPAREN, actual RECURSIVE pos 368, line 16, column 10, token RECURSIVE : SELECT
        DISTINCT u.ID AS id,
        u. NAME AS "policeName",
        u.pcard AS pcard,
        u.id_card AS "idCard",
        u.department as "departmentNum",
        d. NAME AS "departmentName",
        COALESCE(u.contact , '暂无') AS contact

    FROM t_user u 
    join t_department d on u.department = d.code
    LEFT JOIN t_user_dept ud on u.id = ud.user_id

        JOIN (
            WITH RECURSIVE dept AS (
                SELECT id, parent_id, code, name, alias, is_check
                FROM t_department
                WHERE visiable = 1 
                    AND code = ?
                UNION
                SELECT d.id, d.parent_id, d.code, d.name, d.alias, d.is_check
                FROM t_department d
                JOIN dept ON dept.parent_id = d.id
                WHERE d.visiable = 1
            )
            SELECT id, parent_id, code, name, alias, is_check 
            FROM dept
        ) ruledep ON ruledep.id = ud.dept_id

    WHERE u.visiable = 1 and d.visiable = 1 and u.state =1  and u.is_admin = 0

    ORDER BY id

The error may exist in cn/net/data/mapper/LowcaseMapper.xml

The error may involve cn.net.data.mapper.LowcaseMapper.queryUserList

The error occurred while executing a query

SQL: SELECT DISTINCT u.ID AS id, u. NAME AS "policeName", u.pcard AS pcard, u.id_card AS "idCard", u.department as "departmentNum", d. NAME AS "departmentName", COALESCE(u.contact , '暂无') AS contact FROM t_user u join t_department d on u.department = d.code LEFT JOIN t_user_dept ud on u.id = ud.user_id JOIN ( WITH RECURSIVE dept AS ( SELECT id, parent_id, code, name, alias, is_check FROM t_department WHERE visiable = 1 AND code = ? UNION SELECT d.id, d.parent_id, d.code, d.name, d.alias, d.is_check FROM t_department d JOIN dept ON dept.parent_id = d.id WHERE d.visiable = 1 ) SELECT id, parent_id, code, name, alias, is_check FROM dept ) ruledep ON ruledep.id = ud.dept_id WHERE u.visiable = 1 and d.visiable = 1 and u.state =1 and u.is_admin = 0 ORDER BY id

Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'WITH RECURSIVE dept AS (

                SELEC', expect RPAREN, actual RECURSIVE pos 368, line 16, column 10, token RECURSIVE : SELECT
        DISTINCT u.ID AS id,
        u. NAME AS "policeName",
        u.pcard AS pcard,
        u.id_card AS "idCard",
        u.department as "departmentNum",
        d. NAME AS "departmentName",
        COALESCE(u.contact , '暂无') AS contact

    FROM t_user u 
    join t_department d on u.department = d.code
    LEFT JOIN t_user_dept ud on u.id = ud.user_id

        JOIN (
            WITH RECURSIVE dept AS (
                SELECT id, parent_id, code, name, alias, is_check
                FROM t_department
                WHERE visiable = 1 
                    AND code = ?
                UNION
                SELECT d.id, d.parent_id, d.code, d.name, d.alias, d.is_check
                FROM t_department d
                JOIN dept ON dept.parent_id = d.id
                WHERE d.visiable = 1
            )
            SELECT id, parent_id, code, name, alias, is_check 
            FROM dept
        ) ruledep ON ruledep.id = ud.dept_id

    WHERE u.visiable = 1 and d.visiable = 1 and u.state =1  and u.is_admin = 0

    ORDER BY id

; uncategorized SQLException for SQL []; SQL state [null]; error code [0]; sql injection violation, syntax error: syntax error, error in :'WITH RECURSIVE dept AS ( SELEC', expect RPAREN, actual RECURSIVE pos 368, line 16, column 10, token RECURSIVE : SELECT DISTINCT u.ID AS id, u. NAME AS "policeName", u.pcard AS pcard, u.id_card AS "idCard", u.department as "departmentNum", d. NAME AS "departmentName", COALESCE(u.contact , '暂无') AS contact

    FROM t_user u 
    join t_department d on u.department = d.code
    LEFT JOIN t_user_dept ud on u.id = ud.user_id

        JOIN (
            WITH RECURSIVE dept AS (
                SELECT id, parent_id, code, name, alias, is_check
                FROM t_department
                WHERE visiable = 1 
                    AND code = ?
                UNION
                SELECT d.id, d.parent_id, d.code, d.name, d.alias, d.is_check
                FROM t_department d
                JOIN dept ON dept.parent_id = d.id
                WHERE d.visiable = 1
            )
            SELECT id, parent_id, code, name, alias, is_check 
            FROM dept
        ) ruledep ON ruledep.id = ud.dept_id

    WHERE u.visiable = 1 and d.visiable = 1 and u.state =1  and u.is_admin = 0

    ORDER BY id; nested exception is java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'WITH RECURSIVE dept AS (
                SELEC', expect RPAREN, actual RECURSIVE pos 368, line 16, column 10, token RECURSIVE : SELECT
        DISTINCT u.ID AS id,
        u. NAME AS "policeName",
        u.pcard AS pcard,
        u.id_card AS "idCard",
        u.department as "departmentNum",
        d. NAME AS "departmentName",
        COALESCE(u.contact , '暂无') AS contact

    FROM t_user u 
    join t_department d on u.department = d.code
    LEFT JOIN t_user_dept ud on u.id = ud.user_id

        JOIN (
            WITH RECURSIVE dept AS (
                SELECT id, parent_id, code, name, alias, is_check
                FROM t_department
                WHERE visiable = 1 
                    AND code = ?
                UNION
                SELECT d.id, d.parent_id, d.code, d.name, d.alias, d.is_check
                FROM t_department d
                JOIN dept ON dept.parent_id = d.id
                WHERE d.visiable = 1
            )
            SELECT id, parent_id, code, name, alias, is_check 
            FROM dept
        ) ruledep ON ruledep.id = ud.dept_id
    WHERE u.visiable = 1 and d.visiable = 1 and u.state =1  and u.is_admin = 0
    ORDER BY id] with root cause

com.alibaba.druid.sql.parser.ParserException: syntax error, error in :'WITH RECURSIVE dept AS ( SELEC', expect RPAREN, actual RECURSIVE pos 368, line 16, column 10, token RECURSIVE at com.alibaba.druid.sql.parser.SQLParser.printError(SQLParser.java:344) at com.alibaba.druid.sql.parser.SQLParser.accept(SQLParser.java:352) at com.alibaba.druid.sql.parser.SQLSelectParser.parseTableSourceRest(SQLSelectParser.java:1238) at com.alibaba.druid.sql.dialect.postgresql.parser.PGSelectParser.parseTableSourceRest(PGSelectParser.java:271) at com.alibaba.druid.sql.parser.SQLSelectParser.parseTableSourceRest(SQLSelectParser.java:1417) at com.alibaba.druid.sql.dialect.postgresql.parser.PGSelectParser.parseTableSourceRest(PGSelectParser.java:271) at com.alibaba.druid.sql.parser.SQLSelectParser.parseTableSourceRest(SQLSelectParser.java:1417) at com.alibaba.druid.sql.dialect.postgresql.parser.PGSelectParser.parseTableSourceRest(PGSelectParser.java:271) at com.alibaba.druid.sql.parser.SQLSelectParser.parseTableSourceRest(SQLSelectParser.java:1117) at com.alibaba.druid.sql.dialect.postgresql.parser.PGSelectParser.parseTableSourceRest(PGSelectParser.java:271) at com.alibaba.druid.sql.parser.SQLSelectParser.parseTableSource(SQLSelectParser.java:1055) at com.alibaba.druid.sql.parser.SQLSelectParser.parseFrom(SQLSelectParser.java:957) at com.alibaba.druid.sql.dialect.postgresql.parser.PGSelectParser.query(PGSelectParser.java:129) at com.alibaba.druid.sql.parser.SQLSelectParser.query(SQLSelectParser.java:362) at com.alibaba.druid.sql.parser.SQLSelectParser.select(SQLSelectParser.java:61) at com.alibaba.druid.sql.dialect.postgresql.parser.PGSQLStatementParser.parseSelect(PGSQLStatementParser.java:348) at com.alibaba.druid.sql.dialect.postgresql.parser.PGSQLStatementParser.parseSelect(PGSQLStatementParser.java:57) at com.alibaba.druid.sql.parser.SQLStatementParser.parseStatementList(SQLStatementParser.java:248) at com.alibaba.druid.sql.parser.SQLStatementParser.parseStatementList(SQLStatementParser.java:182) at com.alibaba.druid.wall.WallProvider.checkInternal(WallProvider.java:624) at com.alibaba.druid.wall.WallProvider.check(WallProvider.java:578) at com.alibaba.druid.wall.WallFilter.checkInternal(WallFilter.java:793) at com.alibaba.druid.wall.WallFilter.connection_prepareStatement(WallFilter.java:259) at com.alibaba.druid.filter.FilterChainImpl.connection_prepareStatement(FilterChainImpl.java:568) at com.alibaba.druid.proxy.jdbc.ConnectionProxyImpl.prepareStatement(ConnectionProxyImpl.java:341) at com.alibaba.druid.pool.DruidPooledConnection.prepareStatement(DruidPooledConnection.java:350) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.ibatis.logging.jdbc.ConnectionLogger.invoke(ConnectionLogger.java:55) at com.sun.proxy.$Proxy193.prepareStatement(Unknown Source) at org.apache.ibatis.executor.statement.PreparedStatementHandler.instantiateStatement(PreparedStatementHandler.java:87) at org.apache.ibatis.executor.statement.BaseStatementHandler.prepare(BaseStatementHandler.java:88) at org.apache.ibatis.executor.statement.RoutingStatementHandler.prepare(RoutingStatementHandler.java:59) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.ibatis.plugin.Invocation.proceed(Invocation.java:49) at cn.net.plugin.PagePlugin.intercept(PagePlugin.java:119) at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61) at com.sun.proxy.$Proxy192.prepare(Unknown Source) at org.apache.ibatis.executor.SimpleExecutor.prepareStatement(SimpleExecutor.java:85) at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:62) at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:324) at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:156) at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:109) at org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:83) at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:148) at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:141) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:433) at com.sun.proxy.$Proxy103.selectList(Unknown Source) at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:230) at org.apache.ibatis.binding.MapperMethod.executeForMany(MapperMethod.java:137) at org.apache.ibatis.binding.MapperMethod.execute(MapperMethod.java:75) at org.apache.ibatis.binding.MapperProxy.invoke(MapperProxy.java:59) at com.sun.proxy.$Proxy137.queryUserList(Unknown Source) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:136) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at com.sun.proxy.$Proxy138.queryUserList(Unknown Source) at cn.net.data.service.imple.LowcaseServiceImple.queryUserList(LowcaseServiceImple.java:73) at cn.net.data.controller.LowcaseController.getUserByDept(LowcaseController.java:190) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133) at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97) at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827) at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738) at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872) at javax.servlet.http.HttpServlet.service(HttpServlet.java:661) at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at cn.net.data.filter.SessionFilter.doFilterInternal(SessionFilter.java:79) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at cn.net.data.filter.CorsFilter.doFilter(CorsFilter.java:19) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.alibaba.druid.support.http.WebStatFilter.doFilter(WebStatFilter.java:124) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:208) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:105) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:745)

Ivan-kitty commented 4 years ago

不支持这个语法吧,