java.sql.SQLException: violation d'injection sql, nier objet: dbms_random

Question

Comme le titre, je reçois un SQLException quand j'utilise la fonction dbms_random comme ceci:

SELECT DBMS_RANDOM.value(1, 100) AS datas FROM dual 

mais le SQL est exécuté correctement dans PL/SQL . En outre, le pool de connexion que j'utilise est Druide.

pile d'exception comme suit:

15-Sep-2014 11:02:04.397 SEVERE [http-apr-8080-exec-7] com.jfinal.core.ActionHandler.error /chart/tableData?QUERY_ID=16 
com.jfinal.plugin.activerecord.ActiveRecordException: java.sql.SQLException: sql injection violation, deny object : dbms_random : select distinct (a.demand_id) as demand_id, a.demand_title as demand_title, f.product_version_id, h.name, to_char(a.qa_time, 'yyyy-mm-dd') as qa_time, e.op_name as op_name, dbms_random.value(1, 100) as datas from demand_request a, assignment b, group_op_info d, op_login e, product_version f, project g, province h where a.demand_id = b.demand_id and b.closer_id = d.op_id and d.op_id = e.op_id and a.project_code = g.proj_code and g.area_id = h.id 
    at com.jfinal.plugin.activerecord.DbPro.find(DbPro.java:323) 
    at com.jfinal.plugin.activerecord.DbPro.find(DbPro.java:334) 
    at com.jfinal.plugin.activerecord.Db.find(Db.java:233) 
    at com.qms.db.chart.ChartController.tableData(ChartController.java:23) 
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:483) 
    at com.jfinal.core.ActionInvocation.invoke(ActionInvocation.java:55) 
    at com.jfinal.core.ActionHandler.handle(ActionHandler.java:73) 
    at com.jfinal.core.JFinalFilter.doFilter(JFinalFilter.java:72) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) 
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) 
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) 
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504) 
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) 
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) 
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610) 
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) 
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:534) 
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1081) 
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:658) 
    at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:277) 
    at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2381) 
    at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2370) 
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
    at java.lang.Thread.run(Thread.java:745) 
Caused by: java.sql.SQLException: sql injection violation, deny object : dbms_random : select distinct (a.demand_id) as demand_id, a.demand_title as demand_title, f.product_version_id, h.name, to_char(a.qa_time, 'yyyy-mm-dd') as qa_time, e.op_name as op_name, dbms_random.value(1, 100) as datas from demand_request a, assignment b, group_op_info d, op_login e, product_version f, project g, province h where a.demand_id = b.demand_id and b.closer_id = d.op_id and d.op_id = e.op_id and a.project_code = g.proj_code and g.area_id = h.id 
    at com.alibaba.druid.wall.WallFilter.check(WallFilter.java:714) 
    at com.alibaba.druid.wall.WallFilter.connection_prepareStatement(WallFilter.java:240) 
    at com.alibaba.druid.filter.FilterChainImpl.connection_prepareStatement(FilterChainImpl.java:448) 
    at com.alibaba.druid.proxy.jdbc.ConnectionProxyImpl.prepareStatement(ConnectionProxyImpl.java:342) 
    at com.alibaba.druid.pool.DruidPooledConnection.prepareStatement(DruidPooledConnection.java:311) 
    at com.jfinal.plugin.activerecord.DbPro.find(DbPro.java:306) 
    at com.jfinal.plugin.activerecord.DbPro.find(DbPro.java:321) 
    ... 29 more 

Answer 1

Druide semble que le Causion. Alors, vérifiez le document Druid.

Druid WallFilter

Ensuite, changer ma configuration de druide et résoudre le problème.

WallConfig wallConfig = new WallConfig(); 
wallConfig.setFunctionCheck(false); 
wall.setConfig(wallConfig);