|
|
@@ -164,10 +164,8 @@ class GovernTableToolTest {
|
|
|
spec.conditionRun = "XOR";
|
|
|
spec.conditions = List.of(cond("personCardNo", "=", "x"));
|
|
|
assertTrue(text(tool.queryTableData(spec)).contains("conditionRun"));
|
|
|
- // 排序列注入
|
|
|
- spec = baseSpec();
|
|
|
- spec.orderKey = "id; delete from trans_record";
|
|
|
- assertTrue(text(tool.queryTableData(spec)).contains("非法排序列"));
|
|
|
+ // 排序列注入:QuerySpec 已不暴露 orderKey/asc(排序整链下线,注入面随之消失),
|
|
|
+ // 原用例删除;若未来恢复排序,必须连同服务端的白名单校验一起恢复
|
|
|
}
|
|
|
|
|
|
// ==================== 查询 ====================
|
|
|
@@ -187,8 +185,6 @@ class GovernTableToolTest {
|
|
|
spec.conditions = List.of(cond("personCardNo", "=", "O'Brien"),
|
|
|
cond("transAmount", ">=", "100"));
|
|
|
spec.conditionRun = "AND";
|
|
|
- spec.orderKey = "transDate";
|
|
|
- spec.asc = true;
|
|
|
|
|
|
ToolResultBlock result = tool.queryTableData(spec);
|
|
|
assertEquals(ToolResultState.SUCCESS, result.getState(), text(result));
|
|
|
@@ -199,8 +195,6 @@ class GovernTableToolTest {
|
|
|
assertEquals("trans_record", dto.getTableName());
|
|
|
assertEquals(1, dto.getPage());
|
|
|
assertEquals(Integer.MAX_VALUE, dto.getLimit(), "默认 max-rows=0:全量导出不限条数");
|
|
|
- assertEquals("transDate", dto.getOrderKey());
|
|
|
- assertTrue(dto.hasAsc());
|
|
|
assertNotNull(dto.getConditionSql());
|
|
|
assertEquals("AND", dto.getConditionSql().getConditionRun());
|
|
|
assertEquals(2, dto.getConditionSql().getConditions().size());
|