springboot代码审计学习-newbeemall审计

server.port=8089
spring.datasource.url=jdbc:mysql://localhost:3306/newbee_mall_db?...

public void addResourceHandlers(ResourceHandlerRegistry registry) {
	registry.addResourceHandler("/upload/**").addResourceLocations("file:" + Constants.FILE_UPLOAD_DIC);
	registry.addResourceHandler("/goods-img/**").addResourceLocations("file:" + Constants.FILE_UPLOAD_DIC);
}

public class Constants {
	//上传文件的默认url前缀，根据部署设置自行修改
	public final static String FILE_UPLOAD_DIC = "/some_path/src/main/resources/upload/";
	//public final static String FILE_UPLOAD_DIC = "D:\\upload\\";//上传文件的默认url前缀，根据部署设置自行修改
}

docker cp ./newbee_mall_schema.sql container_id:/root

root:/# mysql -u root -p
mysql> create database newbee_mall_db；
mysql> exit

root:/# mysql -u root -p newbee_mall_db</root/newbee_mall_schema.sql

### The error may involve ltd.newbee.mall.dao.NewBeeMallGoodsMapper.findNewBeeMallGoodsListBySearch-Inline
### The error occurred while setting parameters
### SQL: select               goods_id, goods_name, goods_intro,goods_category_id, goods_cover_img, goods_carousel, original_price,     selling_price, stock_num, tag, goods_sell_status, create_user, create_time, update_user,      update_time             from tb_newbee_mall_goods_info          WHERE  (goods_name like CONCAT('%','1'','%') or goods_intro like CONCAT('%','1'','%'))                                  limit ?,?
### Cause: java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1'','%')) 
            limit 0,10' at line 8
; bad SQL grammar []; nested exception is java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1'','%')) 
            limit 0,10' at line 8] with root cause
java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1'','%'))

前言

环境搭建

基础配置

数据库配置

启动项目

springboot项目结构

SQL注入