Server:同步eclipse版至idea版

APIJSON-Java-Server/APIJSON-Idea/APIJSONLibrary/src/main/java/zuo/biao/apijson/JSONObject.java

@@ -84,8 +84,10 @@ public static boolean isTableKey(String key) {
 	//JSONObject内关键词 key <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 
 
-	public static final String KEY_ID = "id";
-	public static final String KEY_ID_IN = KEY_ID + "{}";
+	public static String KEY_ID = "id";
+	public static String KEY_ID_IN = KEY_ID + "{}";
+	public static String KEY_USER_ID = "userId";
+	public static String KEY_USER_ID_IN = KEY_USER_ID + "{}";
 
 	/**set "id":id in Table layer
 	 * @param id
@@ -94,13 +96,28 @@ public static boolean isTableKey(String key) {
 	public JSONObject setId(Long id) {
 		return puts(KEY_ID, id);
 	}
-	/**set id{}:[] in Table layer
+	/**set "id{}":[] in Table layer
 	 * @param list
 	 * @return
 	 */
 	public JSONObject setIdIn(List<Object> list) {
 		return puts(KEY_ID_IN, list);
 	}
+
+	/**set "userId":userId in Table layer
+	 * @param id
+	 * @return
+	 */
+	public JSONObject setUserId(Long id) {
+		return puts(KEY_USER_ID, id);
+	}
+	/**set "userId{}":[] in Table layer
+	 * @param list
+	 * @return
+	 */
+	public JSONObject setUserIdIn(List<Object> list) {
+		return puts(KEY_USER_ID_IN, list);
+	}
 
 
 	//@key关键字都放这个类 <<<<<<<<<<<<<<<<<<<<<<

APIJSON-Java-Server/APIJSON-Idea/APIJSONLibrary/src/main/java/zuo/biao/apijson/JSONResponse.java

@@ -67,8 +67,6 @@ public JSONResponse(JSONObject object) {
 
 	public static final String KEY_CODE = "code";
 	public static final String KEY_MSG = "msg";
-	public static final String KEY_ID = "id";
-	public static final String KEY_ID_IN = KEY_ID + "{}";
 	public static final String KEY_COUNT = "count";
 	public static final String KEY_TOTAL = "total";
 

APIJSON-Java-Server/APIJSON-Idea/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractObjectParser.java

@@ -136,10 +136,10 @@ public AbstractObjectParser(@NotNull JSONObject request, String parentPath, Stri
 	 */
 	@Override
 	public AbstractObjectParser parseCorrect() throws Exception {
-		Set<String> set = correct == null ? null : new HashSet<String>(correct.keySet());
+		Set<String> set = correct == null ? null : new HashSet<>(correct.keySet());
 
 		if (set != null && set.isEmpty() == false) {//对每个需要校正的key进行正则表达式匹配校正
-			corrected = new HashMap<String, String>();//TODO 返回全部correct内的内容，包括未校正的?  correct);
+			corrected = new HashMap<>();//TODO 返回全部correct内的内容，包括未校正的?  correct);
 
 			String value; //13000082001
 			String v; // phone,email,idCard

APIJSON-Java-Server/APIJSON-Idea/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractSQLConfig.java

@@ -21,6 +21,8 @@
 import static zuo.biao.apijson.JSONObject.KEY_HAVING;
 import static zuo.biao.apijson.JSONObject.KEY_ID;
 import static zuo.biao.apijson.JSONObject.KEY_ID_IN;
+import static zuo.biao.apijson.JSONObject.KEY_USER_ID;
+import static zuo.biao.apijson.JSONObject.KEY_USER_ID_IN;
 import static zuo.biao.apijson.JSONObject.KEY_ORDER;
 import static zuo.biao.apijson.JSONObject.KEY_ROLE;
 import static zuo.biao.apijson.JSONObject.KEY_SCHEMA;
@@ -39,6 +41,7 @@
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Map.Entry;
 import java.util.Set;
 
 import com.alibaba.fastjson.JSON;
@@ -511,16 +514,35 @@ public String getWhereString() throws Exception {
 	 * @throws Exception 
 	 */
 	public static String getWhereString(RequestMethod method, Map<String, Object> where, boolean verifyName) throws Exception {
-		Set<String> set = where == null ? null : where.keySet();
-		if (set == null || set.isEmpty()) {
+		Map<String, Object> where2 = where == null || where.isEmpty() ? null : new LinkedHashMap<String, Object>();
+		if (where2 == null) {
 			return "";
 		}
-		String whereString = "";
+
+		//强制排序，把id,id{},userId,userId{}放最前面，保证安全、优化性能
+		Object id = where.remove(KEY_ID);
+		Object idIn = where.remove(KEY_ID_IN);
+		Object userId = where.remove(KEY_USER_ID);
+		Object userIdIn = where.remove(KEY_USER_ID_IN);
+
+		where2.put(KEY_ID, id);
+		where2.put(KEY_ID_IN, idIn);
+		where2.put(KEY_USER_ID, userId);
+		where2.put(KEY_USER_ID_IN, userIdIn);
+		where2.putAll(where);
+
+
+		Set<Entry<String, Object>> set = where2.entrySet();
+
 		boolean isFirst = true;
-
 		String condition;
-		for (String key : set) {
-			condition = getWhereItem(key, where.get(key), method, verifyName);
+		String whereString = "";
+
+		for (Entry<String, Object> entry : set) {
+			if (entry == null) {
+				continue;
+			}
+			condition = getWhereItem(entry.getKey(), entry.getValue(), method, verifyName);
 
 			if (StringUtil.isEmpty(condition, true)) {//避免SQL条件连接错误
 				continue;
@@ -530,6 +552,12 @@ public static String getWhereString(RequestMethod method, Map<String, Object> wh
 
 			isFirst = false;
 		}
+
+		//还原where，后续可能用到
+		where.put(KEY_ID, id);
+		where.put(KEY_ID_IN, idIn);
+		where.put(KEY_USER_ID, userId);
+		where.put(KEY_USER_ID_IN, userIdIn);
 
 		String s = whereString.isEmpty() ? "" : " WHERE " + whereString;
 
@@ -1041,8 +1069,7 @@ public static AbstractSQLConfig newSQLConfig(RequestMethod method, String table,
 		}
 		AbstractSQLConfig config = callback.getSQLConfig(method, table);
 
-		boolean isEmpty = request.isEmpty();
-		if (isEmpty) { // User:{} 这种空内容在查询时也有效
+		if (request.isEmpty()) { // User:{} 这种空内容在查询时也有效
 			return config; //request.remove(key); 前都可以直接return，之后必须保证 put 回去
 		}
 

APIJSON-Java-Server/APIJSON-Idea/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractSQLExecutor.java

@@ -148,7 +148,7 @@ public JSONObject execute(SQLConfig config) throws Exception {
 			result = AbstractParser.newResult(updateCount > 0 ? JSONResponse.CODE_SUCCESS : JSONResponse.CODE_NOT_FOUND
 					, updateCount > 0 ? JSONResponse.MSG_SUCCEED : "可能对象不存在！");
 
-			//id或id{}一定有，一定会返回，不用抛异常来阻止关联写操作时前面错误导致后面无条件执行！
+			//id,id{}至少一个会有，一定会返回，不用抛异常来阻止关联写操作时前面错误导致后面无条件执行！
 			if (config.getId() > 0) {
 				result.put(JSONResponse.KEY_ID, config.getId());
 			} else {

APIJSON-Java-Server/APIJSON-Idea/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractVerifier.java

@@ -78,7 +78,7 @@ public static HashMap<RequestMethod, RequestRole[]> getAccessMap(MethodAccess ac
 			return null;
 		}
 
-		HashMap<RequestMethod, RequestRole[]> map = new HashMap<RequestMethod, RequestRole[]>();
+		HashMap<RequestMethod, RequestRole[]> map = new HashMap<>();
 		map.put(GET, access.GET());
 		map.put(HEAD, access.HEAD());
 		map.put(GETS, access.GETS());

APIJSON-Java-Server/APIJSON-Idea/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/Structure.java

@@ -15,7 +15,7 @@
 package zuo.biao.apijson.server;
 
 import static zuo.biao.apijson.JSONObject.KEY_ID;
-import static zuo.biao.apijson.JSONObject.KEY_ID_IN;
+import static zuo.biao.apijson.JSONObject.KEY_USER_ID;
 import static zuo.biao.apijson.server.Operation.ADD;
 import static zuo.biao.apijson.server.Operation.DISALLOW;
 import static zuo.biao.apijson.server.Operation.NECESSARY;
@@ -82,7 +82,6 @@ public static JSONObject parseRequest(@NotNull final RequestMethod method, final
 			return null;
 		}
 
-		//TODO globleRole要不要改成@role?  只允许服务端Request表中加上可控的ADMIN角色
 		if (RequestRole.get(request.getString(JSONRequest.KEY_ROLE)) == RequestRole.ADMIN) {
 			throw new IllegalArgumentException("角色设置错误！不允许在写操作Request中传 " + name + 
 					":{ " + JSONRequest.KEY_ROLE + ":admin } ！");
@@ -105,29 +104,8 @@ public JSONObject onParseJSONObject(String key, JSONObject tobj, JSONObject robj
 						}
 					} else {
 						if (RequestMethod.isQueryMethod(method) == false) {
-							//单个修改或删除
-							Object id = robj.get(KEY_ID); //如果必须传 id ，可在Request表中配置necessary
-							if (id != null) {
-								if (id instanceof Number == false) {
-									throw new IllegalArgumentException(method.name() + "请求，" + name + "/" + key
-											+ " 里面的 " + KEY_ID + ":value 中value的类型只能是Long！");
-								}
-							} else {
-								//批量修改或删除
-								Object arr = robj.get(KEY_ID_IN); //如果必须传 id{} ，可在Request表中配置necessary
-								if (arr == null) {
-									throw new IllegalArgumentException(method.name() + "请求，" + name + "/" + key
-											+ " 里面 " + KEY_ID + " 和 " + KEY_ID_IN + " 必须传其中一个！");
-								}
-								if (arr instanceof JSONArray == false) {
-									throw new IllegalArgumentException(method.name() + "请求，" + name + "/" + key
-											+ " 里面的 " + KEY_ID_IN + ":value 中value的类型只能是 [Long] ！");
-								}
-								if (((JSONArray)arr).size() > 10) { //不允许一次操作10条以上记录
-									throw new IllegalArgumentException(method.name() + "请求，" + name + "/" + key
-											+ " 里面的 " + KEY_ID_IN + ":[] 中[]的长度不能超过10！");
-								}
-							}
+							verifyId(method.name(), name, key, robj, KEY_ID, true);
+							verifyId(method.name(), name, key, robj, KEY_USER_ID, false);
 						}
 					}
 				} 
@@ -137,8 +115,61 @@ public JSONObject onParseJSONObject(String key, JSONObject tobj, JSONObject robj
 		});
 
 	}
+
+	/**
+	 * @param method
+	 * @param name
+	 * @param key
+	 * @param robj
+	 * @param idKey
+	 * @param atLeastOne 至少有一个不为null
+	 */
+	private static void verifyId(@NotNull String method, @NotNull String name, @NotNull String key
+			, @NotNull JSONObject robj, @NotNull String idKey, boolean atLeastOne) {
+		//单个修改或删除
+		Object id = null;
+		try {
+			id = robj.getLong(idKey); //如果必须传 id ，可在Request表中配置NECESSARY
+		} catch (Exception e) {
+			throw new IllegalArgumentException(method + "请求，" + name + "/" + key
+					+ " 里面的 " + idKey + ":value 中value的类型只能是 Long ！");
+		}
+
+		//批量修改或删除
+		String idInKey = idKey + "{}";
+
+		JSONArray idIn = null;
+		try {
+			idIn = robj.getJSONArray(idInKey); //如果必须传 id{} ，可在Request表中配置NECESSARY
+		} catch (Exception e) {
+			throw new IllegalArgumentException(method + "请求，" + name + "/" + key
+					+ " 里面的 " + idInKey + ":value 中value的类型只能是 [Long] ！");
+		}
+		if (idIn == null) {
+			if (atLeastOne && id == null) {
+				throw new IllegalArgumentException(method + "请求，" + name + "/" + key
+						+ " 里面 " + idKey + " 和 " + idInKey + " 至少传其中一个！");
+			}
+		} else {
+			if (idIn.size() > 10) { //不允许一次操作10条以上记录
+				throw new IllegalArgumentException(method + "请求，" + name + "/" + key
+						+ " 里面的 " + idInKey + ":[] 中[]的长度不能超过10！");
+			}
+			//解决 id{}: ["1' OR 1='1'))--"] 绕过id{}限制
+			//new ArrayList<Long>(idIn) 不能检查类型，Java泛型擦除问题，居然能把 ["a"] 赋值进去还不报错
+			for (int i = 0; i < idIn.size(); i++) {
+				try {
+					idIn.getLong(i);
+				} catch (Exception e) {
+					throw new IllegalArgumentException(method + "请求，" + name + "/" + key
+							+ " 里面的 " + idInKey + ":[] 中所有项的类型都只能是Long！");
+				}
+			}
+		}
+	}
 
 
+
 	/**校验并将response转换为指定的内容和结构
 	 * @param method
 	 * @param name
@@ -229,7 +260,7 @@ public static JSONObject parse(String name, JSONObject target, JSONObject real
 
 		//解析内容<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 
-		Set<Entry<String, Object>> set = new LinkedHashSet<Entry<String, Object>>(target.entrySet());
+		Set<Entry<String, Object>> set = new LinkedHashSet<>(target.entrySet());
 		if (set.isEmpty() == false) {
 
 			String key;
@@ -350,7 +381,7 @@ private static JSONObject operate(Operation opt, JSONObject targetChild, JSONObj
 		}
 
 
-		Set<Entry<String, Object>> set = new LinkedHashSet<Entry<String, Object>>(targetChild.entrySet());
+		Set<Entry<String, Object>> set = new LinkedHashSet<>(targetChild.entrySet());
 		String tk;
 		Object tv;
 
@@ -537,8 +568,8 @@ private static void sqlVerify(@NotNull String funChar, @NotNull JSONObject real,
 			throw new IllegalArgumentException(rk + ":" + rv + "中value不合法！必须匹配 " + logic.getChar() + tv + " ！");
 		}		
 	}
-	
-	
+
+
 	/**验证是否重复
 	 * @param table
 	 * @param key
@@ -568,16 +599,16 @@ public static void verifyRepeat(String table, String key, Object value, long exc
 		if (exceptId > 0) {//允许修改自己的属性为该属性原来的值
 			request.put(JSONRequest.KEY_ID + "!", exceptId);
 		}
-//		JSONObject repeat = new AbstractParser(HEAD, true).parseResponse(
-//				new JSONRequest(table, request)
-//				);
-//		repeat = repeat == null ? null : repeat.getJSONObject(table);
-//		if (repeat == null) {
-//			throw new Exception("服务器内部错误  verifyRepeat  repeat == null");
-//		}
-//		if (repeat.getIntValue(JSONResponse.KEY_COUNT) > 0) {
-//			throw new ConflictException(key + ": " + value + " 已经存在，不能重复！");
-//		}
+		//		JSONObject repeat = new AbstractParser(HEAD, true).parseResponse(
+		//				new JSONRequest(table, request)
+		//				);
+		//		repeat = repeat == null ? null : repeat.getJSONObject(table);
+		//		if (repeat == null) {
+		//			throw new Exception("服务器内部错误  verifyRepeat  repeat == null");
+		//		}
+		//		if (repeat.getIntValue(JSONResponse.KEY_COUNT) > 0) {
+		//			throw new ConflictException(key + ": " + value + " 已经存在，不能重复！");
+		//		}
 	}