Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

为什么限制在GETS中使用@combine #425

Closed
aldag opened this issue Jul 22, 2022 · 4 comments
Closed

为什么限制在GETS中使用@combine #425

aldag opened this issue Jul 22, 2022 · 4 comments
Labels
help wanted 请求帮助 Question 使用问题 使用问题

Comments

@aldag
Copy link

aldag commented Jul 22, 2022

在GETS请求中使用@combine时得到了这样的提示:
"msg": "StandardAdvice:{} 里的 @combine:value 不合法!DELETE,GETS,HEADS 请求不允许传 @combine:value !"
查代码发现,这个检查逻辑是硬编码在AbstractSQLConfig类中的。

为什么在这些类型的请求中限制@combine的使用呢?

@aldag aldag changed the title combine的限制 为什么限制在GETS中使用@combine Jul 22, 2022
@TommyLemon
Copy link
Collaborator

防止前端传参越权操作,例如把后端设置的条件 AND 连接改为 OR 连接

@TommyLemon TommyLemon added the Question 使用问题 使用问题 label Jul 22, 2022
@aldag
Copy link
Author

aldag commented Jul 22, 2022

防止前端传参越权操作,例如把后端设置的条件 AND 连接改为 OR 连接

有些业务场景需要OR连接的查询。在AbstractSQLConfig做检查,后端也无法添加@combine,检查点能否前移呢?

@TommyLemon
Copy link
Collaborator

TommyLemon commented Jul 22, 2022

可以的,把 AbstractSQLConfig 里的检查移到 AbstractVerifier,判断 JSONRequest.KEY_COMBINE.equals(rk) 就抛异常
https://github.com/Tencent/APIJSON/blob/master/APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java#L1006
image

这样就可以实现前端不能传,但后端能在 Request 表指定 @combine

@TommyLemon
Copy link
Collaborator

TommyLemon commented Feb 16, 2023

@aldag
6.0.0 已支持后端在 Request 表中为 GETS/PUT/DELTE 的请求配置 @combine,感谢 @cloudAndMonkey 的贡献
#493

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted 请求帮助 Question 使用问题 使用问题
Projects
None yet
Development

No branches or pull requests

2 participants