-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
为什么限制在GETS中使用@combine #425
Comments
防止前端传参越权操作,例如把后端设置的条件 AND 连接改为 OR 连接 |
有些业务场景需要OR连接的查询。在AbstractSQLConfig做检查,后端也无法添加@combine,检查点能否前移呢? |
可以的,把 AbstractSQLConfig 里的检查移到 AbstractVerifier,判断 JSONRequest.KEY_COMBINE.equals(rk) 就抛异常 这样就可以实现前端不能传,但后端能在 Request 表指定 @combine 了 |
@aldag |
在GETS请求中使用@combine时得到了这样的提示:
"msg": "StandardAdvice:{} 里的 @combine:value 不合法!DELETE,GETS,HEADS 请求不允许传 @combine:value !"
查代码发现,这个检查逻辑是硬编码在AbstractSQLConfig类中的。
为什么在这些类型的请求中限制@combine的使用呢?
The text was updated successfully, but these errors were encountered: