Server:防止GETS通过"[]":{"@ROLE":"ADMIN"},"Table":{},"tag":"Table"绕过权限并能批量查询

TommyLemon · TommyLemon · commit 214da6e88d7b · 2017-11-18T23:33:21.000+08:00
diff --git a/APIJSON-Java-Server/APIJSON-Eclipse/src/main/java/zuo/biao/apijson/server/Parser.java b/APIJSON-Java-Server/APIJSON-Eclipse/src/main/java/zuo/biao/apijson/server/Parser.java
@@ -30,7 +30,6 @@
 import com.alibaba.fastjson.JSONObject;
 
 import apijson.demo.server.Verifier;
-import apijson.demo.server.model.BaseModel;
 import apijson.demo.server.model.User;
 import zuo.biao.apijson.JSON;
 import zuo.biao.apijson.JSONResponse;
@@ -177,7 +176,7 @@ public JSONObject parseResponse(JSONObject request) {
 					if (session != null && requestObject.getIntValue(JSONRequest.KEY_VERSION) <= 0) {
 						requestObject.put(JSONRequest.KEY_VERSION, session.getAttribute(JSONRequest.KEY_VERSION));
 					}
-					
+
 					requestObject = getCorrectRequest(requestMethod, requestObject);
 				}
 			} catch (Exception e) {
@@ -628,8 +627,9 @@ public JSONObject parseResponse(JSONRequest request) throws Exception {
 	private JSONArray getArray(String parentPath, String name, final JSONObject request) throws Exception {
 		Log.i(TAG, "\n\n\n getArray parentPath = " + parentPath
 				+ "; name = " + name + "; request = " + JSON.toJSONString(request));
-		if (RequestMethod.isGetMethod(requestMethod, true) == false) {
-			throw new UnsupportedOperationException("key[]:{}只支持GET类方法！不允许传 " + name + ":{} ！");
+		//不能允许GETS，否则会被通过"[]":{"@role":"ADMIN"},"Table":{},"tag":"Table"绕过权限并能批量查询
+		if (RequestMethod.isGetMethod(requestMethod, false) == false) {
+			throw new UnsupportedOperationException("key[]:{}只支持GET方法！不允许传 " + name + ":{} ！");
 		}
 		if (request == null || request.isEmpty()) {//jsonKey-jsonValue条件
 			return null;
diff --git a/APIJSON-Java-Server/APIJSON-Eclipse/src/main/java/zuo/biao/apijson/server/Structure.java b/APIJSON-Java-Server/APIJSON-Eclipse/src/main/java/zuo/biao/apijson/server/Structure.java
@@ -70,7 +70,9 @@ private Structure() {}
 
 	static final String requestString = "{\"Comment\":{\"DISALLOW\": \"id\", \"NECESSARY\": \"userId,momentId,content\"}, \"ADD\":{\"Comment:to\":{}}}";
 	static final String responseString = "{\"User\":{\"REMOVE\": \"phone\", \"REPLACE\":{\"sex\":2}, \"ADD\":{\"name\":\"api\"}}, \"PUT\":{\"Comment:to\":{}}}";
-
+	/**测试
+	 * @throws Exception
+	 */
 	public static void test() throws Exception {
 		JSONObject request;
 		try {
@@ -121,6 +123,10 @@ public static void test() throws Exception {
 
 	}
 
+	
+	
+	
+	
 
 	/**从request提取target指定的内容
 	 * @param method
