mirror-fastadminnet/framework
1
0
Fork 0
mirror of https://gitee.com/fastadminnet/framework.git synced 2026-08-30 12:45:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

加强JSON字段校验

Browse Source
This commit is contained in:
Karson
2026-08-27 11:46:40 +08:00
parent 3f97aa93cc
commit 44a562cbd0
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
library/think/db/builder/Mysql.php
View File

@@ -97,7 +97,18 @@ class Mysql extends Builder
$key = trim($key);
if (strpos($key, '$.') && false === strpos($key, '(')) {
// JSON字段支持
list($field, $name) = explode('$.', $key);
list($field, $name) = explode('$.', $key, 2);
if ($field === '' || $name === '') {
throw new Exception('invalid json field: ' . $key);
}
// 验证 field 为合法字段名（只允许字母、数字、下划线、点号，且不能有连续点或首尾点）
if (!preg_match('/^[a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+)*$/', $field)) {
throw new Exception('invalid json field: ' . $field);
}
// 验证 name 为合法 JSON 路径（支持嵌套点和数组下标）
if (!preg_match('/^[a-zA-Z0-9_]+(\[[0-9]+\]|\.[a-zA-Z0-9_]+)*$/', $name)) {
throw new Exception('invalid json field: ' . $name);
}
return 'json_extract(' . $field . ', \'$.' . $name . '\')';
} elseif (strpos($key, '.') && !preg_match('/[,\'\"\(\)`\s]/', $key)) {
list($table, $key) = explode('.', $key, 2);