package cn.iocoder.yudao.module.mes.dal.mysql.dv.repair; import cn.iocoder.yudao.framework.common.pojo.PageParam; import cn.iocoder.yudao.module.mes.controller.admin.dv.repair.vo.MesDvRepairPageReqVO; import com.baomidou.mybatisplus.annotation.DbType; import com.baomidou.mybatisplus.core.MybatisConfiguration; import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder; import com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor; import com.baomidou.mybatisplus.extension.plugins.handler.TenantLineHandler; import com.baomidou.mybatisplus.extension.plugins.inner.*; import net.sf.jsqlparser.expression.*; import org.apache.ibatis.datasource.unpooled.UnpooledDataSource; import org.apache.ibatis.mapping.Environment; import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory; import org.junit.jupiter.api.Test; import java.util.UUID; import static org.junit.jupiter.api.Assertions.*; class MesDvRepairMapperTest { @Test void filtersPartialDeviceNameForPageAndExportWithoutLeakingOtherTenants() throws Exception { var datasource = new UnpooledDataSource("org.h2.Driver", "jdbc:h2:mem:repair_" + UUID.randomUUID() + ";MODE=MySQL;DB_CLOSE_DELAY=-1", "sa", ""); try (var connection = datasource.getConnection(); var statement = connection.createStatement()) { statement.execute("CREATE TABLE mes_dv_machinery(id BIGINT PRIMARY KEY,name VARCHAR(100),deleted INT,tenant_id BIGINT)"); statement.execute("CREATE TABLE mes_dv_repair(id BIGINT PRIMARY KEY,code VARCHAR(100),name VARCHAR(100),machinery_id BIGINT,require_date TIMESTAMP,finish_date TIMESTAMP,confirm_date TIMESTAMP,result INT,accepted_user_id BIGINT,confirm_user_id BIGINT,source_doc_type INT,source_doc_id BIGINT,source_doc_code VARCHAR(100),status INT,remark VARCHAR(100),creator VARCHAR(64),create_time TIMESTAMP,updater VARCHAR(64),update_time TIMESTAMP,deleted INT DEFAULT 0,tenant_id BIGINT)"); statement.execute("INSERT INTO mes_dv_machinery VALUES(1,'燕窝灌装机',0,1),(2,'清洗机',0,1),(3,'原浆灌装机',0,2),(4,'停用灌装机',1,1)"); statement.execute("INSERT INTO mes_dv_repair(id,code,machinery_id,tenant_id,status) VALUES(11,'R11',1,1,10),(12,'R12',2,1,10),(13,'R13',3,2,10),(14,'R14',4,1,10),(15,'R15',3,1,10)"); } var configuration = new MybatisConfiguration(); configuration.setMapUnderscoreToCamelCase(true); configuration.setEnvironment(new Environment("test", new JdbcTransactionFactory(), datasource)); var interceptor = new MybatisPlusInterceptor(); interceptor.addInnerInterceptor(new TenantLineInnerInterceptor(new TenantLineHandler() { @Override public Expression getTenantId() { return new LongValue(1); } })); interceptor.addInnerInterceptor(new PaginationInnerInterceptor(DbType.H2)); configuration.addInterceptor(interceptor); configuration.addMapper(MesDvRepairMapper.class); var factory = new MybatisSqlSessionFactoryBuilder().build(configuration); try (var session = factory.openSession()) { var mapper = session.getMapper(MesDvRepairMapper.class); var req = new MesDvRepairPageReqVO(); req.setMachineryName(" 灌装 "); req.setStatus(10); var page = mapper.selectPage(req); assertEquals(1, page.getTotal()); assertEquals(11L, page.getList().get(0).getId()); req.setPageSize(PageParam.PAGE_SIZE_NONE); assertEquals(11L, mapper.selectPage(req).getList().get(0).getId()); req.setMachineryName("不存在设备"); assertEquals(0, mapper.selectPage(req).getTotal()); req.setMachineryName("' OR 1=1 --"); assertEquals(0, mapper.selectPage(req).getTotal()); req.setMachineryName(" "); assertEquals(4, mapper.selectPage(req).getTotal()); } } }