小易说IT 小易说IT

SpringBoot + MyBatis-Plus 安全编码完整 Demo

 ·  Java

环境：SpringBoot 3.x + MyBatis-Plus 3.5.5 + MySQL8 + Java17 重点：安全写法（MP Lambda 构造器） vs 危险写法（字符串拼接 SQL，可注入），方便你直接拿 payload 测试对比 前置：MySQL 新建库 mp_demo，表 user

1. MySQL 建表语句

CREATE DATABASE IF NOT EXISTS mp_demo DEFAULT CHARACTER SET utf8mb4;
USE mp_demo;

CREATE TABLE `user` (
  `id` BIGINT AUTO_INCREMENT PRIMARY KEY COMMENT '主键',
  `username` VARCHAR(50) NOT NULL COMMENT '用户名',
  `phone` VARCHAR(20) DEFAULT NULL COMMENT '手机号',
  `age` INT DEFAULT NULL COMMENT '年龄',
  `create_time` DATETIME DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- 测试数据
INSERT INTO `user`(username,phone,age) VALUES ('admin','13800138000',20),('test','13900139000',22);

2. Maven pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.2.0</version>
        <relativePath/>
    </parent>
    <groupId>com.demo</groupId>
    <artifactId>mp-sql-inject-demo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>mp-sql-inject-demo</name>

    <properties>
        <java.version>17</java.version>
    </properties>

    <dependencies>
        <!-- SpringBoot Web -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <!-- MyBatis-Plus SpringBoot Starter -->
        <dependency>
            <groupId>com.baomidou</groupId>
            <artifactId>mybatis-plus-boot-starter</artifactId>
            <version>3.5.5</version>
        </dependency>
        <!-- MySQL驱动 -->
        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <scope>runtime</scope>
        </dependency>
        <!-- Lombok -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <!-- Test -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <excludes>
                        <exclude>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                        </exclude>
                    </excludes>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>

3. application.yml 配置

spring:
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://localhost:3306/mp_demo?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai
    username: root
    password: 你的mysql密码

mybatis-plus:
  # 开启SQL打印，方便观察执行SQL，看注入效果
  configuration:
    log-impl: org.apache.ibatis.logging.stdout.StdOutImpl
  global-config:
    db-config:
      id-type: assign_id

4. Entity 实体类 User.java

package com.demo.entity;

import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableId;
import com.baomidou.mybatisplus.annotation.TableName;
import lombok.Data;
import java.time.LocalDateTime;

@Data
@TableName("user")
public class User {
    @TableId(type = IdType.AUTO)
    private Long id;
    private String username;
    private String phone;
    private Integer age;
    private LocalDateTime createTime;
}

5. Mapper 接口 UserMapper.java

package com.demo.mapper;

import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.demo.entity.User;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;
import java.util.List;

public interface UserMapper extends BaseMapper<User> {

    /**
     * ⚠️【高危！可SQL注入】手写SQL，直接字符串拼接
     * 用于测试payload，不要在生产使用
     */
    @Select("SELECT * FROM user WHERE username = '${username}'")
    List<User> selectByUsernameInject(@Param("username") String username);
}

6. Service 层

UserService.java

package com.demo.service;

import com.baomidou.mybatisplus.extension.service.IService;
import com.demo.entity.User;
import java.util.List;

public interface UserService extends IService<User> {
    // ✅ 安全查询：Lambda构造器（参数预编译，防注入）
    List<User> safeQueryUser(String username);

    // ⚠️ 危险查询：直接调用mapper拼接字符串SQL（可注入）
    List<User> unsafeInjectQuery(String username);
}

UserServiceImpl.java

package com.demo.service.impl;

import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.demo.entity.User;
import com.demo.mapper.UserMapper;
import com.demo.service.UserService;
import org.springframework.stereotype.Service;
import javax.annotation.Resource;
import java.util.List;

@Service
public class UserServiceImpl extends ServiceImpl<UserMapper, User> implements UserService {

    @Resource
    private UserMapper userMapper;

    /**
     * ✅ 安全写法：MP LambdaQueryWrapper，底层使用 ? 占位符预编译，防止SQL注入
     */
    @Override
    public List<User> safeQueryUser(String username) {
        LambdaQueryWrapper<User> wrapper = new LambdaQueryWrapper<>();
        wrapper.eq(User::getUsername, username);
        return baseMapper.selectList(wrapper);
    }

    /**
     * ⚠️ 危险写法：使用${}字符串拼接，可以被SQL注入
     */
    @Override
    public List<User> unsafeInjectQuery(String username) {
        return userMapper.selectByUsernameInject(username);
    }
}

7. Controller 接口（用于 HTTP 测试）

package com.demo.controller;

import com.demo.entity.User;
import com.demo.service.UserService;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import javax.annotation.Resource;
import java.util.List;

@RestController
@RequestMapping("/user")
public class UserController {

    @Resource
    private UserService userService;

    /**
     * ✅ 安全接口
     * 测试地址：GET /user/safe?username=admin
     */
    @GetMapping("/safe")
    public List<User> safe(@RequestParam String username) {
        return userService.safeQueryUser(username);
    }

    /**
     * ⚠️ 注入测试接口！仅本地测试，禁止上线
     * 测试地址：GET /user/unsafe?username=admin' or '1'='1
     */
    @GetMapping("/unsafe")
    public List<User> unsafe(@RequestParam String username) {
        return userService.unsafeInjectQuery(username);
    }
}

8. SpringBoot 启动类

package com.demo;

import org.mybatis.spring.annotation.MapperScan;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
@MapperScan("com.demo.mapper")
public class MpInjectDemoApplication {
    public static void main(String[] args) {
        SpringApplication.run(MpInjectDemoApplication.class, args);
    }
}

🧪 测试 Payload（直接复制测试）

访问 unsafe 接口进行注入测试；safe 接口无论什么 payload 都不会注入成功

  1. 万能查询 payload：

GET /user/unsafe?username=admin' or '1'='1

拼接后 SQL：SELECT * FROM user WHERE username = 'admin' or '1'='1' → 查询全部用户

  1. 注释掉后面语句 payload：

GET /user/unsafe?username=admin' --

拼接 SQL：SELECT * FROM user WHERE username = 'admin' -- '

对比安全接口 /user/safe?username=admin' or '1'='1 MP Lambda 会把整个传入字符串当成参数值，SQL 变成 where username = ?，参数值原样为 admin' or '1'='1，只会查找用户名等于这个字符串的用户，不会解析成 SQL 语法，不会注入

⚠️ MP 额外风险点（避坑）

  1. QueryWrapper 使用字符串硬编码字段，值用占位符没问题；但如果字段名直接拼接用户输入，会产生注入

// 安全：字段固定，值是参数
wrapper.eq("username", nameVal);

// ❌危险：排序字段来自用户输入字符串
String sortColumn = request.getParameter("sort");
wrapper.orderByAsc(sortColumn); // 用户输入 sort=id;drop table user; 会注入！

排序场景解决方案：白名单校验字段名，只允许指定列排序

  1. ${} MyBatis 原生字符串拼接高危；#{} 预编译安全。MP 内部生成 SQL 全部使用#{}

单元测试类（可选，不用启动 web 直接测试）

package com.demo;

import com.demo.service.UserService;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import java.util.List;

@SpringBootTest
public class SqlInjectTest {

    @Autowired
    private UserService userService;

    @Test
    void testSafe(){
        String payload = "admin' or '1'='1";
        var list = userService.safeQueryUser(payload);
        System.out.println("安全接口结果："+list);
    }

    @Test
    void testUnSafe(){
        String payload = "admin' or '1'='1";
        var list = userService.unsafeInjectQuery(payload);
        System.out.println("危险注入接口结果："+list);
    }
}

本文原创作者：易君召，详见：https://www.yijunzhao.cc/about，转载请注明出处。

原文链接 https://www.yijunzhao.cc/archives/springboot-mybatis-plus-secure-coding-complete-demo

欢迎访问 https://www.yijunzhao.cc/

https://www.yijunzhao.cc/