Jira groovy 脚本错误

Question

我从 SQL 表或函数中获取了 groovy 记录。例子;

String subeKodu = get_sube_kodu_bul(matcher[0][1])

private String get_sube_kodu_bul(String subeAdi) {
   def sql = Sql.newInstance("jdbc:jtds:sqlserver://10.xx.xx.xx:1433/DBNAME", "usrname","pass", "net.sourceforge.jtds.jdbc.Driver")
   subeAdi = subeAdi.trim()
   def row = sql.firstRow("SELECT TOP 1 SUBE_KODU FROM TABLENAME WHERE SUBE_ADI= '${subeAdi}'")
   row != null ? (String)row.SUBE_KODU : ''
}

但我面临以下错误；

WARNING: In Groovy SQL please do not use quotes around dynamic expressions (which start with $) as this means we cannot use a JDBC PreparedStatement and so is a security hole. Groovy has worked around your mistake but the security hole is still there. The expression so far is: SELECT TOP 1 YETKILI FROM TABLENAME WHERE SUBE_ADI = '?'

Answer 1

Groovy 抱怨您的代码可能容易受到SQL 注入攻击。

正确的方法是使用JDBC Prepared Statements。在 Groovy 中，您可以按如下方式执行此操作：

sql.firstRow("SELECT TOP 1 SUBE_KODU FROM TABLENAME WHERE SUBE_ADI= ?", [subeAdi])

有关更多示例，请参阅Groovy SQL 教程并搜索“准备好的语句”。

另外，不要忘记在完成后调用 close() 。