org.springframework.web.filter.GenericFilterBean

org.springframework.web.filter.OncePerRequestFilter

tech.riemann.nif.web.sql.SqlInjectionFilter

All Implemented Interfaces:: jakarta.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.web.context.ServletContextAware

public class SqlInjectionFilter extends org.springframework.web.filter.OncePerRequestFilter

SQL注入防护过滤器

拦截所有HTTP请求，检查参数与请求体中是否包含SQL注入特征

定位声明：本过滤器是 WAF 缓解层，不能替代参数化查询，请务必将参数化查询 / ORM 作为唯一防线。

防护策略： 1. 检查请求参数（query/form）是否包含SQL关键字与注入特征 2. 检查 JSON/文本请求体（可经 nif.web.sql-injection.check-body 关闭；multipart/二进制自动跳过） 3. 对危险请求进行拦截并记录日志

配置示例：

nif:
  web:
    sql-injection:
      enabled: true
      check-body: true
      exclude-paths:
        - /api/health

Constructor Details
- SqlInjectionFilter
  
  public SqlInjectionFilter(boolean enabled, List<String> excludePaths, boolean checkBody, SqlInjectionChecker sqlInjectionChecker)
Method Details
- doFilterInternal
  
  protected void doFilterInternal(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException
  
  Specified by:
  
  doFilterInternal in class org.springframework.web.filter.OncePerRequestFilter
  
  Throws:
  
  jakarta.servlet.ServletException
  
  IOException

Class SqlInjectionFilter

Field Summary