code refactor

models/target.go

@@ -228,6 +228,9 @@ func TargetTotal(ctx *ctx.Context, options ...BuildTargetWhereOption) (int64, er
 
 func TargetGets(ctx *ctx.Context, limit, offset int, order string, desc bool, options ...BuildTargetWhereOption) ([]*Target, error) {
 	var lst []*Target
+
+	order = validateOrderField(order, "ident")
+
 	if desc {
 		order += " desc"
 	} else {

models/user.go

@@ -3,6 +3,7 @@ package models
 import (
 	"fmt"
 	"os"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -555,6 +556,47 @@ func UserTotal(ctx *ctx.Context, query string, stime, etime int64) (num int64, e
 	return num, nil
 }
 
+var (
+	// 预编译正则表达式，避免重复编译
+	whitespaceRegex = regexp.MustCompile(`\s+`)
+	validOrderRegex = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$`)
+)
+
+func validateOrderField(order string, defaultField string) string {
+	// 空值检查
+	if order == "" {
+		return defaultField
+	}
+
+	// 长度检查
+	if len(order) > 64 {
+		logger.Warningf("SQL injection attempt detected: order field too long (%d chars)", len(order))
+		return defaultField
+	}
+
+	// 移除所有空白字符
+	order = whitespaceRegex.ReplaceAllString(order, "")
+	if order == "" {
+		return defaultField
+	}
+
+	// 检查危险字符
+	orderLower := strings.ToLower(order)
+	if strings.ContainsAny(order, "();,'\"` --/*\\=+-*/><|&^~") ||
+		strings.Contains(orderLower, "0x") || strings.Contains(orderLower, "0b") {
+		logger.Warningf("SQL injection attempt detected: contains dangerous characters")
+		return defaultField
+	}
+
+	// 使用正则表达式验证格式：只允许字母开头的字段名，可选择性包含表名
+	if !validOrderRegex.MatchString(order) {
+		logger.Warningf("SQL injection attempt detected: invalid order field format")
+		return defaultField
+	}
+
+	return order
+}
+
 func UserGets(ctx *ctx.Context, query string, limit, offset int, stime, etime int64,
 	order string, desc bool, usernames, phones, emails []string) ([]User, error) {
 
@@ -564,6 +606,8 @@ func UserGets(ctx *ctx.Context, query string, limit, offset int, stime, etime in
 		session = session.Where("last_active_time between ? and ?", stime, etime)
 	}
 
+	order = validateOrderField(order, "username")
+
 	if desc {
 		order = order + " desc"
 	} else {