Zhou Hongyi is now living more and more like a clown. If he stays behind the scenes, he has to become an online celebrity. Can you learn from Lei Jun?

looly 2024-06-02 14:32

@Qingmiao Hutool has also been mentioned some loopholes that I think are relatively "low-level", or I think are not loopholes. At first, I was also very angry, but after thinking it through, I found that CVE's idea was that once you did not actively remind users that there was a pit, the user fell into the pit is your fault, that is, your vulnerability. For example, as a traffic policeman, you should remind everyone who crosses the road to pay attention to safety, and ask him to answer whether he knows. Once you don't remind someone and are hit by a car, you can't get away from it. Similarly, when using frameworks and tools, you should provide at least one parameter to remind users that there may be SQL injection vulnerabilities. Note that it is not in the comments, but in the method parameters, which is the user's responsibility. Therefore, it is not comprehensive to provide solutions in comments or documents.

One code Yma 2024-05-09 09:58

Recently, I often go to interviews. People who hate Ali background most regard me as a fool, even though I am a fool

oldpig 2024-04-28 09:59

”Huawei contributed all the source code "?, the title is completely inconsistent with the content.

Xiao Xu Middle aged 2024-06-01 07:03

good

osc_566335 2024-04-28 14:44

This is also called floor washing? Does it mean that Tesla will not wash the floor if it releases all the source code? Some people HWptds? That is to say, the language is ambiguous, which will also rise to the washing ground? Are some people too focused? Think the people he pays attention to must be staring at?

Simple code 2024-06-02 20:15

Does JBoot solve the problem that the join template in JFinal only supports Java 8? Is the dependency on Javax to be changed to Jakarta?

Flat wave 2024-06-03 00:02

These are all used for propaganda. Xiaomi and OV will also run into this gimmick immediately;

Single structure 2024-05-11 10:09

Selected as Open Source China's disgrace pillar

infoworld 2024-05-11 15:12

Universities should use open source free software instead of commercial ones. In this way, hands and feet will not be tied technically.

haol666 2024-05-31 18:56

This story is powerful, I take it seriously, until I see the end.

All the way north GP 2024-04-25 14:55

America, the future of mankind

The seven in one little King Kong 2024-06-02 15:54

Those people only use resources, others are not developed by NPM...

Li Yinghui 2024-05-09 16:40

Buddhism has a good word, evil opinion. In dealing with the world, it is meaningless to draw conclusions from preset positions; It is also important to receive good logic training.

One code Yma 2024-05-06 09:14

My technical article was moved by CSDN. Why didn't anyone step on the sewing machine? This kind of report is a joke to me. The monsters with background are fine, and the monsters without background fight to death

osc_92224065 2024-04-29 10:57

Long term oppressed outsourcing of state-owned enterprises

young crops 2024-06-01 16:21

There is no tipping point. There are also many official documents stating that SQL fragments involving direct string splicing need to be controlled by the user, and specific solutions are also provided. If you say that the value part is injected, then we are also 100% free of any dispute. This obvious SQL fragment is unrealistic for ORM to explain without your control, Since SQL allows splicing fragments, there must be some scenarios that cannot be forced into non SQL strings. It is also very simple. Have you ever thought about why not force them???

People are addicted to food 2024-06-01 13:53

History history combination

Ma Nong Little Fatty Brother 2024-05-16 14:40

I give you six seconds. I give you six moves with the same effect in the martial arts contest, which shows the invincibility and confidence of the master

Dogo_Little People 2024-06-02 12:24

Not everyone will go to see the document in full detail. As a general basic framework, the method naming should consider not only readability but also understandability. At least, it should also establish a cognition for developers. LambdaQueryWrapper is recommended. The official only briefly said that QueryWrapper may lead to SQL injection risks, There are no detailed examples (many people don't understand what SQL injection is). Now I met a jerk and submitted it to CVE to see who is the most powerful

zzeric 2024-04-28 20:01

Although France is the parent community, the core developers of OCCT on github are all Russians. Without Russians, the French parent community cannot continue to operate. So Huawei took over, moved to China, changed its name and resumed open source and community operations. What's the problem?

Starry Night Destiny 2024-06-01 21:49

It feels like Mybatis. It's OK to provide users with optional security solutions. It's useless for users to complain about this problem

Xiao Xu Middle aged 2024-05-31 19:13

Very good

Bright 2024-05-19 23:25

What a fool! I killed myself. How can people deal with me later.

Code craftsman 2024-06-01 11:22

I also said "user controllable parameters"

Happy LeapFrog 2024-05-18 09:18

But the question is: "What's the use of this for ordinary Android users?" Now the answer seems to be: "Almost nothing.".

MrChen89 2024-04-29 09:18

There are a group of people like this. I don't know what they have experienced. When it comes to HW, I can't say anything good, even if it's neutral

jalena 2024-05-31 23:57

I can imagine that I will also receive the CVE repair request next week..... I don't use the key!!!!!!!!!

-SORA- 2024-06-01 09:30

American characters

GDWhisperer 2024-05-15 17:23

I transferred tens of thousands of yuan to my own account, which was under risk control. How did I do this? The bank should be responsible for this**

Ning Jinnong 2024-06-01 21:04

Correct it. The example of loading the library is wrong. It should be # library=@ loading the dynamic library, "./yards to the treasurer. dll"

Yeah, for 2024-05-17 13:42

That's too right. Old Zhou can't control Google, but he can control 360. Do not do to others what you do not want. All 360 products should be opened first.

Shuimu Yi'an 2024-05-20 09:58

The news should be read continuously. I'm waiting for the third news besides rustdesk and teamviewer. Localized remote desktop software is far ahead.

Francesca 2024-05-19 18:00

Wine runs the Android emulator of Windows. Chrome OS is installed in the Android emulator. Linux environment is installed in chrome OS. Linux environment is installed in the Linux environment. Wine is installed in the Android emulator

Love to eat raw pears 2024-06-01 19:18

Don't expect programmers to have a deep understanding of the document. I still think that since the tool hides the details of $#, some necessary security checks are necessary. Many people do not use MybatisPlus directly, but use various so-called rapid development platforms. The MyBatisPlus rapid development platform Snowy, Guns, etc., has an impression that many versions have the problem of using Wrapper directly to splice the Request parameter. I remember that JeecgBoot was opened a lot of CVEs last year or the year before last because of the Wrapper splicing problem. Do you know the author of ibeetl? Many CVE blaming holes have been opened before. The problem is similar. The lack of basic knowledge "script editing permission" is actively handed over to the front end. What a low-level error or even low-energy behavior. However, I accepted it with an open mind and added a white list check.

Shen Lang Panda 2024-06-01 08:16

You can directly ask questions in the project work order. The comment area is not suitable for answering such questions

zhy 2024-05-16 13:16

At the end of Shannon is Nong

Xiao Xu Middle aged 2024-06-01 06:49

thank

CodeDoger 2024-05-02 20:48

35 It's too old to go to work and too early to retire at 60

CheckStyle 2024-06-02 22:26

This is the right attitude, support

osc_25732934 2024-06-01 19:30

It seems that the current version of the Foreign Function&Memory API is not as fast as that of jni, or even worse. In addition, before vallhala comes out, all interactions between java and c have to get an additional memory. Even if it comes out, it may not be possible to directly throw a copy of binary data into memory as a structure. When the two apis are completely stable, the day lily is cold

Rocket ship 2024-05-31 19:22

It's a ghost anyway.

Apizza 2024-06-01 17:52

You can switch from lodash to radash in 2024!!!

Voice of God 2024-06-01 20:47

By default, injection ($) and splicing are turned off. If you want to use it, you need to sign the birth and death form and press the fingerprint.

sweet potato chips 2024-05-31 22:08

Glue code consumes few resources

Small and beautiful software development 2024-06-01 05:06

Cheat one's job

kangaroo 2024-06-01 22:23

The next version focuses on improving existing functions * improving internal power and qi * and continues to move towards the goal of Grand Master.

xiaoqibabby 2024-05-15 17:36

The bank is strongly required to be responsible for

Love to eat raw pears 2024-06-01 11:48

Why is this so-called "vulnerability" not a vulnerability? Spring, MyBatis and other frameworks can accept all kinds of CVE criticism, while MyBatisPlus has to dump the pot and accuse programmers of being too low-level# There is a difference. The premise is that you write XML, MyBatisPlus encapsulates Wrapper and claims to simplify code. Since it encapsulates and hides $#, it is not appropriate to do some necessary security checks? Instead of doubting the authority of CVE, you should know that SQL ->MyBatis ->MyBatisPlus ->various back-end scaffolds have multiple layers, each layer is simplifying, and each layer is throwing away the upper layer of the boiler. Who dares to use them. The programmers who use MyBatisPlus can't be expected to be at a high level. Every programmer wants to save effort. The front-end parameters can be directly obtained by HttpServletRequest from the back-end. Wrapper splicing can be found everywhere. If something goes wrong, is it the front-end or the framework? According to Qingmiao, can the injection vulnerability of the previous log4j and the deletion vulnerability of the Druid be used to eliminate low-level programmers?

kakai 2024-05-10 10:21

The world only knows that Android was created by Google. Several people know that Android is only a product acquired by Google. Similarly, what is the problem with Huawei's contribution to the collection of OGG open source work and integration into its own proprietary product line?

Yokesily 2024-06-02 15:11

So designed

gamedot 2024-05-17 11:14

Old Zhou is deeply concerned about Huawei's great cause of open source. He is not a Huawei person, but has Huawei's soul.

sunday12345 2024-05-15 18:31

What does the bank do? It's blamed on the remote desktop. Persimmons really pick up soft pinches~?

monkey_cici 2024-05-09 00:25

My I9 CPU, 64GB memory module and 3080Ti computer are inferior to the top configuration of 19999 on a tablet

Chief taxi captain 2024-05-17 11:17

I suggest that 360 open source all its products, and then become the leading enterprise in the domestic open source industry through open source, leading everyone to compete with foreign enterprises

Qin Liming 2024-05-11 09:12

be devoid of any sense of shame

Bright Stars 2 2024-05-31 23:28

Remove Unsafe? You don't want netty anymore?

Others are still watching

More highlights

DB Engines was acquired by Redgate, a British database software developer

Kugua Cloud Classroom (Enterprise Edition) v1.2.8 release, knowledge payment solution

: fire:: fire: Super SDK version manager VMR v0.6.1 preview version surprise release! Support more than 60 languages and tools!

Top 10 distinctive highlights of the new ORM mybatis mp

The first anniversary of open source, the new version of Qinghua was released

MooTool 1.6.1 is released, and developers always have small tools

Jboot v4.1.6 release, based on JFinal microservice framework

Blazork8s released a new version, updated AI execution command logic, and added multiple AI functions

Kangaroo database tool v5.0 has been released

SQLE 3.2405.0 Release

Maximizing the Effective Throughput of LLM Serving

State fine-tuning, PointRWKV, Chinese documents online... The latest news of RWKV community in May is coming!

Java AI has a bright future

Databases that do not need data

This PHP application server looks a bit trendy! FrankenPHP

The Code R&D management platform - the innovative realization of the integration of daily reports and working hours

The easy-to-use ORM framework mybatis-mp 1.5.3 was released

GRPC 1.64.1 release, cross language RPC framework

Malware is rampant in pirated Microsoft Office

Analysis of lightweight pre training model more suitable for text classification

How to ensure a large-scale live broadcast of ten million levels?

Proxmox of Mobile DevOps realizes throttling and efficiency improvement

The Way to Balance Network QoS -- Introduction to Audio and Video Weak Network Countermeasures

High concurrency IM system architecture optimization practice

Free psychological assistance | NetEase Yunxin joined hands with a little smart "heart" to protect against the epidemic

Netease Smart Enterprise Node.js Practice (3) | Gray environment and application monitoring

Job Hunt "Epidemic" | Netease Yunxin Joins Hands with Binjiang District Human Resources and Social Security Bureau to Achieve "Contactless" Recruitment

go, iris , nuxt, Application and practice of server-side rendering and other technologies in helloworld developer community

Mobile IM Development Guide 1: How to select technology

Full Practice of Lianmai Interactive Live Broadcast Scheme 2: Evolution of NetEase Cloud Trust Lianmai Interactive Live Broadcast Scheme

Detailed explanation of four ways of submitting data by POST in HTTP

Audio session management of WebRTC series

The practice of micro front-end in Netease Qiyu

Netease Smart Enterprise Node.js Practice (2) | Smooth release and front-end code

Mobile IM Development Guide 2: Heartbeat Command Details

Netease Practical Sharing | Yunxin IM SDK Interface Design Practice

How to realize cloud information privatization within the enterprise

Netease Yunxin Instant Messaging Push Guarantee and Network Optimization Details (III)

The Practice and Application of Distributed ID

On fast reconnection mechanism of websocket

Video private cloud practice: build on-demand private cloud platform based on Docker

True · Programmer's Guide to May Day | Recommended Books

The four highlights of NetEase Smart Enterprise 2020 Meeting are the first to see!

From beginner to advanced | How to build a video conference based on WebRTC

Implementation Practice of AI Driven Super Resolution Technology

Thoroughly understand the class design principle - single responsibility principle

Things about iOS App development 1: How to establish appropriate specifications

Implementation of Custom Encoding Resolution Transmission Based on WebRTC

Open Source | How to develop a high-performance Redis cluster proxy?

IM instant messaging: how to design chat room architecture out of traditional thinking?

How to quickly realize the short video function on the mobile end?

Netease Seven Fish Service Governance Practice

What is cross domain and how to solve it? It's easy to understand, and it will take you to finish

Overcome difficulties: technology helps the online transformation of banking business in Hubei

10 years of programmers' programming language experience and Go's affinity

[Heavy Release] NetEase Yunxin Quality Data Monitoring Platform Opens NetEase Yunxin

How to scientifically complete an AR press conference? It's all in this super detailed event planning Xmind

Netease smart enterprise Node.js practice (1) | Node application architecture design and React isomorphism

Heart of Technology | Moment of Technology Assistance under the Epidemic Situation

Data report scheme based on Elastic search

The audio of WebRTC series

Breaking the traditional noise reduction technology to see the practical application of Netease Yunxin in voice noise reduction

Practice of Netease Yunxin Service Monitoring Platform

Understand the essence of https principle in plain English

Summary of Android instant messaging development (I)

Many people can't understand HTTPS, but I can

How to play mobile social? Netease Yunxin, together with Zaizao and Uki, creates more new scenes!

Yesterday, Today and Tomorrow of Echo Cancellation

Video test practice without reference evaluation in Yunxin

Details of PostgreSQL Array Types

Things about iOS App development 2: How to build a suitable framework

Yunxin Classroom | How to Realize Audio and Video Call

Five simple steps to easily build a local "clubhouse"

Active Noise Cancelling

Exploration and Practice of Netease Yunxin in the Converged Communication Scenario - SIPGateway Service Architecture

##How can we use the developer community to improve our technology?

Self rescue of traditional business enterprises under the epidemic | 4 Tips set up broadcast rooms with sales exceeding 100 million yuan

How is a question answering robot with a matching rate of up to 90% refined?

Detailed explanation of IM push guarantee and network optimization (I): how to realize backstage survival without affecting user experience

Handwritten Java HashMap core source code

Video auxiliary stream of WebRTC series

Compressed Vision: Video Encoding and Decoding Technology

How to design the server architecture when hundreds of thousands of people chat online in the live broadcast room at the same time?

Technical Practice | Talk about the signaling network library practice of NetEase Yunxin

Random talk on multi tenant design of enterprise level SaaS

Full Practice of Lianmai Interactive Live Broadcast Scheme 3: Implementation Scheme of NetEase Cloud Trust Lianmai Interaction

Build a real-time audio and video engine from 0 to 1

Industry Observation | Smart screens are bursting, can the big screen market usher in the losers?

An article that is easy to understand makes you thoroughly understand Java annotations

QoS policy in real-time audio and video conference scenario

7 Handwritten source code series - Principle of binary search tree and Java source code implementation

Under the epidemic | They are contributing to the strength of this era

Full Practice of Lianmai Interactive Live Broadcasting Scheme 1: What is Lianmai Interactive Live Broadcasting?

Thoroughly understand the import and export of Javascript modules

The online education solution of NetEase Yunxin guarantees the "air classroom"

Mobile IM Development Guide 3: How to Optimize the Login Module

The way to break through the old and establish a new, accurate test

Software Author

Authors who have not been certified for this software

Use WeChat to log in quickly

Ministry of Industry and Information Technology

Open Source Software Promotion Alliance

Designated official community

Community norms

Yue ICP Bei No. 12009483

Top

Apache Flink Streaming and batching integrated analysis engine

Software Introduction

requirement

code

comment

Apache Flink ML 2.2.0 Announcement

Official Announcement | Apache Flink 1.16 Announcement

Apache Flink 1.14.6 release, stream processing framework

Apache Flink's Statement on Akka License Changes

Apache Flink 1.15.2 release, stream processing framework

Official Announcement | Apache Flink 1.15 Announcement

Official Announcement | Apache Flink 1.14.0 Announcement

Preview of new features of Apache Flink 1.14

Official Announcement | Apache Flink 1.13.0 was officially released, making stream processing applications more simple and efficient!

Apache Flink 1.10.3 released

{{formatAllHtml(o.title)}}

{{formatAllHtml(o.title)}}

Awesome software

Hot content

Popular comments of the whole site

Others are still watching

Software Author

Hot News

OSCHINA Community

Online tools

Introduction

QQ group

Public account

Video number

Software Introduction

requirement

code

comment

Awesome software

Hot content

Popular comments of the whole site

Others are still watching

Software Author

Recommendation of similar software

Hot News

OSCHINA Community

Online tools

Introduction

QQ group

Public account

Video number