Why is this so-called "vulnerability" not a vulnerability? Spring, MyBatis and other frameworks can accept all kinds of CVE criticism, while MyBatisPlus has to dump the pot and accuse programmers of being too low-level# There is a difference. The premise is that you write XML, MyBatisPlus encapsulates Wrapper and claims to simplify code. Since it encapsulates and hides $#, it is not appropriate to do some necessary security checks? Instead of doubting the authority of CVE, you should know that SQL ->MyBatis ->MyBatisPlus ->various back-end scaffolds have multiple layers, each layer is simplifying, and each layer is throwing away the upper layer of the boiler. Who dares to use them. The programmers who use MyBatisPlus can't be expected to be at a high level. Every programmer wants to save effort. The front-end parameters can be directly obtained by HttpServletRequest from the back-end. Wrapper splicing can be found everywhere. If something goes wrong, is it the front-end or the framework? According to Qingmiao, can the injection vulnerability of the previous log4j and the deletion vulnerability of the Druid be used to eliminate low-level programmers?

Rocket ship 2024-05-31 19:22

It's a ghost anyway.

-SORA- 2024-06-01 09:30

American characters

osc_566335 2024-04-28 14:44

This is also called floor washing? Does it mean that Tesla will not wash the floor if it releases all the source code? Some people HWptds? That is to say, the language is ambiguous, which will also rise to the washing ground? Are some people too focused? Think the people he pays attention to must be staring at?

Xiao Xu Middle aged 2024-05-31 19:13

Very good

kakai 2024-05-10 10:21

The world only knows that Android was created by Google. Several people know that Android is only a product acquired by Google. Similarly, what is the problem with Huawei's contribution to the collection of OGG open source work and integration into its own proprietary product line?

Small and beautiful software development 2024-06-01 05:06

Cheat one's job

Single structure 2024-05-11 10:09

Selected as Open Source China's disgrace pillar

infoworld 2024-05-11 15:12

Universities should use open source free software instead of commercial ones. In this way, hands and feet will not be tied technically.

Yoona520 2024-05-17 16:34

Zhou Hongyi is now living more and more like a clown. If he stays behind the scenes, he has to become an online celebrity. Can you learn from Lei Jun?

Xiao Xu Middle aged 2024-06-01 07:03

good

Ma Nong Little Fatty Brother 2024-05-16 14:40

I give you six seconds. I give you six moves with the same effect in the martial arts contest, which shows the invincibility and confidence of the master

Apizza 2024-06-01 17:52

You can switch from lodash to radash in 2024!!!

Shen Lang Panda 2024-06-01 08:16

You can directly ask questions in the project work order. The comment area is not suitable for answering such questions

One code Yma 2024-05-06 09:14

My technical article was moved by CSDN. Why didn't anyone step on the sewing machine? This kind of report is a joke to me. The monsters with background are fine, and the monsters without background fight to death

haol666 2024-05-31 18:56

This story is powerful, I take it seriously, until I see the end.

Starry Night Destiny 2024-06-01 21:49

It feels like Mybatis. It's OK to provide users with optional security solutions. It's useless for users to complain about this problem

Bright 2024-05-19 23:25

What a fool! I killed myself. How can people deal with me later.

All the way north GP 2024-04-25 14:55

America, the future of mankind

CodeDoger 2024-05-02 20:48

35 It's too old to go to work and too early to retire at 60

People are addicted to food 2024-06-01 13:53

History history combination

Love to eat raw pears 2024-06-01 19:18

Don't expect programmers to have a deep understanding of the document. I still think that since the tool hides the details of $#, some necessary security checks are necessary. Many people do not use MybatisPlus directly, but use various so-called rapid development platforms. The MyBatisPlus rapid development platform Snowy, Guns, etc., has an impression that many versions have the problem of using Wrapper directly to splice the Request parameter. I remember that JeecgBoot was opened a lot of CVEs last year or the year before last because of the Wrapper splicing problem. Do you know the author of ibeetl? Many CVE blaming holes have been opened before. The problem is similar. The lack of basic knowledge "script editing permission" is actively handed over to the front end. What a low-level error or even low-energy behavior. However, I accepted it with an open mind and added a white list check.

sunday12345 2024-05-15 18:31

What does the bank do? It's blamed on the remote desktop. Persimmons really pick up soft pinches~?

Yeah, for 2024-05-17 13:42

That's too right. Old Zhou can't control Google, but he can control 360. Do not do to others what you do not want. All 360 products should be opened first.

GDWhisperer 2024-05-15 17:23

I transferred tens of thousands of yuan to my own account, which was under risk control. How did I do this? The bank should be responsible for this**

zzeric 2024-04-28 20:01

Although France is the parent community, the core developers of OCCT on github are all Russians. Without Russians, the French parent community cannot continue to operate. So Huawei took over, moved to China, changed its name and resumed open source and community operations. What's the problem?

Voice of God 2024-06-01 20:47

By default, injection ($) and splicing are turned off. If you want to use it, you need to sign the birth and death form and press the fingerprint.

Yokesily 2024-06-02 15:11

So designed

-SORA- 2024-04-30 17:07

When this happened in a foreign country, the comment area suddenly became very objective and rational**

jalena 2024-05-31 23:57

I can imagine that I will also receive the CVE repair request next week..... I don't use the key!!!!!!!!!

Monkeys think of apes 2024-05-31 18:31

You can cheat your brother. Just don't cheat yourself

Qin Liming 2024-05-11 09:12

be devoid of any sense of shame

Bright Stars 2 2024-05-31 23:28

Remove Unsafe? You don't want netty anymore?

looly 2024-06-02 14:32

@Qingmiao Hutool has also been mentioned some loopholes that I think are relatively "low-level", or I think are not loopholes. At first, I was also very angry, but after thinking it through, I found that CVE's idea was that once you did not actively remind users that there was a pit, the user fell into the pit is your fault, that is, your vulnerability. For example, as a traffic policeman, you should remind everyone who crosses the road to pay attention to safety, and ask him to answer whether he knows. Once you don't remind someone and are hit by a car, you can't get away from it. Similarly, when using frameworks and tools, you should provide at least one parameter to remind users that there may be SQL injection vulnerabilities. Note that it is not in the comments, but in the method parameters, which is the user's responsibility. Therefore, it is not comprehensive to provide solutions in comments or documents.

Shuimu Yi'an 2024-05-20 09:58

The news should be read continuously. I'm waiting for the third news besides rustdesk and teamviewer. Localized remote desktop software is far ahead.

osc_25732934 2024-06-01 19:30

It seems that the current version of the Foreign Function&Memory API is not as fast as that of jni, or even worse. In addition, before vallhala comes out, all interactions between java and c have to get an additional memory. Even if it comes out, it may not be possible to directly throw a copy of binary data into memory as a structure. When the two apis are completely stable, the day lily is cold

Monkeys think of apes 2024-05-31 18:31

You can cheat your brother. Just don't cheat yourself

sweet potato chips 2024-05-31 22:08

Glue code consumes few resources

young crops 2024-06-01 16:21

There is no tipping point. There are also many official documents stating that SQL fragments involving direct string splicing need to be controlled by the user, and specific solutions are also provided. If you say that the value part is injected, then we are also 100% free of any dispute. This obvious SQL fragment is unrealistic for ORM to explain without your control, Since SQL allows splicing fragments, there must be some scenarios that cannot be forced into non SQL strings. It is also very simple. Have you ever thought about why not force them???

Francesca 2024-05-19 18:00

Wine runs the Android emulator of Windows. Chrome OS is installed in the Android emulator. Linux environment is installed in chrome OS. Linux environment is installed in the Linux environment. Wine is installed in the Android emulator

Chief taxi captain 2024-05-17 11:17

I suggest that 360 open source all its products, and then become the leading enterprise in the domestic open source industry through open source, leading everyone to compete with foreign enterprises

Li Yinghui 2024-05-09 16:40

Buddhism has a good word, evil opinion. In dealing with the world, it is meaningless to draw conclusions from preset positions; It is also important to receive good logic training.

Code craftsman 2024-06-01 11:22

I also said "user controllable parameters"

osc_92224065 2024-04-29 10:57

Long term oppressed outsourcing of state-owned enterprises

Xiao Xu Middle aged 2024-06-01 06:49

thank

kangaroo 2024-06-01 22:23

The next version focuses on improving existing functions * improving internal power and qi * and continues to move towards the goal of Grand Master.

gamedot 2024-05-17 11:14

Old Zhou is deeply concerned about Huawei's great cause of open source. He is not a Huawei person, but has Huawei's soul.

oldpig 2024-04-28 09:59

”Huawei contributed all the source code "?, the title is completely inconsistent with the content.

Ning Jinnong 2024-06-01 21:04

Correct it. The example of loading the library is wrong. It should be # library=@ loading the dynamic library, "./yards to the treasurer. dll"

Dogo_Little People 2024-06-02 12:24

Not everyone will go to see the document in full detail. As a general basic framework, the method naming should consider not only readability but also understandability. At least, it should also establish a cognition for developers. LambdaQueryWrapper is recommended. The official only briefly said that QueryWrapper may lead to SQL injection risks, There are no detailed examples (many people don't understand what SQL injection is). Now I met a jerk and submitted it to CVE to see who is the most powerful

xiaoqibabby 2024-05-15 17:36

The bank is strongly required to be responsible for

MrChen89 2024-04-29 09:18

There are a group of people like this. I don't know what they have experienced. When it comes to HW, I can't say anything good, even if it's neutral

Hakuna 2024-05-31 18:28

It is compatible with Oracle, but does not know "just" or "just". Those who can be compatible with Oracle and do well are real men and real warriors. You should know that compatibility means that even bugs must be compatible, and you have no other code that can not be copied. It's all based on real skills and understanding of oracle.

Others are still watching

More highlights

DB Engines was acquired by Redgate, a British database software developer

Kugua Cloud Classroom (Enterprise Edition) v1.2.8 release, knowledge payment solution

: fire:: fire: Super SDK version manager VMR v0.6.1 preview version surprise release! Support more than 60 languages and tools!

Top 10 distinctive highlights of the new ORM mybatis mp

The first anniversary of open source, the new version of Qinghua was released

MooTool 1.6.1 is released, and developers always have small tools

Jboot v4.1.6 release, based on JFinal microservice framework

Blazork8s released a new version, updated AI execution command logic, and added multiple AI functions

Kangaroo database tool v5.0 has been released

SQLE 3.2405.0 Release

Maximizing the Effective Throughput of LLM Serving

State fine-tuning, PointRWKV, Chinese documents online... The latest news of RWKV community in May is coming!

Java AI has a bright future

Databases that do not need data

This PHP application server looks a bit trendy! FrankenPHP

The Code R&D management platform - the innovative realization of the integration of daily reports and working hours

The easy-to-use ORM framework mybatis-mp 1.5.3 was released

GRPC 1.64.1 release, cross language RPC framework

Malware is rampant in pirated Microsoft Office

ECUG Con invites you to discuss the deepest practice of server development

Qiniu Cloud's QVM "One Yuan Cloud" Collection Strategy: How to Go to Cloud at Low Cost

Qiniu's wedding ceremony in 2015, about?

Qiniu Cloud successfully passed CMMI3 certification

Architect Practice Day 11.9 Nanjing Station Registration | Technical Daniel takes you to analyze the challenges and practices in the internal evolution of the big data platform

ECUG Con 2014 Technical Dry Goods Sharing Phase II

Qiniuyun Li Chaoguang: Deep learning platform helps hundred million level content audit system

1024 Countdown to trouble! Programmer's Day is 2 days away!

[Special review on ECUG] Re talk about CERL: Detailed discussion on the differences between GO and ERLANG's concurrent programming models - Xu Shiwei

How to realize video structured management with AI?

Small program live broadcast is emerging, ready to embrace the latest growth trend?

Invite friends to win the grand prize! Come and draw your signature for 2019 New Year!

Object storage JavaScript SDK update, instant experience of simpler and reliable services

Cavalry to infantry? 10 minutes to figure out how to go to mosaic in live broadcast

New function of Qiniu cloud audio and video: audio support AAC_HE

Developer's Best Practice Day · Issue 4 - Triathlon software, hardware, cloud

How can the 300+R&D team maintain the high quality and efficiency of the project?

Dialogue with Qiniu AI Laboratory: Design and Thinking of Deep Learning Platform

NIUDAY 11.23 Beijing Station snatched tickets | Watch the AI landing industry enjoy the dividend of the AI era

Full summary of cloud storage application scenarios - picture application

What is the best language in the last decade- Come to Gopher China Conference to find out

I'm Huang Jianshi. I met my ex girlfriend at work

How to eliminate "bad video"? She teaches you the first step hand in hand

Jointly build a public security standard system | Qiniuyun and Rui'an Technology reach deep strategic cooperation

ECUG Con 2018 Morning Bird Ticket Hot Sale | Celebrities Gather to Explore the Next Decade of Cloud Computing

How can startups quickly build efficient monitoring systems?

Use the concept of 12 factor to quickly create high maintainability applications - Ye Feng (1213 developer practice day)

The 2018 China Short Video Developer Creativity Competition is coming, and the 10000 yuan cash prize invites you to fight!

[Warm Spring Gifts] Seven Bulls Customer Care Million Red Packets Come in April!

[Activity] Developer's Best Practice Day · Issue 11 - HTML5 and Native App Application Technology Practice

Dry goods sharing: deep practice of big data+intelligence in the era of smart factory

It's time to learn the real spark technology

Smoothness increased by 100%! How does Qiniu Cloud QUIC streaming scheme achieve live broadcast 0 stuck?

After cloud computing, the next battlefield of Go: game industry

[Container people must see] Three reasons why you must come to ECUG Con 2018!

Help developers to enter overseas markets and accelerate the launch of Qiniu global service

Full summary of cloud storage application scenarios - audio and video

TAL Xie Hualiang: Application of AI in the Education Industry

Qiniuyun Shopping Carnival Season | Winning the King Jinniu Award

What you want on the Double 11, we have prepared it for you in advance - Qiniuyun products start at 0.1 yuan

How to build a high throughput log platform

China.com and Qiniuyun have reached strategic cooperation to jointly build an international financial media center

Full summary of cloud storage application scenarios – App, HTML5, Web applications

Qiniu Yungong Jing: Continuous delivery platform based on container and big data platform

Had to stay up late Manual

AR+real-time audio and video call, seamless integration of virtual and reality

Qiniu Cloud helps you survive the cold winter | At 10:24 every day, new users get the full amount free of charge

The birth and change of video: AI leads video innovation

ECUG Con 2014 Lecturer Solicitation Order

Troubleshooting of Difficult and Miscellaneous Problems of Live Broadcasting Part 3: Slow Start

The price of seven-year integrated CDN was reduced comprehensively, with a value reduction of 42%

Tell me your favorite open source project, and Qiniu will support it with you!

Troubleshooting of Difficult and Miscellaneous Problems of Live Broadcasting Part 4: High Delay

The 10th Anniversary Event of ECUG Con: Exploring the deepest practice of cloud technology with celebrities

Data migration practice of Caibai

Troubleshooting of Difficult and Complicated Problems of Live Broadcasting (II): Playing Carton

Developer Best Practice Day · Issue 13 - Practice microservice architecture

New Murphy's Law of Cloud Computing

Process, thread, coroutine, synchronous, asynchronous, callback in Python

Why is the breakup between CoreOS and Docker predestined

How to build an efficient and independent container cloud delivery platform?

Qiniu Cloud Storage delivers love declaration to developers through the OSChina platform

Qiniu Convergence CDN management service was launched, and together with oschina community, coupon delivery benefits were upgraded!

Qiniu Cloud is invited to explore the value of financial data through joint auction and loan

Live quiz must read: technology pits and new play methods that must be known in advance

Surprise Christmas, Qiniu brings star customers to give gifts~

How does the test service of the efficiency department of Qiniu Cloud project protect 700000+customers?

Selection of technical architecture of log analysis system in the scale of 100 billion

[Class in Qiniuwan District] Communication mode between Ruby services

Get filters, animations, AR special effects, and quickly show off your short video development special effects!

(II) Mining the infinite value of big data in traditional industry logs

Changes of Qiniu data processing architecture

ECUG 2015 | Xu Shiwei: The choice of programming language is not about camp, but about taste

Practical Experience of Highly Available Scalable Architecture

Further Discussion on the Application Prospect of Go Language in Front End

Qiniu launched the first yellow identification service in China, free of charge from June to August

Have you found the flavor of these years?

[Double Twelfth] At 12:12 on December 12, there was a limited amount of benefits grabbing. Cloud computing didn't cut corners!

Xu Shiwei: What is the next era of the Internet after 20 years of evolution?

Cloud data processing makes services lighter Pang Xiangcai (1213 Developer Practice Day)

Software Author

Authors who have not been certified for this software

Use WeChat to log in quickly

Ministry of Industry and Information Technology

Open Source Software Promotion Alliance

Designated official community

Community norms

FreeCAD Open source CAD/CAE tools

Software Introduction

code

comment

FreeCAD 0.20 release, open source CAD/CAE software

FreeCAD 0.17 officially released, open source CAD/CAE tool

FreeCAD 0.16 and 0.17 revisions released

FreeCAD 0.17Pre released, open source CAD/CAE tool

FreeCAD 0.16 release, open source CAD/CAE tool

FreeCAD 0.15.4671 released, open source CAD/CAE tool

{{formatAllHtml(o.title)}}

{{formatAllHtml(o.title)}}

Awesome software

Hot content

Popular comments of the whole site

Others are still watching

Software Author

Hot News

OSCHINA Community

Online tools

Introduction

QQ group

Public account

Video number

Software Introduction

code

comment

Awesome software

Hot content

Popular comments of the whole site

Others are still watching

Software Author

Recommendation of similar software

Hot News

OSCHINA Community

Online tools

Introduction

QQ group

Public account

Video number