Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
com.github.dreamroute:sqlprinter-spring-boot-starter
Advanced tools
print sql use real value replace '?' in sql fragment.
<dependency>
<groupId>com.github.dreamroute</groupId>
<artifactId>sqlprinter-spring-boot-starter</artifactId>
<version>latest version</version>
</dependency>
描述:本插件主要是为了解决输出的sql中参数是问号'?'形式不易观察,而使用真实值替换掉问号'?'。生产环境如果不需要此插件(设置成false即可)。
如果应用中使用了mybatis plus,那么打印sql没问题,但是格式化可能不成功,不影响业务,这是由于mybatis plus操蛋的改动了mybatis的插件接口
如果你项目中使用了类似mybatis plus
这种框架,优先使用mybatis plus依赖的mybatis,排除本插件的依赖,如下:
<dependency>
<groupId>com.github.dreamroute</groupId>
<artifactId>sqlprinter-spring-boot-starter</artifactId>
<version>xxx.version</version>
<exclusions>
<exclusion>
<artifactId>mybatis</artifactId>
<groupId>org.mybatis</groupId>
</exclusion>
</exclusions>
</dependency>
sqlprinter.show=false
即可)sqlprinter.format = true
)来格式化SQL,对于一些比较特殊的SQL,如果格式化失败,那么会打印未被格式化时的sql,这时候会打印错误日志,
但是不会对业务造成任何影响,如果在乎错误日志,觉得错误日志不好看,那么可以关闭格式化功能
格式化的好处:1. 系统打印的SQL很整齐,风格一致;2. 由于mybatis使用动态标签,如果不格式化,那么打印的SQL会移除不满足条件的动态标签,显得SQL很凌乱
sqlprinter:
show: true
filter:
- com.github.dreamroute.sqlprinter.boot.mapper.UserMapper.selectById
- com.github.dreamroute.sqlprinter.boot.mapper.UserMapper.selectAll
那么selectById和selectAll方法就不会打印sql了。==> com.github.dreamroute.sqlprinter.boot.mapper.UserMapper.selectUserByIds
SELECT *
FROM smart_user
WHERE id IN (1, 2)
sqlprinter.show-result = true/false(是否显示查询结果,默认true)
|==========================================================|
| id | name | password | version | birthday | gender |
|==========================================================|
| 1 | w.dehai | null | 0 | null | null |
| 2 | Dreamroute | null | 0 | null | null |
|==========================================================|
之前:insert into xxx (name, password) values (?, ?)
之后:insert into xxx (name, password) values ('tom', '123456')
toString
方法的结果,类似这样Tue Sep 07 16:25:28 CST 2021
,而你需要的是2021-09-07 16:25:028.673
,如果从控制台或者日志文件中直接复制带有这种Tue Sep 07 16:25:28 CST 2021
时间的sql去数据库执行,很有可能会报错,
这时你就可以自定义日期类型的打印格式,打印成2021-09-07 16:25:028.673
这种易读并且可以直接用于执行的格式。Date
参数,希望打印yyyy-MM-dd HH:mm:ss.SSS
类型的日期ValueConverter
接口:public class DateConverter implements ValueConverter {
@Override
public Object convert(Object value) {
if (value instanceof Date) {
value = DateUtil.format((Date) value, "yyyy-MM-dd HH:mm:ss");
}
return value;
}
}
@EnableSQLPrinter
的属性converters
中加入即可,比如@EnableSQLPrinter(converters = {DateConverter.class, EnumConverter.class})
Date
的字段打印的就是2021-09-07 16:25:028.673
这种格式的了日期
和枚举
值转换工具,如果满足你的需求就用,不满足就自定义,在def包下:
1. 本插件是为了方便程序员观察真实sql的打印情况(问号'?'已经被真实值替换),特别是参数较多的sql,很直观清晰,可以直接复制sql在数据库中执行,非常友好。<br>
2. 本插件仅仅是打印sql,插件内部不会破坏mybatis的任何核心,也不会和任何其他插件造成冲突,可以放心使用。
如果您有什么建议或者意见,欢迎留言,也欢迎pull request,作者会将你优秀的思想加入到插件里面来,为其他人更好的解决问题。
本项目可以直接pull到本地执行单元测试观察效果
作者QQ:342252328
作者邮箱:342252328@qq.com
FAQs
print sql use real value replace '?' in sql fragment.
We found that com.github.dreamroute:sqlprinter-spring-boot-starter demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.