Pre Merge pull request !876 from miko/6.X-fix

ruoyi-common/ruoyi-common-mybatis/src/main/java/org/dromara/common/mybatis/config/MybatisPlusConfig.java

@@ -11,6 +11,7 @@ import com.baomidou.mybatisplus.extension.plugins.inner.PaginationInnerIntercept
 import org.dromara.common.core.factory.YmlPropertySourceFactory;
 import org.dromara.common.mybatis.aspect.DataPermissionPointcutAdvisor;
 import org.dromara.common.mybatis.config.properties.SqlLogProperties;
+import org.dromara.common.mybatis.core.page.PageQuery;
 import org.dromara.common.mybatis.handler.InjectionMetaObjectHandler;
 import org.dromara.common.mybatis.handler.MybatisExceptionHandler;
 import org.dromara.common.mybatis.handler.PlusPostInitTableInfoHandler;
@@ -77,6 +78,8 @@ public class MybatisPlusConfig {
         PaginationInnerInterceptor paginationInnerInterceptor = new PaginationInnerInterceptor();
         // 分页合理化
         paginationInnerInterceptor.setOverflow(true);
+        // 限制单次分页记录数，防止绕过 PageQuery 直接构造超大分页
+        paginationInnerInterceptor.setMaxLimit((long) PageQuery.MAX_PAGE_SIZE);
         return paginationInnerInterceptor;
     }
 

ruoyi-common/ruoyi-common-mybatis/src/main/java/org/dromara/common/mybatis/core/page/PageQuery.java

@@ -5,8 +5,11 @@ import cn.hutool.core.util.ObjectUtil;
 import com.baomidou.mybatisplus.core.metadata.OrderItem;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.fasterxml.jackson.annotation.JsonIgnore;
+import jakarta.validation.constraints.Max;
+import jakarta.validation.constraints.Min;
 import lombok.Data;
 import lombok.NoArgsConstructor;
+import org.dromara.common.core.constant.HttpStatus;
 import org.dromara.common.core.exception.ServiceException;
 import org.dromara.common.core.utils.StringUtils;
 import org.dromara.common.core.utils.sql.SqlUtil;
@@ -31,11 +34,15 @@ public class PageQuery implements Serializable {
     /**
      * 分页大小
      */
+    @Min(value = 1, message = "每页显示记录数不能小于1")
+    @Max(value = MAX_PAGE_SIZE, message = "每页显示记录数不能超过{value}")
     private Integer pageSize;
 
     /**
      * 当前页数
      */
+    @Min(value = 1, message = "当前页数不能小于1")
+    @Max(value = MAX_PAGE_NUM, message = "当前页数不能超过{value}")
     private Integer pageNum;
 
     /**
@@ -54,9 +61,19 @@ public class PageQuery implements Serializable {
     public static final int DEFAULT_PAGE_NUM = 1;
 
     /**
-     * 每页显示记录数 默认值 默认查全部
+     * 每页显示记录数默认值
      */
-    public static final int DEFAULT_PAGE_SIZE = Integer.MAX_VALUE;
+    public static final int DEFAULT_PAGE_SIZE = 10;
+
+    /**
+     * 每页显示记录数上限
+     */
+    public static final int MAX_PAGE_SIZE = 200;
+
+    /**
+     * 当前页数上限，避免异常深分页请求
+     */
+    public static final int MAX_PAGE_NUM = 100_000;
 
     /**
      * 构建分页对象。
@@ -65,11 +82,8 @@ public class PageQuery implements Serializable {
      * @return MyBatis-Plus 分页对象
      */
     public <T> Page<T> build() {
-        Integer pageNum = ObjectUtil.defaultIfNull(getPageNum(), DEFAULT_PAGE_NUM);
+        int pageNum = resolvePageNum();
-        Integer pageSize = ObjectUtil.defaultIfNull(getPageSize(), DEFAULT_PAGE_SIZE);
+        int pageSize = resolvePageSize();
-        if (pageNum <= 0) {
-            pageNum = DEFAULT_PAGE_NUM;
-        }
         Page<T> page = new Page<>(pageNum, pageSize);
         List<OrderItem> orderItems = buildOrderItem();
         if (CollUtil.isNotEmpty(orderItems)) {
@@ -126,12 +140,33 @@ public class PageQuery implements Serializable {
      */
     @JsonIgnore
     public Integer getFirstNum() {
-        Integer currentPageNum = ObjectUtil.defaultIfNull(getPageNum(), DEFAULT_PAGE_NUM);
+        return (resolvePageNum() - 1) * resolvePageSize();
-        Integer currentPageSize = ObjectUtil.defaultIfNull(getPageSize(), DEFAULT_PAGE_SIZE);
+    }
-        if (currentPageNum <= 0) {
+
-            currentPageNum = DEFAULT_PAGE_NUM;
+    /**
+     * 获取并校验当前页数。
+     *
+     * @return 有效页码
+     */
+    private int resolvePageNum() {
+        int value = ObjectUtil.defaultIfNull(getPageNum(), DEFAULT_PAGE_NUM);
+        if (value < 1 || value > MAX_PAGE_NUM) {
+            throw new ServiceException("当前页数必须在1到" + MAX_PAGE_NUM + "之间", HttpStatus.BAD_REQUEST);
         }
-        return (currentPageNum - 1) * currentPageSize;
+        return value;
+    }
+
+    /**
+     * 获取并校验每页显示记录数。
+     *
+     * @return 有效分页大小
+     */
+    private int resolvePageSize() {
+        int value = ObjectUtil.defaultIfNull(getPageSize(), DEFAULT_PAGE_SIZE);
+        if (value < 1 || value > MAX_PAGE_SIZE) {
+            throw new ServiceException("每页显示记录数必须在1到" + MAX_PAGE_SIZE + "之间", HttpStatus.BAD_REQUEST);
+        }
+        return value;
     }
 
     /**