AI SDL 数字分身 - 风险项目详情

package com.alipay.subsidy.controller;

import org.springframework.web.bind.annotation.*;
import java.sql.*;

@RestController
@RequestMapping("/api/subsidy")
public class SubsidyController {
    
    @GetMapping("/status")
    public String getSubsidyStatus(@RequestParam String idCard) {
        // 漏洞点: SQL注入风险
        String query = "SELECT status FROM subsidy_applications WHERE id_card = '" + idCard + "'";
        
        try (Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/subsidy", "user", "pass");
             Statement stmt = conn.createStatement();
             ResultSet rs = stmt.executeQuery(query)) {
            
            if (rs.next()) {
                return rs.getString("status");
            }
            return "Not found";
        } catch (SQLException e) {
            return "Error";
        }
    }
    
    @PostMapping("/apply")
    public String applySubsidy(@RequestBody SubsidyApplication application) {
        // 业务逻辑处理
        return "Success";
    }
    
    // 其他方法...
}