manager/my-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修改

Browse Source
This commit is contained in:
gaoxq
2025-12-04 21:24:42 +08:00
parent 312dfec699
commit 216d49a0af
2 changed files with 249 additions and 270 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
common/src/main/java/com/jeesite/common/codec/EncodeUtils.java
View File

@@ -16,6 +16,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory; import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletRequest;
import java.io.UnsupportedEncodingException; import java.io.UnsupportedEncodingException;
import java.net.URLDecoder; import java.net.URLDecoder;
import java.net.URLEncoder; import java.net.URLEncoder;
@@ -31,6 +32,7 @@ import java.util.regex.Pattern;
* 3. Commons-Lang 的 xml/html escape * 3. Commons-Lang 的 xml/html escape
* 4. JDK 提供的 URLEncoder * 4. JDK 提供的 URLEncoder
* 5. XSS、SQL、orderBy 过滤器 * 5. XSS、SQL、orderBy 过滤器
*
* @author calvin、ThinkGem * @author calvin、ThinkGem
* @version 2025-7-9 * @version 2025-7-9
*/ */
@@ -70,18 +72,12 @@ public class EncodeUtils {
* Base64编码. * Base64编码.
*/ */
public static String encodeBase64(String input) { public static String encodeBase64(String input) {
if (StringUtils.isBlank(input)){ if (StringUtils.isBlank(input)) {
return StringUtils.EMPTY; return StringUtils.EMPTY;
} }
return new String(Base64.encodeBase64(input.getBytes(StandardCharsets.UTF_8))); return new String(Base64.encodeBase64(input.getBytes(StandardCharsets.UTF_8)));
} }
// /**
// * Base64编码, URL安全(将Base64中的URL非法字符'+'和'/'转为'-'和'_', 见RFC3548).
// */
// public static String encodeUrlSafeBase64(byte[] input) {
// return Base64.encodeBase64URLSafe(input);
// }
/** /**
* Base64解码. * Base64解码.
@@ -94,7 +90,7 @@ public class EncodeUtils {
* Base64解码. * Base64解码.
*/ */
public static String decodeBase64String(String input) { public static String decodeBase64String(String input) {
if (StringUtils.isBlank(input)){ if (StringUtils.isBlank(input)) {
return StringUtils.EMPTY; return StringUtils.EMPTY;
} }
return new String(Base64.decodeBase64(input.getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8); return new String(Base64.decodeBase64(input.getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8);
@@ -150,7 +146,7 @@ public class EncodeUtils {
* URL 编码, Encode默认为UTF-8. * URL 编码, Encode默认为UTF-8.
*/ */
public static String encodeUrl(String part, String encoding) { public static String encodeUrl(String part, String encoding) {
if (part == null){ if (part == null) {
return null; return null;
} }
try { try {
@@ -171,7 +167,7 @@ public class EncodeUtils {
* URL 解码, Encode默认为UTF-8. * URL 解码, Encode默认为UTF-8.
*/ */
public static String decodeUrl(String part, String encoding) { public static String decodeUrl(String part, String encoding) {
if (part == null){ if (part == null) {
return null; return null;
} }
try { try {
@@ -199,6 +195,7 @@ public class EncodeUtils {
/** /**
* XSS 非法字符过滤，内容以<!--HTML-->开头的用以下规则（保留标签） * XSS 非法字符过滤，内容以<!--HTML-->开头的用以下规则（保留标签）
*
* @author ThinkGem * @author ThinkGem
*/ */
public static String xssFilter(String text) { public static String xssFilter(String text) {
@@ -207,59 +204,39 @@ public class EncodeUtils {
/** /**
* XSS 非法字符过滤，内容以<!--HTML-->开头的用以下规则（保留标签） * XSS 非法字符过滤，内容以<!--HTML-->开头的用以下规则（保留标签）
*
* @author ThinkGem * @author ThinkGem
*/ */
public static String xssFilter(String text, HttpServletRequest request) { public static String xssFilter(String text, HttpServletRequest request) {
request = (request != null ? request : ServletUtils.getRequest()); // 获取当前请求对象（优先级：入参 > 上下文获取）
if (request != null && StringUtils.containsAny(request.getRequestURI(), ServletUtils.XSS_FILE_EXCLUDE_URI)) { HttpServletRequest currentRequest = (request != null) ? request : ServletUtils.getRequest();
// 排除指定URI的过滤
if (currentRequest != null && StringUtils.containsAny(currentRequest.getRequestURI(), ServletUtils.XSS_FILE_EXCLUDE_URI)) {
return text; return text;
} }
String oriValue = StringUtils.trim(text); // 空值处理
if (text != null){ if (text == null) {
String value = oriValue;
for (Pattern pattern : xssPatterns) {
Matcher matcher = pattern.matcher(value);
if (matcher.find()) {
value = matcher.replaceAll(StringUtils.EMPTY);
}
}
// 如果开始不是HTML，XML，JOSN格式，则再进行HTML的 "、<、> 转码。
if (!StringUtils.startsWithIgnoreCase(value, "<!--HTML-->") // HTML
&& !StringUtils.startsWithIgnoreCase(value, "<?xml ") // XML
&& !(StringUtils.startsWith(value, "{") && StringUtils.endsWith(value, "}")) // JSON Object
&& !(StringUtils.startsWith(value, "[") && StringUtils.endsWith(value, "]")) // JSON Array
){
StringBuilder sb = new StringBuilder();
for (int i = 0; i < value.length(); i++) {
char c = value.charAt(i);
switch (c) {
case '>':
sb.append("＞");
break;
case '<':
sb.append("＜");
break;
case '\'':
sb.append("＇");
break;
case '\"':
sb.append("＂");
break;
default:
sb.append(c);
break;
}
}
value = sb.toString();
}
if (logger.isInfoEnabled() && !value.equals(oriValue)){
logger.info("xssFilter: {} <=<=<= {} source: {}", value, text,
request != null ? request.getRequestURL() : "common");
}
return value;
}
return null; return null;
} }
// 去除首尾空格，保留原始值用于日志对比
String originalValue = StringUtils.trim(text);
String filteredValue = originalValue;
// 执行XSS正则过滤
if (!filteredValue.isEmpty()) {
for (Pattern pattern : xssPatterns) {
Matcher matcher = pattern.matcher(filteredValue);
if (matcher.find()) {
filteredValue = matcher.replaceAll(StringUtils.EMPTY);
}
}
}
// 记录过滤日志（仅当内容有变化时）
if (logger.isInfoEnabled() && !filteredValue.equals(originalValue)) {
String requestUrl = currentRequest != null ? currentRequest.getRequestURL().toString() : "common";
logger.info("xssFilter: {} <=<=<= {} source: {}", filteredValue, text, requestUrl);
}
return filteredValue;
}
// 预编译SQL过滤正则表达式 // 预编译SQL过滤正则表达式
private static final Pattern sqlPattern = Pattern.compile( private static final Pattern sqlPattern = Pattern.compile(
@@ -271,18 +248,20 @@ public class EncodeUtils {
/** /**
* SQL过滤，防止注入，传入参数输入有select相关代码，替换空。 * SQL过滤，防止注入，传入参数输入有select相关代码，替换空。
*
* @author ThinkGem * @author ThinkGem
*/ */
public static String sqlFilter(String text){ public static String sqlFilter(String text) {
return sqlFilter(text, "common"); return sqlFilter(text, "common");
} }
/** /**
* SQL过滤，防止注入，传入参数输入有select相关代码，替换空。 * SQL过滤，防止注入，传入参数输入有select相关代码，替换空。
*
* @author ThinkGem * @author ThinkGem
*/ */
public static String sqlFilter(String text, String source){ public static String sqlFilter(String text, String source) {
if (text != null){ if (text != null) {
String value = text; String value = text;
if (StringUtils.inString(source, "simple", "orderBy")) { if (StringUtils.inString(source, "simple", "orderBy")) {
Matcher matcher = simplePattern.matcher(value); Matcher matcher = simplePattern.matcher(value);
@@ -300,7 +279,7 @@ public class EncodeUtils {
value = matcher.replaceAll(StringUtils.EMPTY); value = matcher.replaceAll(StringUtils.EMPTY);
} }
} }
if (logger.isWarnEnabled() && !value.equals(text)){ if (logger.isWarnEnabled() && !value.equals(text)) {
logger.info("sqlFilter: {} <=<=<= {} source: {}", value, text, source); logger.info("sqlFilter: {} <=<=<= {} source: {}", value, text, source);
return StringUtils.EMPTY; return StringUtils.EMPTY;
} }
@@ -316,8 +295,8 @@ public class EncodeUtils {
/** /**
* 手机号码进行掩码处理 * 手机号码进行掩码处理
*/ */
public static String mobileMask(String mobile){ public static String mobileMask(String mobile) {
if (StringUtils.isBlank(mobile)){ if (StringUtils.isBlank(mobile)) {
return mobile; return mobile;
} }
return mobilePattern.matcher(mobile).replaceAll("$1****$3"); return mobilePattern.matcher(mobile).replaceAll("$1****$3");
@@ -326,8 +305,8 @@ public class EncodeUtils {
/** /**
* 对电子邮箱进行掩码处理 * 对电子邮箱进行掩码处理
*/ */
public static String emailMask(String email){ public static String emailMask(String email) {
if (StringUtils.isBlank(email)){ if (StringUtils.isBlank(email)) {
return email; return email;
} }
return emailPattern.matcher(email).replaceAll("$1****$3$4"); return emailPattern.matcher(email).replaceAll("$1****$3$4");

2
web-api/src/main/java/com/jeesite/modules/app/utils/MysqlUtils.java
View File

@@ -214,8 +214,8 @@ public class MysqlUtils {
public static ExecResult getExecResult(BizDbConfig dbConfig, String sql) { public static ExecResult getExecResult(BizDbConfig dbConfig, String sql) {
try { try {
EXEC_FILE = null;
Connection conn = getConnection(dbConfig.getDbIp(), dbConfig.getDbPort(), dbConfig.getDbUsername(), dbConfig.getDbPassword()); Connection conn = getConnection(dbConfig.getDbIp(), dbConfig.getDbPort(), dbConfig.getDbUsername(), dbConfig.getDbPassword());
Statement statement = conn.createStatement(); Statement statement = conn.createStatement();
boolean isQuery = sql.trim().toUpperCase().startsWith("SELECT"); boolean isQuery = sql.trim().toUpperCase().startsWith("SELECT");