KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

框架完善

Browse Source
This commit is contained in:
梁琦涛
2023-04-12 16:59:40 +08:00
parent a247d15420
commit 854945db2f
6 changed files with 114 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/cors/CorsFilter.java
+4 -7
View File
@@ -2,8 +2,6 @@ package com.jero.config.filter.cors;
import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
@@ -20,8 +18,6 @@ import java.util.Objects;
@WebFilter(urlPatterns = {"/verifyCode/**"})
public class CorsFilter implements Filter {
private static final Log LOGGER = LogFactory.getLog(CorsFilter.class);
private final String originIp;
private final List<String> notFilter;
@@ -34,7 +30,7 @@ public class CorsFilter implements Filter {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
// do other
}
@Override
@@ -62,9 +58,9 @@ public class CorsFilter implements Filter {
responseInfo(request, response, chain);
}
public boolean isMSBrowser(HttpServletRequest request) {
String[] IEBrowserSignals = {"MSIE", "Trident"};
String[] ieBrowserSignals = {"MSIE", "Trident"};
String userAgent = request.getHeader("User-Agent");
for (String signal : IEBrowserSignals) {
for (String signal : ieBrowserSignals) {
if (userAgent.contains(signal)){
return true;
}
@@ -87,6 +83,7 @@ public class CorsFilter implements Filter {
@Override
public void destroy() {
// do other
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java
+7 -6
View File
@@ -83,10 +83,10 @@ public class CsrfFilter implements Filter {
String refHost = "";
referUrl = referUrl.toLowerCase();
if (referUrl.startsWith("http://")) {
int i = referUrl.substring(7).indexOf("/");
int i = referUrl.indexOf("/", 7) - 7;
refHost = referUrl.substring(7,i+7);
} else if (referUrl.startsWith("https://")) {
int i = referUrl.substring(8).indexOf("/");
int i = referUrl.indexOf("/", 8) - 8;
refHost = referUrl.substring(8,i+8);
}
@@ -108,14 +108,15 @@ public class CsrfFilter implements Filter {
* @return
*/
public String getIp(HttpServletRequest request) {
String unknown = "unknown";
String ip = request.getHeader("x-forwarded-for");
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) {
ip = request.getHeader("Proxy-Client-IP");
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) {
ip = request.getHeader("WL-Proxy-Client-IP");
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) {
ip = request.getRemoteAddr();
}
if (ip.equals("0:0:0:0:0:0:0:1")) {
@@ -125,6 +126,6 @@ public class CsrfFilter implements Filter {
}
@Override
public void destroy() {
// do other
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/HTMLFilter.java
+86 -134
View File
@@ -6,8 +6,12 @@
package com.jero.config.filter.xss;
import cn.hutool.core.lang.Console;
import org.jetbrains.annotations.Nullable;
import java.util.*;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;
import java.util.regex.Matcher;
@@ -17,7 +21,6 @@ import java.util.regex.Pattern;
* @author hzwl
*/
public final class HTMLFilter {
private static final int REGEX_FLAGS_SI = 34;
private static final Pattern P_COMMENTS = Pattern.compile("<!--(.*?)-->", 32);
private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", 34);
private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", 32);
@@ -28,21 +31,16 @@ public final class HTMLFilter {
private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", 34);
private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?");
private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?");
private static final Pattern P_ENCODE = Pattern.compile("%([0-9a-f]{2});?");
private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))");
private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+?)(<|$)", 32);
private static final Pattern P_END_ARROW = Pattern.compile("^>");
private static final Pattern P_BODY_TO_END = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_XML_CONTENT = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+)(<|$)", 32);
private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_AMP = Pattern.compile("&");
private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']");
private static final Pattern P_LEFT_ARROW = Pattern.compile("<");
private static final Pattern P_RIGHT_ARROW = Pattern.compile(">");
private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>");
private static final ConcurrentMap<String, Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap();
private static final ConcurrentMap<String, Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap();
private static final ConcurrentMap<String, Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap<>();
private static final ConcurrentMap<String, Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap<>();
private final Map<String, List<String>> vAllowed;
private final Map<String, Integer> vTagCounts;
private final String[] vSelfClosingTags;
@@ -57,75 +55,39 @@ public final class HTMLFilter {
private boolean vDebug;
private final boolean alwaysMakeTags;
public HTMLFilter() {
this.vTagCounts = new HashMap();
String strong = "strong";
this.vTagCounts = new HashMap<>();
this.vDebug = false;
this.vAllowed = new HashMap();
ArrayList<String> a_atts = new ArrayList();
a_atts.add("href");
a_atts.add("target");
this.vAllowed.put("a", a_atts);
ArrayList<String> img_atts = new ArrayList();
img_atts.add("src");
img_atts.add("width");
img_atts.add("height");
img_atts.add("alt");
this.vAllowed.put("img", img_atts);
ArrayList<String> no_atts = new ArrayList();
this.vAllowed.put("b", no_atts);
this.vAllowed.put("strong", no_atts);
this.vAllowed.put("i", no_atts);
this.vAllowed.put("em", no_atts);
this.vAllowed = new HashMap<>();
ArrayList<String> aAtts = new ArrayList<>();
aAtts.add("href");
aAtts.add("target");
this.vAllowed.put("a", aAtts);
ArrayList<String> imgAtts = new ArrayList<>();
imgAtts.add("src");
imgAtts.add("width");
imgAtts.add("height");
imgAtts.add("alt");
this.vAllowed.put("img", imgAtts);
ArrayList<String> noAtts = new ArrayList<>();
this.vAllowed.put("b", noAtts);
this.vAllowed.put(strong, noAtts);
this.vAllowed.put("i", noAtts);
this.vAllowed.put("em", noAtts);
this.vSelfClosingTags = new String[]{"img"};
this.vNeedClosingTags = new String[]{"a", "b", "strong", "i", "em"};
this.vNeedClosingTags = new String[]{"a", "b", strong, "i", "em"};
this.vDisallowed = new String[0];
this.vAllowedProtocols = new String[]{"http", "mailto", "https"};
this.vProtocolAtts = new String[]{"src", "href"};
this.vRemoveBlanks = new String[]{"a", "b", "strong", "i", "em"};
this.vRemoveBlanks = new String[]{"a", "b", strong, "i", "em"};
this.vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"};
this.stripComment = true;
this.encodeQuotes = true;
this.alwaysMakeTags = true;
}
public HTMLFilter(boolean debug) {
this();
this.vDebug = debug;
}
public HTMLFilter(Map<String, Object> conf) {
this.vTagCounts = new HashMap();
this.vDebug = false;
assert conf.containsKey("vAllowed") : "configuration requires vAllowed";
assert conf.containsKey("vSelfClosingTags") : "configuration requires vSelfClosingTags";
assert conf.containsKey("vNeedClosingTags") : "configuration requires vNeedClosingTags";
assert conf.containsKey("vDisallowed") : "configuration requires vDisallowed";
assert conf.containsKey("vAllowedProtocols") : "configuration requires vAllowedProtocols";
assert conf.containsKey("vProtocolAtts") : "configuration requires vProtocolAtts";
assert conf.containsKey("vRemoveBlanks") : "configuration requires vRemoveBlanks";
assert conf.containsKey("vAllowedEntities") : "configuration requires vAllowedEntities";
this.vAllowed = Collections.unmodifiableMap((HashMap)conf.get("vAllowed"));
this.vSelfClosingTags = (String[])((String[])conf.get("vSelfClosingTags"));
this.vNeedClosingTags = (String[])((String[])conf.get("vNeedClosingTags"));
this.vDisallowed = (String[])((String[])conf.get("vDisallowed"));
this.vAllowedProtocols = (String[])((String[])conf.get("vAllowedProtocols"));
this.vProtocolAtts = (String[])((String[])conf.get("vProtocolAtts"));
this.vRemoveBlanks = (String[])((String[])conf.get("vRemoveBlanks"));
this.vAllowedEntities = (String[])((String[])conf.get("vAllowedEntities"));
this.stripComment = conf.containsKey("stripComment") ? (Boolean)conf.get("stripComment") : true;
this.encodeQuotes = conf.containsKey("encodeQuotes") ? (Boolean)conf.get("encodeQuotes") : true;
this.alwaysMakeTags = conf.containsKey("alwaysMakeTags") ? (Boolean)conf.get("alwaysMakeTags") : true;
}
private void reset() {
this.vTagCounts.clear();
}
@@ -142,7 +104,6 @@ public final class HTMLFilter {
}
public static String htmlSpecialChars(String s) {
// String result = regexReplace(P_AMP, "&amp;", s);
String result = regexReplace(P_QUOTE, "&quot;", s);
result = regexReplace(P_LEFT_ARROW, "&lt;", result);
result = regexReplace(P_RIGHT_ARROW, "&gt;", result);
@@ -161,20 +122,10 @@ public final class HTMLFilter {
this.debug(" checkTags: " + s);
s = this.processRemoveBlanks(s);
this.debug("processRemoveBlanks: " + s);
// s = this.validateEntities(s);
// this.debug(" validateEntites: " + s);
this.debug("************************************************\n\n");
return s;
}
public boolean isAlwaysMakeTags() {
return this.alwaysMakeTags;
}
public boolean isStripComments() {
return this.stripComment;
}
private String escapeComments(String s) {
Matcher m = P_COMMENTS.matcher(s);
StringBuffer buf = new StringBuffer();
@@ -189,9 +140,7 @@ public final class HTMLFilter {
private String balanceHTML(String s) {
if (this.alwaysMakeTags) {
/* s = regexReplace(P_END_ARROW, "", s);
s = regexReplace(P_BODY_TO_END, "<$1>", s);
s = regexReplace(P_XML_CONTENT, "$1<$2", s);*/
// do other
} else {
s = regexReplace(P_STRAY_LEFT_ARROW, "&lt;$1", s);
s = regexReplace(P_STRAY_RIGHT_ARROW, "$1$2&gt;<", s);
@@ -213,14 +162,9 @@ public final class HTMLFilter {
m.appendTail(buf);
StringBuilder sBuilder = new StringBuilder(buf.toString());
Iterator var5 = this.vTagCounts.keySet().iterator();
while(var5.hasNext()) {
String key = (String)var5.next();
for(int ii = 0; ii < (Integer)this.vTagCounts.get(key); ++ii) {
sBuilder.append("</").append(key).append(">");
}
for (Map.Entry<String, Integer> entry : this.vTagCounts.entrySet()) {
sBuilder.append("</").append(entry.getKey()).append(">");
}
s = sBuilder.toString();
@@ -238,19 +182,19 @@ public final class HTMLFilter {
P_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?></" + tag + ">"));
}
result = regexReplace((Pattern)P_REMOVE_PAIR_BLANKS.get(tag), "", result);
result = regexReplace(P_REMOVE_PAIR_BLANKS.get(tag), "", result);
if (!P_REMOVE_SELF_BLANKS.containsKey(tag)) {
P_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?/>"));
}
result = regexReplace((Pattern)P_REMOVE_SELF_BLANKS.get(tag), "", result);
result = regexReplace(P_REMOVE_SELF_BLANKS.get(tag), "", result);
}
return result;
}
private static String regexReplace(Pattern regex_pattern, String replacement, String s) {
Matcher m = regex_pattern.matcher(s);
private static String regexReplace(Pattern regexPattern, String replacement, String s) {
Matcher m = regexPattern.matcher(s);
return m.replaceAll(replacement);
}
@@ -260,7 +204,7 @@ public final class HTMLFilter {
if (m.find()) {
name = m.group(1).toLowerCase();
if (this.allowed(name) && !inArray(name, this.vSelfClosingTags) && this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) - 1);
this.vTagCounts.put(name, this.vTagCounts.get(name) - 1);
return "</" + name + ">";
}
}
@@ -279,52 +223,62 @@ public final class HTMLFilter {
StringBuilder params = new StringBuilder();
Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body);
Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body);
List<String> paramNames = new ArrayList();
ArrayList paramValues = new ArrayList();
List<String> paramNames = new ArrayList<>();
ArrayList<String> paramValues = new ArrayList<>();
while(m2.find()) {
paramNames.add(m2.group(1));
paramValues.add(m2.group(3));
}
getAppend(name, params, m2, m3, paramNames, paramValues);
while(m3.find()) {
paramNames.add(m3.group(1));
paramValues.add(m3.group(3));
}
for(int ii = 0; ii < paramNames.size(); ++ii) {
String paramName = ((String)paramNames.get(ii)).toLowerCase();
String paramValue = (String)paramValues.get(ii);
if (this.allowedAttribute(name, paramName)) {
if (inArray(paramName, this.vProtocolAtts)) {
paramValue = this.processParamProtocol(paramValue);
}
params.append(' ').append(paramName).append("=\"").append(paramValue).append("\"");
}
}
if (inArray(name, this.vSelfClosingTags)) {
ending = " /";
}
if (inArray(name, this.vNeedClosingTags)) {
ending = "";
}
if (ending != null && ending.length() >= 1) {
ending = " /";
} else if (this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) + 1);
} else {
this.vTagCounts.put(name, 1);
}
ending = getString(name, ending);
return "<" + name + params + ending + ">";
}
}
}
@Nullable
private String getString(String name, String ending) {
if (inArray(name, this.vSelfClosingTags)) {
ending = " /";
}
if (inArray(name, this.vNeedClosingTags)) {
ending = "";
}
if (ending != null && ending.length() >= 1) {
ending = " /";
} else if (this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, this.vTagCounts.get(name) + 1);
} else {
this.vTagCounts.put(name, 1);
}
return ending;
}
private void getAppend(String name, StringBuilder params, Matcher m2, Matcher m3, List<String> paramNames, ArrayList<String> paramValues) {
while(m2.find()) {
paramNames.add(m2.group(1));
paramValues.add(m2.group(3));
}
while(m3.find()) {
paramNames.add(m3.group(1));
paramValues.add(m3.group(3));
}
for(int ii = 0; ii < paramNames.size(); ++ii) {
String paramName = paramNames.get(ii).toLowerCase();
String paramValue = paramValues.get(ii);
if (this.allowedAttribute(name, paramName)) {
if (inArray(paramName, this.vProtocolAtts)) {
paramValue = this.processParamProtocol(paramValue);
}
params.append(' ').append(paramName).append("=\"").append(paramValue).append("\"");
}
}
}
private String processParamProtocol(String s) {
s = this.decodeEntities(s);
Matcher m = P_PROTOCOL.matcher(s);
@@ -365,9 +319,7 @@ public final class HTMLFilter {
}
m.appendTail(buf);
s = buf.toString();
buf = new StringBuffer();
// m = P_ENCODE.matcher(s);
while(m.find()) {
match = m.group(1);
@@ -441,6 +393,6 @@ public final class HTMLFilter {
}
private boolean allowedAttribute(String name, String paramName) {
return this.allowed(name) && (this.vAllowed.isEmpty() || ((List)this.vAllowed.get(name)).contains(paramName));
return this.allowed(name) && (this.vAllowed.isEmpty() || this.vAllowed.get(name).contains(paramName));
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java
+4 -2
View File
@@ -5,10 +5,12 @@
package com.jero.config.filter.xss;
import com.jero.common.exception.JeroBootException;
import org.apache.commons.lang.StringUtils;
public class SqlFilter {
public SqlFilter() {
private SqlFilter(){
}
public static String sqlInject(String str) {
@@ -23,7 +25,7 @@ public class SqlFilter {
for(int var4 = 0; var4 < var3; ++var4) {
String keyword = var2[var4];
if (StringUtils.indexOfIgnoreCase(str, keyword + " ") != -1) {
throw new RuntimeException("包含非法字符");
throw new JeroBootException("包含非法字符");
}
}
str = StringUtils.replace(str, "Line_Break", "\\n");
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssFilter.java
+2 -1
View File
@@ -17,7 +17,7 @@ public class XssFilter implements Filter {
@Override
public void init(FilterConfig config) throws ServletException {
// do other
}
@Override
@@ -40,6 +40,7 @@ public class XssFilter implements Filter {
@Override
public void destroy() {
// do other
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssHttpServletRequestWrapper.java
+11 -15
View File
@@ -14,7 +14,7 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.util.Iterator;
import java.nio.charset.StandardCharsets;
import java.util.LinkedHashMap;
import java.util.Map;
@@ -24,7 +24,6 @@ import java.util.Map;
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
HttpServletRequest orgRequest;
private static final HTMLFilter HTML_FILTER = new HTMLFilter();
private static final SqlFilter sqlFilter = new SqlFilter();
public XssHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
@@ -37,12 +36,12 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
if (StringUtils.indexOfIgnoreCase(type, "application/json") < 0) {
return super.getInputStream();
} else {
String json = IOUtils.toString(super.getInputStream(), "utf-8");
String json = IOUtils.toString(super.getInputStream(), StandardCharsets.UTF_8);
if (StringUtils.isBlank(json)) {
return super.getInputStream();
} else {
json = this.xssSqlEncode(json);
final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes("utf-8"));
final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes(StandardCharsets.UTF_8));
return new ServletInputStream() {
@Override
public boolean isFinished() {
@@ -54,6 +53,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
}
@Override
public void setReadListener(ReadListener readListener) {
// do other
}
@Override
public int read() throws IOException {
@@ -84,25 +84,21 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
return parameters;
} else {
return null;
return new String[0];
}
}
@Override
public Map<String, String[]> getParameterMap() {
Map<String, String[]> map = new LinkedHashMap();
Map<String, String[]> map = new LinkedHashMap<>();
Map<String, String[]> parameters = super.getParameterMap();
Iterator var3 = parameters.keySet().iterator();
while(var3.hasNext()) {
String key = (String)var3.next();
String[] values = (String[])parameters.get(key);
for(int i = 0; i < values.length; ++i) {
for (Map.Entry<String, String[]> entry : parameters.entrySet()) {
String[] values = entry.getValue();
for (int i = 0; i < values.length; ++i) {
values[i] = this.xssSqlEncode(values[i]);
}
map.put(key, values);
map.put(entry.getKey(), values);
}
return map;
@@ -119,7 +115,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
}
private String xssSqlEncode(String input) {
input=input.replaceAll("%5b","[").replaceAll("%5d","]");
input=input.replace("%5b","[").replace("%5d","]");
String htmlOutput= HTML_FILTER.filter(input);
return SqlFilter.sqlInject(htmlOutput);
}