From 9669685464447a0757a8ded7848d16319eb002ee Mon Sep 17 00:00:00 2001 From: zer0Black <694429613@qq.com> Date: Sat, 9 Apr 2022 11:14:29 +0800 Subject: [PATCH] =?UTF-8?q?=E3=80=90=E4=BF=AE=E6=94=B9=E3=80=91=E5=90=84?= =?UTF-8?q?=E7=B1=BBbug=E4=BF=AE=E5=A4=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../jero/common/util/SqlInjectionUtil.java | 21 ++++++++++++ .../com/jero/config/shiro/ShiroConfig.java | 2 +- .../system/controller/CommonController.java | 6 ++++ jero-boot/pom.xml | 3 +- jero-web/package.json | 4 +-- .../components/jero/JEasyCron/EasyCron.vue | 6 +++- .../components/jero/JEasyCron/tabs/const.js | 16 ++++----- .../components/jero/JEasyCron/tabs/week.vue | 14 ++++---- .../JSelectBizComponentModal.vue | 20 ++++++++--- .../jerobiz/modal/JSelectUserByDepModal.vue | 33 +++++++++++++++---- jero-web/src/components/page/GlobalHeader.vue | 4 +-- jero-web/src/mixins/JeroListMixin.js | 3 ++ 12 files changed, 100 insertions(+), 32 deletions(-) diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java index a635ffe3..e2d1ef84 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/SqlInjectionUtil.java @@ -4,6 +4,7 @@ import cn.hutool.crypto.SecureUtil; import lombok.extern.slf4j.Slf4j; import com.jero.common.exception.JeroBootException; import javax.servlet.http.HttpServletRequest; +import java.util.regex.Pattern; /** * sql注入处理工具类 @@ -51,6 +52,8 @@ public class SqlInjectionUtil { } // 统一转为小写 value = value.toLowerCase(); + value = value.replaceAll("/\\*.*\\*/",""); + String[] xssArr = xssStr.split("\\|"); for (int i = 0; i < xssArr.length; i++) { if (value.indexOf(xssArr[i]) > -1) { @@ -59,6 +62,9 @@ public class SqlInjectionUtil { throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); } } + if(Pattern.matches("show\\s+tables", value)){ + throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + } return; } @@ -76,6 +82,8 @@ public class SqlInjectionUtil { } // 统一转为小写 value = value.toLowerCase(); + value = value.replaceAll("/\\*.*\\*/",""); + for (int i = 0; i < xssArr.length; i++) { if (value.indexOf(xssArr[i]) > -1) { log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); @@ -83,6 +91,9 @@ public class SqlInjectionUtil { throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); } } + if(Pattern.matches("show\\s+tables", value)){ + throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + } } return; } @@ -101,6 +112,8 @@ public class SqlInjectionUtil { } // 统一转为小写 value = value.toLowerCase(); + value = value.replaceAll("/\\*.*\\*/",""); + for (int i = 0; i < xssArr.length; i++) { if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); @@ -108,6 +121,9 @@ public class SqlInjectionUtil { throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); } } + if(Pattern.matches("show\\s+tables", value)){ + throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + } return; } @@ -126,6 +142,8 @@ public class SqlInjectionUtil { } // 统一转为小写 value = value.toLowerCase(); + value = value.replaceAll("/\\*.*\\*/",""); + for (int i = 0; i < xssArr.length; i++) { if (value.indexOf(xssArr[i]) > -1 || value.startsWith(xssArr[i].trim())) { log.error("请注意，存在SQL注入关键词---> {}", xssArr[i]); @@ -133,6 +151,9 @@ public class SqlInjectionUtil { throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); } } + if(Pattern.matches("show\\s+tables", value)){ + throw new RuntimeException("请注意，值可能存在SQL注入风险!--->" + value); + } return; } diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/ShiroConfig.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/ShiroConfig.java index 15d3d9c5..25f60502 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/ShiroConfig.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/ShiroConfig.java @@ -58,7 +58,7 @@ public class ShiroConfig { * 2、当设置多个过滤器时，全部验证通过，才视为通过 * 3、部分过滤器可指定参数，如perms，roles */ - @Bean("shiroFilter") + @Bean("shiroFilterFactoryBean") public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) { CustomShiroFilterFactoryBean shiroFilterFactoryBean = new CustomShiroFilterFactoryBean(); shiroFilterFactoryBean.setSecurityManager(securityManager); diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java index 57b43b63..cf756a01 100644 --- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java +++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java @@ -83,6 +83,12 @@ public class CommonController { Result result = new Result<>(); String savePath = ""; String bizPath = request.getParameter("biz"); + + //sys/common/upload接口存在任意文件上传漏洞 + if (oConvertUtils.isNotEmpty(bizPath) && (bizPath.contains("../") || bizPath.contains("..\\"))) { + throw new JeroBootException("上传目录bizPath，格式非法！"); + } + MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request; // 获取上传文件对象 MultipartFile file = multipartRequest.getFile("file"); diff --git a/jero-boot/pom.xml b/jero-boot/pom.xml index d3ec6a1a..252cd16b 100644 --- a/jero-boot/pom.xml +++ b/jero-boot/pom.xml @@ -36,7 +36,7 @@ 2.6 2.1.0 3.11.2 - 1.7.1 + 1.8.0 3.11.0 3.1.0 1.3.6 @@ -44,6 +44,7 @@ 1.3.4 1.6.1 7.4.0 + 2.15.0 diff --git a/jero-web/package.json b/jero-web/package.json index ed4e1430..bd699f19 100644 --- a/jero-web/package.json +++ b/jero-web/package.json @@ -11,7 +11,6 @@ }, "dependencies": { "@antv/data-set": "^0.11.4", - "@tinymce/tinymce-vue": "^2.1.0", "@toast-ui/editor": "^2.1.2", "ant-design-vue": "^1.7.2", "china-area-data": "^5.0.1", @@ -29,7 +28,8 @@ "lodash.pick": "^4.4.0", "md5": "^2.2.1", "nprogress": "^0.2.0", - "tinymce": "^5.3.2", + "@tinymce/tinymce-vue": "2.1.0", + "tinymce": "5.4.1", "viser-vue": "^2.4.8", "vue": "^2.6.10", "vue-area-linkage": "^5.1.0", diff --git a/jero-web/src/components/jero/JEasyCron/EasyCron.vue b/jero-web/src/components/jero/JEasyCron/EasyCron.vue index 73ef4872..3034e168 100644 --- a/jero-web/src/components/jero/JEasyCron/EasyCron.vue +++ b/jero-web/src/components/jero/JEasyCron/EasyCron.vue @@ -144,8 +144,12 @@ export default { const v = this.cronValue_c if (this.hideYear || this.hideSecond) return v const vs = v.split(' ') + if (vs.length >= 6) { + // 将 Quartz 星期 的规则转换为 CronParser 的规则 + vs[5] = this.convertQuartzWeekToCParser(vs[5]) + } return vs.slice(0, vs.length - 1).join(' ') - } + }, }, watch: { cronValue(newVal, oldVal) { diff --git a/jero-web/src/components/jero/JEasyCron/tabs/const.js b/jero-web/src/components/jero/JEasyCron/tabs/const.js index e076ee18..67cfa75a 100644 --- a/jero-web/src/components/jero/JEasyCron/tabs/const.js +++ b/jero-web/src/components/jero/JEasyCron/tabs/const.js @@ -1,11 +1,11 @@ export const WEEK_MAP_EN = { - 'SUN': '0', - 'MON': '1', - 'TUE': '2', - 'WED': '3', - 'THU': '4', - 'FRI': '5', - 'SAT': '6' + 'SUN': '1', + 'MON': '2', + 'TUE': '3', + 'WED': '4', + 'THU': '5', + 'FRI': '6', + 'SAT': '7' } export const replaceWeekName = (c) => { @@ -14,7 +14,7 @@ export const replaceWeekName = (c) => { Object.keys(WEEK_MAP_EN).forEach(k => { c = c.replace(new RegExp(k, 'g'), WEEK_MAP_EN[k]) }) - c = c.replace(new RegExp('7', 'g'), '0') + // c = c.replace(new RegExp('7', 'g'), '0') } // console.info('after: ' + c) return c diff --git a/jero-web/src/components/jero/JEasyCron/tabs/week.vue b/jero-web/src/components/jero/JEasyCron/tabs/week.vue index 1b8b2b2a..1f1b6041 100644 --- a/jero-web/src/components/jero/JEasyCron/tabs/week.vue +++ b/jero-web/src/components/jero/JEasyCron/tabs/week.vue @@ -51,14 +51,14 @@ import mixin from './mixin' import { replaceWeekName, WEEK_MAP_EN } from './const.js' const WEEK_MAP = { - '周一': 1, - '周二': 2, - '周三': 3, - '周四': 4, - '周五': 5, - '周六': 6, + '周一': 2, + '周二': 3, + '周三': 4, + '周四': 5, + '周五': 6, + '周六': 7, // 按照国人习惯，将周日放到每周的最后一天 - '周日': 7, + '周日': 1, } export default { diff --git a/jero-web/src/components/jerobiz/JSelectBizComponent/JSelectBizComponentModal.vue b/jero-web/src/components/jerobiz/JSelectBizComponent/JSelectBizComponentModal.vue index 33a0ded3..4cd452e1 100644 --- a/jero-web/src/components/jerobiz/JSelectBizComponent/JSelectBizComponentModal.vue +++ b/jero-web/src/components/jerobiz/JSelectBizComponent/JSelectBizComponentModal.vue @@ -62,8 +62,9 @@ import { getAction } from '@/api/manage' import Ellipsis from '@/components/Ellipsis' import { JeroListMixin } from '@/mixins/JeroListMixin' - import { cloneObject, pushIfNotExist } from '@/utils/util' + import { pushIfNotExist } from '@/utils/util' import JSelectBizQueryItem from './JSelectBizQueryItem' + import {cloneDeep} from 'lodash' export default { name: 'JSelectBizComponentModal', @@ -177,11 +178,22 @@ computed: { // 表头 innerColumns() { - let columns = cloneObject(this.columns) + let columns = cloneDeep(this.columns) columns.forEach(column => { // 给所有的列加上过长裁剪 if (this.ellipsisLength !== -1) { - column.customRender = (text) => this.renderEllipsis(text) + let myCustomRender = column.customRender + column.customRender = (text, record, index) => { + let value = text + if (typeof myCustomRender === 'function') { + // noinspection JSVoidFunctionReturnValueUsed + value = myCustomRender(text, record, index) + } + if (typeof value === 'string') { + return this.renderEllipsis(value) + } + return value + } } }) return columns @@ -192,7 +204,7 @@ deep: true, immediate: true, handler(val) { - this.innerValue = cloneObject(val) + this.innerValue = cloneDeep(val) this.selectedRowKeys = [] this.valueWatchHandler(val) this.queryOptionsByValue(val) diff --git a/jero-web/src/components/jerobiz/modal/JSelectUserByDepModal.vue b/jero-web/src/components/jerobiz/modal/JSelectUserByDepModal.vue index 30c1fac5..dcfc77a5 100644 --- a/jero-web/src/components/jerobiz/modal/JSelectUserByDepModal.vue +++ b/jero-web/src/components/jerobiz/modal/JSelectUserByDepModal.vue @@ -21,8 +21,8 @@ :dropdownStyle="{maxHeight:'200px',overflow:'auto'}" :treeData="departTree" :expandAction="false" - :expandedKeys.sync="expandedKeys" @select="onDepSelect" + :load-data="onLoadDepartment" /> @@ -63,7 +63,7 @@