WL/laws_weilai
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

文档库--表单数据结构

Browse Source
This commit is contained in:
zhn
2022-03-14 15:56:24 +08:00
parent b7f04e477c
commit c051d51c90
13 changed files with 1033 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/es/JeroElasticsearchTemplate.java
-17
View File
@@ -280,23 +280,6 @@ public class JeroElasticsearchTemplate {
*/
public boolean saveOrUpdate(String indexName, String typeName, String dataId, JSONObject data) {
String url = this.getBaseUrl(indexName, typeName).append("/").append(dataId).append("?refresh=wait_for").toString();
/* 返回结果（仅供参考）
"createIndexA2": {
"result": "created",
"_shards": {
"total": 2,
"successful": 1,
"failed": 0
},
"_seq_no": 0,
"_index": "test_index_1",
"_type": "test_type_1",
"_id": "a2",
"_version": 1,
"_primary_term": 1
}
*/
try {
// 去掉 data 中为空的值
Set<String> keys = data.keySet();
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/HTMLFilter.java
+450
View File
@@ -0,0 +1,450 @@
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package com.jero.config.safeFilter.Xss;
import cn.hutool.core.lang.Console;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public final class HTMLFilter {
private static final int REGEX_FLAGS_SI = 34;
private static final Pattern P_COMMENTS = Pattern.compile("<!--(.*?)-->", 32);
private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", 34);
private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", 32);
private static final Pattern P_END_TAG = Pattern.compile("^/([a-z0-9]+)", 34);
private static final Pattern P_START_TAG = Pattern.compile("^([a-z0-9]+)(.*?)(/?)$", 34);
private static final Pattern P_QUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)=([\"'])(.*?)\\2", 34);
private static final Pattern P_UNQUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)(=)([^\"\\s']+)", 34);
private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", 34);
private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?");
private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?");
private static final Pattern P_ENCODE = Pattern.compile("%([0-9a-f]{2});?");
private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))");
private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+?)(<|$)", 32);
private static final Pattern P_END_ARROW = Pattern.compile("^>");
private static final Pattern P_BODY_TO_END = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_XML_CONTENT = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_AMP = Pattern.compile("&");
private static final Pattern P_PERCENT = Pattern.compile("%");
private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']");
private static final Pattern P_LEFT_ARROW = Pattern.compile("<");
private static final Pattern P_RIGHT_ARROW = Pattern.compile(">");
private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>");
private static final ConcurrentMap<String, Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap();
private static final ConcurrentMap<String, Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap();
private final Map<String, List<String>> vAllowed;
private final Map<String, Integer> vTagCounts;
private final String[] vSelfClosingTags;
private final String[] vNeedClosingTags;
private final String[] vDisallowed;
private final String[] vProtocolAtts;
private final String[] vAllowedProtocols;
private final String[] vRemoveBlanks;
private final String[] vAllowedEntities;
private final boolean stripComment;
private final boolean encodeQuotes;
private boolean vDebug;
private final boolean alwaysMakeTags;
public HTMLFilter() {
this.vTagCounts = new HashMap();
this.vDebug = false;
this.vAllowed = new HashMap();
ArrayList<String> a_atts = new ArrayList();
a_atts.add("href");
a_atts.add("target");
this.vAllowed.put("a", a_atts);
ArrayList<String> img_atts = new ArrayList();
img_atts.add("src");
img_atts.add("width");
img_atts.add("height");
img_atts.add("alt");
this.vAllowed.put("img", img_atts);
ArrayList<String> no_atts = new ArrayList();
this.vAllowed.put("b", no_atts);
this.vAllowed.put("strong", no_atts);
this.vAllowed.put("i", no_atts);
this.vAllowed.put("em", no_atts);
this.vSelfClosingTags = new String[]{"img"};
this.vNeedClosingTags = new String[]{"a", "b", "strong", "i", "em"};
this.vDisallowed = new String[0];
this.vAllowedProtocols = new String[]{"http", "mailto", "https"};
this.vProtocolAtts = new String[]{"src", "href"};
this.vRemoveBlanks = new String[]{"a", "b", "strong", "i", "em"};
this.vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"};
this.stripComment = true;
this.encodeQuotes = true;
this.alwaysMakeTags = true;
}
public HTMLFilter(boolean debug) {
this();
this.vDebug = debug;
}
public HTMLFilter(Map<String, Object> conf) {
this.vTagCounts = new HashMap();
this.vDebug = false;
assert conf.containsKey("vAllowed") : "configuration requires vAllowed";
assert conf.containsKey("vSelfClosingTags") : "configuration requires vSelfClosingTags";
assert conf.containsKey("vNeedClosingTags") : "configuration requires vNeedClosingTags";
assert conf.containsKey("vDisallowed") : "configuration requires vDisallowed";
assert conf.containsKey("vAllowedProtocols") : "configuration requires vAllowedProtocols";
assert conf.containsKey("vProtocolAtts") : "configuration requires vProtocolAtts";
assert conf.containsKey("vRemoveBlanks") : "configuration requires vRemoveBlanks";
assert conf.containsKey("vAllowedEntities") : "configuration requires vAllowedEntities";
this.vAllowed = Collections.unmodifiableMap((HashMap)conf.get("vAllowed"));
this.vSelfClosingTags = (String[])((String[])conf.get("vSelfClosingTags"));
this.vNeedClosingTags = (String[])((String[])conf.get("vNeedClosingTags"));
this.vDisallowed = (String[])((String[])conf.get("vDisallowed"));
this.vAllowedProtocols = (String[])((String[])conf.get("vAllowedProtocols"));
this.vProtocolAtts = (String[])((String[])conf.get("vProtocolAtts"));
this.vRemoveBlanks = (String[])((String[])conf.get("vRemoveBlanks"));
this.vAllowedEntities = (String[])((String[])conf.get("vAllowedEntities"));
this.stripComment = conf.containsKey("stripComment") ? (Boolean)conf.get("stripComment") : true;
this.encodeQuotes = conf.containsKey("encodeQuotes") ? (Boolean)conf.get("encodeQuotes") : true;
this.alwaysMakeTags = conf.containsKey("alwaysMakeTags") ? (Boolean)conf.get("alwaysMakeTags") : true;
}
private void reset() {
this.vTagCounts.clear();
}
private void debug(String msg) {
if (this.vDebug) {
Console.log(msg);
}
}
public static String chr(int decimal) {
return String.valueOf((char)decimal);
}
public static String htmlSpecialChars(String s) {
String result = regexReplace(P_AMP, "&amp;", s);
result = regexReplace(P_PERCENT, "&permil;", result);
result = regexReplace(P_QUOTE, "&quot;", result);
result = regexReplace(P_LEFT_ARROW, "&lt;", result);
result = regexReplace(P_RIGHT_ARROW, "&gt;", result);
return result;
}
public String filter(String input) {
this.reset();
this.debug("************************************************");
this.debug(" INPUT: " + input);
String s = this.escapeComments(input);
this.debug(" escapeComments: " + s);
s = this.balanceHTML(s);
this.debug(" balanceHTML: " + s);
s = this.checkTags(s);
this.debug(" checkTags: " + s);
s = this.processRemoveBlanks(s);
this.debug("processRemoveBlanks: " + s);
s = this.validateEntities(s);
this.debug(" validateEntites: " + s);
this.debug("************************************************\n\n");
return s;
}
public boolean isAlwaysMakeTags() {
return this.alwaysMakeTags;
}
public boolean isStripComments() {
return this.stripComment;
}
private String escapeComments(String s) {
Matcher m = P_COMMENTS.matcher(s);
StringBuffer buf = new StringBuffer();
if (m.find()) {
String match = m.group(1);
m.appendReplacement(buf, Matcher.quoteReplacement("<!--" + htmlSpecialChars(match) + "-->"));
}
m.appendTail(buf);
return buf.toString();
}
private String balanceHTML(String s) {
if (this.alwaysMakeTags) {
/* s = regexReplace(P_END_ARROW, "", s);
s = regexReplace(P_BODY_TO_END, "<$1>", s);
s = regexReplace(P_XML_CONTENT, "$1<$2", s);*/
} else {
s = regexReplace(P_STRAY_LEFT_ARROW, "&lt;$1", s);
s = regexReplace(P_STRAY_RIGHT_ARROW, "$1$2&gt;<", s);
s = regexReplace(P_BOTH_ARROWS, "", s);
}
return s;
}
private String checkTags(String s) {
Matcher m = P_TAGS.matcher(s);
StringBuffer buf = new StringBuffer();
while(m.find()) {
String replaceStr = m.group(1);
replaceStr = this.processTag(replaceStr);
m.appendReplacement(buf, Matcher.quoteReplacement(replaceStr));
}
m.appendTail(buf);
StringBuilder sBuilder = new StringBuilder(buf.toString());
Iterator var5 = this.vTagCounts.keySet().iterator();
while(var5.hasNext()) {
String key = (String)var5.next();
for(int ii = 0; ii < (Integer)this.vTagCounts.get(key); ++ii) {
sBuilder.append("</").append(key).append(">");
}
}
s = sBuilder.toString();
return s;
}
private String processRemoveBlanks(String s) {
String result = s;
String[] var3 = this.vRemoveBlanks;
int var4 = var3.length;
for(int var5 = 0; var5 < var4; ++var5) {
String tag = var3[var5];
if (!P_REMOVE_PAIR_BLANKS.containsKey(tag)) {
P_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?></" + tag + ">"));
}
result = regexReplace((Pattern)P_REMOVE_PAIR_BLANKS.get(tag), "", result);
if (!P_REMOVE_SELF_BLANKS.containsKey(tag)) {
P_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?/>"));
}
result = regexReplace((Pattern)P_REMOVE_SELF_BLANKS.get(tag), "", result);
}
return result;
}
private static String regexReplace(Pattern regex_pattern, String replacement, String s) {
Matcher m = regex_pattern.matcher(s);
return m.replaceAll(replacement);
}
private String processTag(String s) {
Matcher m = P_END_TAG.matcher(s);
String name;
if (m.find()) {
name = m.group(1).toLowerCase();
if (this.allowed(name) && !inArray(name, this.vSelfClosingTags) && this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) - 1);
return "</" + name + ">";
}
}
m = P_START_TAG.matcher(s);
if (!m.find()) {
m = P_COMMENT.matcher(s);
return !this.stripComment && m.find() ? "<" + m.group() + ">" : "";
} else {
name = m.group(1).toLowerCase();
String body = m.group(2);
String ending = m.group(3);
if (!this.allowed(name)) {
return "";
} else {
StringBuilder params = new StringBuilder();
Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body);
Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body);
List<String> paramNames = new ArrayList();
ArrayList paramValues = new ArrayList();
while(m2.find()) {
paramNames.add(m2.group(1));
paramValues.add(m2.group(3));
}
while(m3.find()) {
paramNames.add(m3.group(1));
paramValues.add(m3.group(3));
}
for(int ii = 0; ii < paramNames.size(); ++ii) {
String paramName = ((String)paramNames.get(ii)).toLowerCase();
String paramValue = (String)paramValues.get(ii);
if (this.allowedAttribute(name, paramName)) {
if (inArray(paramName, this.vProtocolAtts)) {
paramValue = this.processParamProtocol(paramValue);
}
params.append(' ').append(paramName).append("=\"").append(paramValue).append("\"");
}
}
if (inArray(name, this.vSelfClosingTags)) {
ending = " /";
}
if (inArray(name, this.vNeedClosingTags)) {
ending = "";
}
if (ending != null && ending.length() >= 1) {
ending = " /";
} else if (this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) + 1);
} else {
this.vTagCounts.put(name, 1);
}
return "<" + name + params + ending + ">";
}
}
}
private String processParamProtocol(String s) {
s = this.decodeEntities(s);
Matcher m = P_PROTOCOL.matcher(s);
if (m.find()) {
String protocol = m.group(1);
if (!inArray(protocol, this.vAllowedProtocols)) {
s = "#" + s.substring(protocol.length() + 1);
if (s.startsWith("#//")) {
s = "#" + s.substring(3);
}
}
}
return s;
}
private String decodeEntities(String s) {
StringBuffer buf = new StringBuffer();
Matcher m = P_ENTITY.matcher(s);
String match;
int decimal;
while(m.find()) {
match = m.group(1);
decimal = Integer.decode(match);
m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
}
m.appendTail(buf);
s = buf.toString();
buf = new StringBuffer();
m = P_ENTITY_UNICODE.matcher(s);
while(m.find()) {
match = m.group(1);
decimal = Integer.valueOf(match, 16);
m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
}
m.appendTail(buf);
s = buf.toString();
buf = new StringBuffer();
m = P_ENCODE.matcher(s);
while(m.find()) {
match = m.group(1);
decimal = Integer.valueOf(match, 16);
m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
}
m.appendTail(buf);
s = buf.toString();
s = this.validateEntities(s);
return s;
}
private String validateEntities(String s) {
StringBuffer buf = new StringBuffer();
Matcher m = P_VALID_ENTITIES.matcher(s);
while(m.find()) {
String one = m.group(1);
String two = m.group(2);
m.appendReplacement(buf, Matcher.quoteReplacement(this.checkEntity(one, two)));
}
m.appendTail(buf);
return this.encodeQuotes(buf.toString());
}
private String encodeQuotes(String s) {
if (!this.encodeQuotes) {
return s;
} else {
StringBuffer buf = new StringBuffer();
Matcher m = P_VALID_QUOTES.matcher(s);
while(m.find()) {
String one = m.group(1);
String two = m.group(2);
String three = m.group(3);
m.appendReplacement(buf, Matcher.quoteReplacement(one + regexReplace(P_QUOTE, "&quot;", two) + three));
}
m.appendTail(buf);
return buf.toString();
}
}
private String checkEntity(String preamble, String term) {
return ";".equals(term) && this.isValidEntity(preamble) ? '&' + preamble : "&amp;" + preamble;
}
private boolean isValidEntity(String entity) {
return inArray(entity, this.vAllowedEntities);
}
private static boolean inArray(String s, String[] array) {
String[] var2 = array;
int var3 = array.length;
for(int var4 = 0; var4 < var3; ++var4) {
String item = var2[var4];
if (item != null && item.equals(s)) {
return true;
}
}
return false;
}
private boolean allowed(String name) {
return (this.vAllowed.isEmpty() || this.vAllowed.containsKey(name)) && !inArray(name, this.vDisallowed);
}
private boolean allowedAttribute(String name, String paramName) {
return this.allowed(name) && (this.vAllowed.isEmpty() || ((List)this.vAllowed.get(name)).contains(paramName));
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/SQLFilter.java
+33
View File
@@ -0,0 +1,33 @@
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package com.jero.config.safeFilter.Xss;
import org.apache.commons.lang.StringUtils;
public class SQLFilter {
public SQLFilter() {
}
public static String sqlInject(String str) {
if (StringUtils.isBlank(str)) {
return null;
} else {
str = StringUtils.replace(str, "\\", "");
String[] keywords = new String[]{"master", "truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"};
String[] var2 = keywords;
int var3 = keywords.length;
for(int var4 = 0; var4 < var3; ++var4) {
String keyword = var2[var4];
if (StringUtils.indexOfIgnoreCase(str, keyword + " ") != -1) {
throw new RuntimeException("包含非法字符");
}
}
return str;
}
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssFilter.java
+69
View File
@@ -0,0 +1,69 @@
package com.jero.config.safeFilter.Xss;
import org.apache.commons.lang3.StringUtils;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
public class XssFilter implements Filter {
private String excludedPages;
private String[] excludedPageArray;
public XssFilter(String excludedPages) {
this.excludedPages=excludedPages;
}
public void init(FilterConfig config) throws ServletException {
if (StringUtils.isNotEmpty(this.excludedPages)) {
this.excludedPageArray = this.excludedPages.split(",");
}
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
boolean isExcludedPage = false;
if (this.isNotEmpty(this.excludedPageArray)) {
String[] excludedPages = this.excludedPageArray;
int excludedPageLength = excludedPages.length;
for(int i = 0; i < excludedPageLength; ++i) {
String page = excludedPages[i];
if (((HttpServletRequest)request).getRequestURI().contains(page)) {
isExcludedPage = true;
break;
}
}
}
if (isExcludedPage) {
chain.doFilter(request, response);
} else {
XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest)request);
chain.doFilter(xssRequest, response);
}
}
public void destroy() {
}
public static String filterNull(Object o) {
return o != null && !"null".equals(o.toString()) ? o.toString().trim() : "";
}
public static boolean isNotEmpty(Object o) {
if (o == null) {
return false;
} else {
return !"".equals(filterNull(o.toString()));
}
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssHttpServletRequestWrapper.java
+126
View File
@@ -0,0 +1,126 @@
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package com.jero.config.safeFilter.Xss;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang.StringUtils;
import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.util.Iterator;
import java.util.LinkedHashMap;
import java.util.Map;
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
HttpServletRequest orgRequest;
private static final HTMLFilter htmlFilter = new HTMLFilter();
private static final SQLFilter sqlFilter = new SQLFilter();
public XssHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
this.orgRequest = request;
}
public ServletInputStream getInputStream() throws IOException {
String type = super.getHeader("Content-Type");
if (StringUtils.indexOfIgnoreCase(type, "application/json") < 0) {
return super.getInputStream();
} else {
String json = IOUtils.toString(super.getInputStream(), "utf-8");
if (StringUtils.isBlank(json)) {
return super.getInputStream();
} else {
json = this.xssSqlEncode(json);
final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes("utf-8"));
return new ServletInputStream() {
public boolean isFinished() {
return true;
}
public boolean isReady() {
return true;
}
public void setReadListener(ReadListener readListener) {
}
public int read() throws IOException {
return bis.read();
}
};
}
}
}
public String getParameter(String name) {
String value = super.getParameter(this.xssSqlEncode(name));
if (StringUtils.isNotBlank(value)) {
value = this.xssSqlEncode(value);
}
return value;
}
public String[] getParameterValues(String name) {
String[] parameters = super.getParameterValues(name);
if (parameters != null && parameters.length != 0) {
for(int i = 0; i < parameters.length; ++i) {
parameters[i] = this.xssSqlEncode(parameters[i]);
}
return parameters;
} else {
return null;
}
}
public Map<String, String[]> getParameterMap() {
Map<String, String[]> map = new LinkedHashMap();
Map<String, String[]> parameters = super.getParameterMap();
Iterator var3 = parameters.keySet().iterator();
while(var3.hasNext()) {
String key = (String)var3.next();
String[] values = (String[])parameters.get(key);
for(int i = 0; i < values.length; ++i) {
values[i] = this.xssSqlEncode(values[i]);
}
map.put(key, values);
}
return map;
}
public String getHeader(String name) {
String value = super.getHeader(this.xssSqlEncode(name));
if (StringUtils.isNotBlank(value)) {
value = this.xssSqlEncode(value);
}
return value;
}
private String xssSqlEncode(String input) {
input=input.replaceAll("%5b","[").replaceAll("%5d","]");
String htmlOutput=input;
htmlOutput= htmlFilter.filter(input);
return SQLFilter.sqlInject(htmlOutput);
}
public HttpServletRequest getOrgRequest() {
return this.orgRequest;
}
public static HttpServletRequest getOrgRequest(HttpServletRequest request) {
return request instanceof XssHttpServletRequestWrapper ? ((XssHttpServletRequestWrapper)request).getOrgRequest() : request;
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/cors/CorsFilter.java
+100
View File
@@ -0,0 +1,100 @@
package com.jero.config.safeFilter.cors;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
import java.util.Objects;
/**
* 设置响应信息
*/
@WebFilter(urlPatterns = {"/verifyCode/**"})
public class CorsFilter implements Filter {
private static final Log LOGGER = LogFactory.getLog(CorsFilter.class);
private int size = 0;
private String origin;
private String notFilter;
public CorsFilter(String origin, String notFilter) {
this.origin = origin;
this.notFilter = notFilter;
}
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
final String origin = ((HttpServletRequest) request).getHeader("Origin");
//请求头与系统的origin不通则咔嚓
// if (Objects.nonNull(origin) || this.origin.contains(origin)){
// return;
// }
if (Objects.nonNull(origin) && !this.origin.contains(origin)){
return;
}
//获取请求路径
String url = req.getRequestURL().toString();
String[] interfaceNameArr = notFilter.split(",");
if (!isMSBrowser(req)){
for (String name : interfaceNameArr) {
//如果包含,不需要判断Origin是否合法
if(url.contains(name)){
responseInfo(request, response, chain);
// return;
}
}
}
responseInfo(request, response, chain);
}
public boolean isMSBrowser(HttpServletRequest request) {
String[] IEBrowserSignals = {"MSIE", "Trident"};
String userAgent = request.getHeader("User-Agent");
for (String signal : IEBrowserSignals) {
if (userAgent.contains(signal)){
return true;
}
}
return false;
}
private void responseInfo(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
// HttpServletResponse httpServletResponse = (HttpServletResponse) response;
// httpServletResponse.setHeader("Access-Control-Allow-Origin", origin);
// httpServletResponse.addHeader("Access-Control-Allow-Headers", "Authorization");
// httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true");
// httpServletResponse.setHeader("Access-Control-Allow-Methods", "POST, GET, HEAD, OPTIONS, PUT, DELETE");
// httpServletResponse.setHeader("Access-Control-Max-Age", "3600");
// httpServletResponse.setHeader("Content-Security-Policy", "upgrade-insecure-requests;connect-src *");
// httpServletResponse.setHeader("X-Content-Type-Options", "nosniff");
// httpServletResponse.setHeader("X-XSS-Protection", "1;mode=block");
// httpServletResponse.setHeader("Access-Control-Allow-Headers", "Origin, Accept, x-auth-token, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, authorization");
chain.doFilter(request, response);
}
@Override
public void destroy() {
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/CsrfFilter.java
+126
View File
@@ -0,0 +1,126 @@
package com.jero.config.safeFilter.csrf;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Arrays;
import java.util.Date;
import java.util.List;
/**
* CsrfFilter
*/
public class CsrfFilter implements Filter {
public CsrfFilter(String csrfList) {
this.csrfList = csrfList;
}
/**
* LOGGER
*/
private static final Log LOGGER = LogFactory.getLog(CsrfFilter.class);
/**
* 从配置文件读取的csrf白名单字符串
*/
private final String csrfList;
/**
* 白名单
*/
private List<String> whiteUrls;
/**
* size
*/
private int size = 0;
/**
* 读取文件
*
* @param filterConfig
*/
public void init(FilterConfig filterConfig) {
// 读取文件
String path = CsrfFilter.class.getResource("/").getFile();
// whiteUrls = FileUtil.readAsStringList(path + "csrfWhite.txt");
whiteUrls = Arrays.asList(csrfList.split(","));
size = whiteUrls.size();
}
/**
* @param request
* @param response
* @param chain
* @throws IOException
* @throws ServletException
*/
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
// try {
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
// 获取请求url地址
String url = req.getRequestURL().toString();
String referurl = req.getHeader("Referer");
if (isWhiteReq(referurl)) {
chain.doFilter(request, response);
} else {
req.getRequestDispatcher("/").forward(req, res);
// 记录跨站请求日志
String log = "";
String date = new SimpleDateFormat("yyyyMMddHHmmss").format(new Date());
String clientIp = RequestUtils.getClientIp(req);
log = "跨站请求---->>>" + clientIp + "||" + date + "||" + referurl + "||" + url;
LOGGER.warn(log);
}
// } catch (Exception e) {
// LOGGER.error("doFilter", e);
// }
}
/**
* 判断是否是白名单
*/
private boolean isWhiteReq(String referUrl) {
if (referUrl == null || "".equals(referUrl) || size == 0) {
return true;
} else {
String refHost = "";
referUrl = referUrl.toLowerCase();
if (referUrl.startsWith("http://")) {
refHost = referUrl.substring(7);
} else if (referUrl.startsWith("https://")) {
refHost = referUrl.substring(8);
}
for (String urlTemp : whiteUrls) {
if (refHost.contains(urlTemp.toLowerCase())) {
return true;
}
}
}
return false;
}
/**
* destroy
*/
public void destroy() {
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/RequestUtils.java
+37
View File
@@ -0,0 +1,37 @@
package com.jero.config.safeFilter.csrf;
import org.apache.commons.lang3.StringUtils;
import javax.servlet.http.HttpServletRequest;
public class RequestUtils {
public static final String LOGIN_USER = "LOGIN_USER";
public static final String LOGIN_USER_ID = "LOGIN_USER_ID";
public static final String LOGIN_ROLE_ID = "LOGIN_ROLE_ID";
/**
* 获取客户端IP地址
* @param request
* @return
*/
public static String getClientIp(HttpServletRequest request) {
String remoteAddr = "";
if (request != null) {
remoteAddr = request.getHeader("X-FORWARDED-FOR");
if (StringUtils.isEmpty(remoteAddr)) {
remoteAddr = request.getRemoteAddr();
}
}
return remoteAddr;
}
public static String getLoginUserId(HttpServletRequest request) {
return (String) request.getSession().getAttribute(LOGIN_USER_ID);
}
public static String getLoginRoleId(HttpServletRequest request) {
return (String) request.getSession().getAttribute(LOGIN_ROLE_ID);
}
}
jero-boot/jero-boot-base/jero-boot-base-generater/src/main/java/com/jero/generater/modules/online/cgform/entity/OnlCgformField.java
+9
View File
@@ -75,6 +75,15 @@ public class OnlCgformField implements Serializable {
private String queryValidType;
private String queryMustInput;
private String sortFlag;
private String isShowSearch;
public String getIsShowSearch() {
return isShowSearch;
}
public void setIsShowSearch(String isShowSearch) {
this.isShowSearch = isShowSearch;
}
public String getDictId() {
return dictId;
jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/oss/service/impl/OSSFileServiceImpl.java
+1 -1
View File
@@ -91,7 +91,7 @@ public class OSSFileServiceImpl extends ServiceImpl<OSSFileMapper, OSSFile> impl
}
}
if (flag) {
throw new JeroBootException("只能够上传Word、Excel、PDF、静态图片类型的文件。请重新选择文件！");
throw new JeroBootException("只能够上传pdf/word/excel/csv/ppt/txt/zip/rar/静态图片类型的文件。请重新选择文件！");
}
}
jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/controller/BussDocumentLibraryEOController.java
+2 -2
View File
@@ -168,7 +168,7 @@ public class BussDocumentLibraryEOController extends JeroController<BussDocument
// @RequiresPermissions("document:queryCondition")
public Result<List<Map<String,Object>>> queryCondition(@RequestParam(name="flag",required=true) String flag,
@RequestParam(name="cut",required=true) String cut) {
List<Map<String,Object>> list = bussDocumentLibraryEOService.queryCondition(flag,cut);
List<Map<String,Object>> list = bussDocumentLibraryEOService.queryCondition(flag,cut,null);
return Result.OK(list);
}
@@ -183,7 +183,7 @@ public class BussDocumentLibraryEOController extends JeroController<BussDocument
// @RequiresPermissions("document:getHeader")
public Result<List<Map<String,Object>>> getHeader(@RequestParam(name="flag",required=true) String flag,
@RequestParam(name="cut",required=true) String cut) {
List<Map<String,Object>> list = bussDocumentLibraryEOService.getHeader(flag,cut);
List<Map<String,Object>> list = bussDocumentLibraryEOService.getHeader(flag,cut,null);
return Result.OK(list);
}
jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/IBussDocumentLibraryEOService.java
+2 -2
View File
@@ -54,14 +54,14 @@ public interface IBussDocumentLibraryEOService extends IService<BussDocumentLibr
*
* @return
*/
List<Map<String, Object>> queryCondition(String flag, String cut);
List<Map<String, Object>> queryCondition(String flag, String cut,String searchFlag);
/**
* 列表表头
*
* @return
*/
List<Map<String, Object>> getHeader(String flag, String cut);
List<Map<String, Object>> getHeader(String flag, String cut,String searchFlag);
/**
* 新增表单
jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/impl/BussDocumentLibraryEOServiceImpl.java
+78 -20
View File
@@ -1,6 +1,7 @@
package com.jero.modules.document.service.impl;
import cn.hutool.core.util.ZipUtil;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.aliyuncs.utils.IOUtils;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
@@ -15,6 +16,7 @@ import com.jero.common.constant.enums.IsMustEnum;
import com.jero.common.constant.enums.MessageTypeEnum;
import com.jero.common.constant.enums.ModuleEnum;
import com.jero.common.constant.enums.YesOrNoEnum;
import com.jero.common.es.JeroElasticsearchTemplate;
import com.jero.common.exception.JeroBootException;
import com.jero.common.system.vo.LoginUser;
import com.jero.common.util.DateUtils;
@@ -136,6 +138,8 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl<BussDocumentLi
private SysCategoryServiceImpl sysCategoryService;
@Autowired
private ISysUserService sysUserService;
@Autowired
private JeroElasticsearchTemplate jeroElasticsearchTemplate;
@Resource
private WebSocket webSocket;
@Resource
@@ -254,15 +258,22 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl<BussDocumentLi
/**
* 查询条件
*
* @param flag
* @param cut
* @param searchFlag 搜索中心标识(searchFlag=search时查询的是搜索中心的查询条件)
* @return
*/
@Override
public List<Map<String, Object>> queryCondition(String flag, String cut) {
public List<Map<String, Object>> queryCondition(String flag, String cut,String searchFlag) {
List<OnlCgformField> fieldList = onlCgformFieldService.getFieldList(flag);
if (fieldList.size() != 0) {
//过滤出搜索条件()
fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsQuery()))).collect(Collectors.toList());
if("search".equals(searchFlag)){
fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsShowSearch()))).collect(Collectors.toList());
}else{
fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsQuery()))).collect(Collectors.toList());
}
}
//树形数据字典
List<SysCategoryTreeVO> sysCategoryTree = sysCategoryService.getSysCategoryTree();
@@ -291,15 +302,21 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl<BussDocumentLi
/**
* 列表表头
*
* @param flag
* @param cut
* @param searchFlag 搜索中心列表表头(searchFlag=search时)
* @return
*/
@Override
public List<Map<String, Object>> getHeader(String flag, String cut) {
public List<Map<String, Object>> getHeader(String flag, String cut,String searchFlag) {
List<OnlCgformField> fieldList = onlCgformFieldService.getFieldList(flag);
if (fieldList.size() != 0) {
//过滤列表字段(is_show_list-->列表是否显示0否 1是)
fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsShowList()))).collect(Collectors.toList());
if("search".equals(searchFlag)){
fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsShowSearch()))).collect(Collectors.toList());
}else{
fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsShowList()))).collect(Collectors.toList());
}
}
List<Map<String, Object>> list = new ArrayList<>();
for (OnlCgformField onlCgformField : fieldList) {
@@ -357,8 +374,33 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl<BussDocumentLi
}
//树形数据字典
List<SysCategoryTreeVO> sysCategoryTree = sysCategoryService.getSysCategoryTree();
List<Map<String, Object>> result = new ArrayList<>();
// List<Map<String, Object>> result = new ArrayList<>();
// for (OnlCgformArea onlCgformAreaTemp : areaList) {
// String areaName = "";
// if (CutEnum.CN.getValue().equals(cut)) {
// areaName = onlCgformAreaTemp.getShowArea();
// } else {
// areaName = onlCgformAreaTemp.getEnName();
// }
// List<OnlCgformField> fieldListTemp = fieldList.stream().filter(e -> onlCgformAreaTemp.getId().equals(e.getShowArea())).collect(Collectors.toList());
// for (OnlCgformField onlCgformField : fieldListTemp) {
// String dictId = onlCgformField.getDictId();
// List<SysCategoryTreeVO> sysCategoryTreeVOList = new ArrayList<>();
// if (StringUtils.isNotBlank(dictId)) {
// sysCategoryTreeVOList = sysCategoryTree.stream().filter(e -> dictId.equals(e.getDictId())).collect(Collectors.toList());
// }
// Map<String, Object> map = new HashMap<>();
// mapPut(cut, map, "field_show_type", onlCgformField.getFieldShowType(), "dict_field", onlCgformField.getDictField(), "db_field_name", onlCgformField.getDbFieldName(), "db_field_txt", onlCgformField.getDbFieldTxt(), "db_field_en_name", onlCgformField.getDbFieldEnName(), "area", areaName, sysCategoryTreeVOList);
// map.put("field_must_input", onlCgformField.getFieldMustInput());//是否必填
// map.put("db_length", onlCgformField.getDbLength());//字段长度
// result.add(map);
// }
// }
// return result;
List<Map<String, Object>> resultTemp = new ArrayList<>();
for (OnlCgformArea onlCgformAreaTemp : areaList) {
List<Map<String, Object>> result = new ArrayList<>();
Map<String,Object> mapTemp = new HashMap<>();
String areaName = "";
if (CutEnum.CN.getValue().equals(cut)) {
areaName = onlCgformAreaTemp.getShowArea();
@@ -367,19 +409,23 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl<BussDocumentLi
}
List<OnlCgformField> fieldListTemp = fieldList.stream().filter(e -> onlCgformAreaTemp.getId().equals(e.getShowArea())).collect(Collectors.toList());
for (OnlCgformField onlCgformField : fieldListTemp) {
String dictId = onlCgformField.getDictId();
List<SysCategoryTreeVO> sysCategoryTreeVOList = new ArrayList<>();
if (StringUtils.isNotBlank(dictId)) {
sysCategoryTreeVOList = sysCategoryTree.stream().filter(e -> dictId.equals(e.getDictId())).collect(Collectors.toList());
if(onlCgformAreaTemp.getId().equals(onlCgformField.getShowArea())){
String dictId = onlCgformField.getDictId();
List<SysCategoryTreeVO> sysCategoryTreeVOList = new ArrayList<>();
if (StringUtils.isNotBlank(dictId)) {
sysCategoryTreeVOList = sysCategoryTree.stream().filter(e -> dictId.equals(e.getDictId())).collect(Collectors.toList());
}
Map<String, Object> map = new HashMap<>();
mapPut(cut, map, "field_show_type", onlCgformField.getFieldShowType(), "dict_field", onlCgformField.getDictField(), "db_field_name", onlCgformField.getDbFieldName(), "db_field_txt", onlCgformField.getDbFieldTxt(), "db_field_en_name", onlCgformField.getDbFieldEnName(), "area", areaName, sysCategoryTreeVOList);
map.put("field_must_input", onlCgformField.getFieldMustInput());//是否必填
map.put("db_length", onlCgformField.getDbLength());//字段长度
result.add(map);
}
Map<String, Object> map = new HashMap<>();
mapPut(cut, map, "field_show_type", onlCgformField.getFieldShowType(), "dict_field", onlCgformField.getDictField(), "db_field_name", onlCgformField.getDbFieldName(), "db_field_txt", onlCgformField.getDbFieldTxt(), "db_field_en_name", onlCgformField.getDbFieldEnName(), "area", areaName, sysCategoryTreeVOList);
map.put("field_must_input", onlCgformField.getFieldMustInput());//是否必填
map.put("db_length", onlCgformField.getDbLength());//字段长度
result.add(map);
}
mapTemp.put(onlCgformAreaTemp.getShowArea(),result);
resultTemp.add(mapTemp);
}
return result;
return resultTemp;
}
/**
@@ -507,8 +553,13 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl<BussDocumentLi
List<Map<String, Object>> mapList = bussDocumentLibraryEOMapper.selectMapsAll(null);
//原始对应标准,代替标准,被代替标准(原始数据存的是iD)
String correspondingStandardId = (String) dataList.get(0).get("corresponding_standard");//对应标准
String replaceStandardId = (String) dataList.get(0).get("replace_standard");//代替标准
String correspondingStandardId = "";
String replaceStandardId = "";//代替标准
if(dataList.size() != 0){
correspondingStandardId = (String) dataList.get(0).get("corresponding_standard");//对应标准
replaceStandardId = (String) dataList.get(0).get("replace_standard");//代替标准
}
//被代替标准
List<String> replacedStandardIdList = new ArrayList<>();//代替标准
@@ -879,6 +930,13 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl<BussDocumentLi
}
//向订阅该领域管理的人发消息
sendMsg(map, idTemp);
//添加es
map.put("id",idTemp);
String json = JSON.toJSONString(map);//map转String
JSONObject jsonObject = JSON.parseObject(json);
int a=0;
// jeroElasticsearchTemplate.saveOrUpdate(null,null,idTemp,jsonObject);
}
private void sendMsg(Map<String, Object> map, String idTemp) {
@@ -1604,7 +1662,7 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl<BussDocumentLi
StringBuilder conditionSb = new StringBuilder("where 1 = 1");
//过滤查询条件字段类型使用
List<Map<String, Object>> mapList = queryCondition("1", null);
List<Map<String, Object>> mapList = queryCondition("1", null,null);
//查询条件处理
for (Map.Entry<String, Object> entry : parameter.entrySet()) {