From c051d51c900d7ab4a4e7195af0dca289a1c5b365 Mon Sep 17 00:00:00 2001 From: zhn <947514737@qq.com> Date: Mon, 14 Mar 2022 15:56:24 +0800 Subject: [PATCH] =?UTF-8?q?=E6=96=87=E6=A1=A3=E5=BA=93--=E8=A1=A8=E5=8D=95?= =?UTF-8?q?=E6=95=B0=E6=8D=AE=E7=BB=93=E6=9E=84?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../common/es/JeroElasticsearchTemplate.java | 17 - .../config/safeFilter/Xss/HTMLFilter.java | 450 ++++++++++++++++++ .../jero/config/safeFilter/Xss/SQLFilter.java | 33 ++ .../jero/config/safeFilter/Xss/XssFilter.java | 69 +++ .../Xss/XssHttpServletRequestWrapper.java | 126 +++++ .../config/safeFilter/cors/CorsFilter.java | 100 ++++ .../config/safeFilter/csrf/CsrfFilter.java | 126 +++++ .../config/safeFilter/csrf/RequestUtils.java | 37 ++ .../online/cgform/entity/OnlCgformField.java | 9 + .../oss/service/impl/OSSFileServiceImpl.java | 2 +- .../BussDocumentLibraryEOController.java | 4 +- .../IBussDocumentLibraryEOService.java | 4 +- .../BussDocumentLibraryEOServiceImpl.java | 98 +++- 13 files changed, 1033 insertions(+), 42 deletions(-) create mode 100644 jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/HTMLFilter.java create mode 100644 jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/SQLFilter.java create mode 100644 jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssFilter.java create mode 100644 jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssHttpServletRequestWrapper.java create mode 100644 jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/cors/CorsFilter.java create mode 100644 jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/CsrfFilter.java create mode 100644 jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/RequestUtils.java diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/es/JeroElasticsearchTemplate.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/es/JeroElasticsearchTemplate.java index 56798b08c..839a0804a 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/es/JeroElasticsearchTemplate.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/es/JeroElasticsearchTemplate.java @@ -280,23 +280,6 @@ public class JeroElasticsearchTemplate { */ public boolean saveOrUpdate(String indexName, String typeName, String dataId, JSONObject data) { String url = this.getBaseUrl(indexName, typeName).append("/").append(dataId).append("?refresh=wait_for").toString(); - /* 返回结果（仅供参考） - "createIndexA2": { - "result": "created", - "_shards": { - "total": 2, - "successful": 1, - "failed": 0 - }, - "_seq_no": 0, - "_index": "test_index_1", - "_type": "test_type_1", - "_id": "a2", - "_version": 1, - "_primary_term": 1 - } - */ - try { // 去掉 data 中为空的值 Set keys = data.keySet(); diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/HTMLFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/HTMLFilter.java new file mode 100644 index 000000000..7627fc367 --- /dev/null +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/HTMLFilter.java @@ -0,0 +1,450 @@ +// +// Source code recreated from a .class file by IntelliJ IDEA +// (powered by FernFlower decompiler) +// + +package com.jero.config.safeFilter.Xss; + +import cn.hutool.core.lang.Console; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.HashMap; +import java.util.Iterator; +import java.util.List; +import java.util.Map; +import java.util.concurrent.ConcurrentHashMap; +import java.util.concurrent.ConcurrentMap; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +public final class HTMLFilter { + private static final int REGEX_FLAGS_SI = 34; + private static final Pattern P_COMMENTS = Pattern.compile("", 32); + private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", 34); + private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", 32); + private static final Pattern P_END_TAG = Pattern.compile("^/([a-z0-9]+)", 34); + private static final Pattern P_START_TAG = Pattern.compile("^([a-z0-9]+)(.*?)(/?)$", 34); + private static final Pattern P_QUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)=([\"'])(.*?)\\2", 34); + private static final Pattern P_UNQUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)(=)([^\"\\s']+)", 34); + private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", 34); + private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?"); + private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?"); + private static final Pattern P_ENCODE = Pattern.compile("%([0-9a-f]{2});?"); + private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))"); + private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+?)(<|$)", 32); + private static final Pattern P_END_ARROW = Pattern.compile("^>"); + private static final Pattern P_BODY_TO_END = Pattern.compile("<([^>]*?)(?=<|$)"); + private static final Pattern P_XML_CONTENT = Pattern.compile("(^|>)([^<]*?)(?=>)"); + private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)"); + private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)"); + private static final Pattern P_AMP = Pattern.compile("&"); + private static final Pattern P_PERCENT = Pattern.compile("%"); + private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']"); + private static final Pattern P_LEFT_ARROW = Pattern.compile("<"); + private static final Pattern P_RIGHT_ARROW = Pattern.compile(">"); + private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>"); + private static final ConcurrentMap P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap(); + private static final ConcurrentMap P_REMOVE_SELF_BLANKS = new ConcurrentHashMap(); + private final Map> vAllowed; + private final Map vTagCounts; + private final String[] vSelfClosingTags; + private final String[] vNeedClosingTags; + private final String[] vDisallowed; + private final String[] vProtocolAtts; + private final String[] vAllowedProtocols; + private final String[] vRemoveBlanks; + private final String[] vAllowedEntities; + private final boolean stripComment; + private final boolean encodeQuotes; + private boolean vDebug; + private final boolean alwaysMakeTags; + + public HTMLFilter() { + this.vTagCounts = new HashMap(); + this.vDebug = false; + this.vAllowed = new HashMap(); + ArrayList a_atts = new ArrayList(); + a_atts.add("href"); + a_atts.add("target"); + this.vAllowed.put("a", a_atts); + ArrayList img_atts = new ArrayList(); + img_atts.add("src"); + img_atts.add("width"); + img_atts.add("height"); + img_atts.add("alt"); + this.vAllowed.put("img", img_atts); + ArrayList no_atts = new ArrayList(); + this.vAllowed.put("b", no_atts); + this.vAllowed.put("strong", no_atts); + this.vAllowed.put("i", no_atts); + this.vAllowed.put("em", no_atts); + this.vSelfClosingTags = new String[]{"img"}; + this.vNeedClosingTags = new String[]{"a", "b", "strong", "i", "em"}; + this.vDisallowed = new String[0]; + this.vAllowedProtocols = new String[]{"http", "mailto", "https"}; + this.vProtocolAtts = new String[]{"src", "href"}; + this.vRemoveBlanks = new String[]{"a", "b", "strong", "i", "em"}; + this.vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"}; + this.stripComment = true; + this.encodeQuotes = true; + this.alwaysMakeTags = true; + } + + public HTMLFilter(boolean debug) { + this(); + this.vDebug = debug; + } + + public HTMLFilter(Map conf) { + this.vTagCounts = new HashMap(); + this.vDebug = false; + + assert conf.containsKey("vAllowed") : "configuration requires vAllowed"; + + assert conf.containsKey("vSelfClosingTags") : "configuration requires vSelfClosingTags"; + + assert conf.containsKey("vNeedClosingTags") : "configuration requires vNeedClosingTags"; + + assert conf.containsKey("vDisallowed") : "configuration requires vDisallowed"; + + assert conf.containsKey("vAllowedProtocols") : "configuration requires vAllowedProtocols"; + + assert conf.containsKey("vProtocolAtts") : "configuration requires vProtocolAtts"; + + assert conf.containsKey("vRemoveBlanks") : "configuration requires vRemoveBlanks"; + + assert conf.containsKey("vAllowedEntities") : "configuration requires vAllowedEntities"; + + this.vAllowed = Collections.unmodifiableMap((HashMap)conf.get("vAllowed")); + this.vSelfClosingTags = (String[])((String[])conf.get("vSelfClosingTags")); + this.vNeedClosingTags = (String[])((String[])conf.get("vNeedClosingTags")); + this.vDisallowed = (String[])((String[])conf.get("vDisallowed")); + this.vAllowedProtocols = (String[])((String[])conf.get("vAllowedProtocols")); + this.vProtocolAtts = (String[])((String[])conf.get("vProtocolAtts")); + this.vRemoveBlanks = (String[])((String[])conf.get("vRemoveBlanks")); + this.vAllowedEntities = (String[])((String[])conf.get("vAllowedEntities")); + this.stripComment = conf.containsKey("stripComment") ? (Boolean)conf.get("stripComment") : true; + this.encodeQuotes = conf.containsKey("encodeQuotes") ? (Boolean)conf.get("encodeQuotes") : true; + this.alwaysMakeTags = conf.containsKey("alwaysMakeTags") ? (Boolean)conf.get("alwaysMakeTags") : true; + } + + private void reset() { + this.vTagCounts.clear(); + } + + private void debug(String msg) { + if (this.vDebug) { + Console.log(msg); + } + + } + + public static String chr(int decimal) { + return String.valueOf((char)decimal); + } + + public static String htmlSpecialChars(String s) { + String result = regexReplace(P_AMP, "&", s); + result = regexReplace(P_PERCENT, "‰", result); + result = regexReplace(P_QUOTE, """, result); + result = regexReplace(P_LEFT_ARROW, "<", result); + result = regexReplace(P_RIGHT_ARROW, ">", result); + return result; + } + + public String filter(String input) { + this.reset(); + this.debug("************************************************"); + this.debug(" INPUT: " + input); + String s = this.escapeComments(input); + this.debug(" escapeComments: " + s); + s = this.balanceHTML(s); + this.debug(" balanceHTML: " + s); + s = this.checkTags(s); + this.debug(" checkTags: " + s); + s = this.processRemoveBlanks(s); + this.debug("processRemoveBlanks: " + s); + s = this.validateEntities(s); + this.debug(" validateEntites: " + s); + this.debug("************************************************\n\n"); + return s; + } + + public boolean isAlwaysMakeTags() { + return this.alwaysMakeTags; + } + + public boolean isStripComments() { + return this.stripComment; + } + + private String escapeComments(String s) { + Matcher m = P_COMMENTS.matcher(s); + StringBuffer buf = new StringBuffer(); + if (m.find()) { + String match = m.group(1); + m.appendReplacement(buf, Matcher.quoteReplacement("")); + } + + m.appendTail(buf); + return buf.toString(); + } + + private String balanceHTML(String s) { + if (this.alwaysMakeTags) { +/* s = regexReplace(P_END_ARROW, "", s); + s = regexReplace(P_BODY_TO_END, "<$1>", s); + s = regexReplace(P_XML_CONTENT, "$1<$2", s);*/ + } else { + s = regexReplace(P_STRAY_LEFT_ARROW, "<$1", s); + s = regexReplace(P_STRAY_RIGHT_ARROW, "$1$2><", s); + s = regexReplace(P_BOTH_ARROWS, "", s); + } + + return s; + } + + private String checkTags(String s) { + Matcher m = P_TAGS.matcher(s); + StringBuffer buf = new StringBuffer(); + + while(m.find()) { + String replaceStr = m.group(1); + replaceStr = this.processTag(replaceStr); + m.appendReplacement(buf, Matcher.quoteReplacement(replaceStr)); + } + + m.appendTail(buf); + StringBuilder sBuilder = new StringBuilder(buf.toString()); + Iterator var5 = this.vTagCounts.keySet().iterator(); + + while(var5.hasNext()) { + String key = (String)var5.next(); + + for(int ii = 0; ii < (Integer)this.vTagCounts.get(key); ++ii) { + sBuilder.append(""); + } + } + + s = sBuilder.toString(); + return s; + } + + private String processRemoveBlanks(String s) { + String result = s; + String[] var3 = this.vRemoveBlanks; + int var4 = var3.length; + + for(int var5 = 0; var5 < var4; ++var5) { + String tag = var3[var5]; + if (!P_REMOVE_PAIR_BLANKS.containsKey(tag)) { + P_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?>")); + } + + result = regexReplace((Pattern)P_REMOVE_PAIR_BLANKS.get(tag), "", result); + if (!P_REMOVE_SELF_BLANKS.containsKey(tag)) { + P_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?/>")); + } + + result = regexReplace((Pattern)P_REMOVE_SELF_BLANKS.get(tag), "", result); + } + + return result; + } + + private static String regexReplace(Pattern regex_pattern, String replacement, String s) { + Matcher m = regex_pattern.matcher(s); + return m.replaceAll(replacement); + } + + private String processTag(String s) { + Matcher m = P_END_TAG.matcher(s); + String name; + if (m.find()) { + name = m.group(1).toLowerCase(); + if (this.allowed(name) && !inArray(name, this.vSelfClosingTags) && this.vTagCounts.containsKey(name)) { + this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) - 1); + return ""; + } + } + + m = P_START_TAG.matcher(s); + if (!m.find()) { + m = P_COMMENT.matcher(s); + return !this.stripComment && m.find() ? "<" + m.group() + ">" : ""; + } else { + name = m.group(1).toLowerCase(); + String body = m.group(2); + String ending = m.group(3); + if (!this.allowed(name)) { + return ""; + } else { + StringBuilder params = new StringBuilder(); + Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body); + Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body); + List paramNames = new ArrayList(); + ArrayList paramValues = new ArrayList(); + + while(m2.find()) { + paramNames.add(m2.group(1)); + paramValues.add(m2.group(3)); + } + + while(m3.find()) { + paramNames.add(m3.group(1)); + paramValues.add(m3.group(3)); + } + + for(int ii = 0; ii < paramNames.size(); ++ii) { + String paramName = ((String)paramNames.get(ii)).toLowerCase(); + String paramValue = (String)paramValues.get(ii); + if (this.allowedAttribute(name, paramName)) { + if (inArray(paramName, this.vProtocolAtts)) { + paramValue = this.processParamProtocol(paramValue); + } + + params.append(' ').append(paramName).append("=\"").append(paramValue).append("\""); + } + } + + if (inArray(name, this.vSelfClosingTags)) { + ending = " /"; + } + + if (inArray(name, this.vNeedClosingTags)) { + ending = ""; + } + + if (ending != null && ending.length() >= 1) { + ending = " /"; + } else if (this.vTagCounts.containsKey(name)) { + this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) + 1); + } else { + this.vTagCounts.put(name, 1); + } + + return "<" + name + params + ending + ">"; + } + } + } + + private String processParamProtocol(String s) { + s = this.decodeEntities(s); + Matcher m = P_PROTOCOL.matcher(s); + if (m.find()) { + String protocol = m.group(1); + if (!inArray(protocol, this.vAllowedProtocols)) { + s = "#" + s.substring(protocol.length() + 1); + if (s.startsWith("#//")) { + s = "#" + s.substring(3); + } + } + } + + return s; + } + + private String decodeEntities(String s) { + StringBuffer buf = new StringBuffer(); + Matcher m = P_ENTITY.matcher(s); + + String match; + int decimal; + while(m.find()) { + match = m.group(1); + decimal = Integer.decode(match); + m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal))); + } + + m.appendTail(buf); + s = buf.toString(); + buf = new StringBuffer(); + m = P_ENTITY_UNICODE.matcher(s); + + while(m.find()) { + match = m.group(1); + decimal = Integer.valueOf(match, 16); + m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal))); + } + + m.appendTail(buf); + s = buf.toString(); + buf = new StringBuffer(); + m = P_ENCODE.matcher(s); + + while(m.find()) { + match = m.group(1); + decimal = Integer.valueOf(match, 16); + m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal))); + } + + m.appendTail(buf); + s = buf.toString(); + s = this.validateEntities(s); + return s; + } + + private String validateEntities(String s) { + StringBuffer buf = new StringBuffer(); + Matcher m = P_VALID_ENTITIES.matcher(s); + + while(m.find()) { + String one = m.group(1); + String two = m.group(2); + m.appendReplacement(buf, Matcher.quoteReplacement(this.checkEntity(one, two))); + } + + m.appendTail(buf); + return this.encodeQuotes(buf.toString()); + } + + private String encodeQuotes(String s) { + if (!this.encodeQuotes) { + return s; + } else { + StringBuffer buf = new StringBuffer(); + Matcher m = P_VALID_QUOTES.matcher(s); + + while(m.find()) { + String one = m.group(1); + String two = m.group(2); + String three = m.group(3); + m.appendReplacement(buf, Matcher.quoteReplacement(one + regexReplace(P_QUOTE, """, two) + three)); + } + + m.appendTail(buf); + return buf.toString(); + } + } + + private String checkEntity(String preamble, String term) { + return ";".equals(term) && this.isValidEntity(preamble) ? '&' + preamble : "&" + preamble; + } + + private boolean isValidEntity(String entity) { + return inArray(entity, this.vAllowedEntities); + } + + private static boolean inArray(String s, String[] array) { + String[] var2 = array; + int var3 = array.length; + + for(int var4 = 0; var4 < var3; ++var4) { + String item = var2[var4]; + if (item != null && item.equals(s)) { + return true; + } + } + + return false; + } + + private boolean allowed(String name) { + return (this.vAllowed.isEmpty() || this.vAllowed.containsKey(name)) && !inArray(name, this.vDisallowed); + } + + private boolean allowedAttribute(String name, String paramName) { + return this.allowed(name) && (this.vAllowed.isEmpty() || ((List)this.vAllowed.get(name)).contains(paramName)); + } +} diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/SQLFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/SQLFilter.java new file mode 100644 index 000000000..9c3c00c08 --- /dev/null +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/SQLFilter.java @@ -0,0 +1,33 @@ +// +// Source code recreated from a .class file by IntelliJ IDEA +// (powered by FernFlower decompiler) +// + +package com.jero.config.safeFilter.Xss; + +import org.apache.commons.lang.StringUtils; + +public class SQLFilter { + public SQLFilter() { + } + + public static String sqlInject(String str) { + if (StringUtils.isBlank(str)) { + return null; + } else { + str = StringUtils.replace(str, "\\", ""); + String[] keywords = new String[]{"master", "truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"}; + String[] var2 = keywords; + int var3 = keywords.length; + + for(int var4 = 0; var4 < var3; ++var4) { + String keyword = var2[var4]; + if (StringUtils.indexOfIgnoreCase(str, keyword + " ") != -1) { + throw new RuntimeException("包含非法字符"); + } + } + + return str; + } + } +} diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssFilter.java new file mode 100644 index 000000000..9b1ce5aef --- /dev/null +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssFilter.java @@ -0,0 +1,69 @@ +package com.jero.config.safeFilter.Xss; + + +import org.apache.commons.lang3.StringUtils; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import java.io.IOException; + +public class XssFilter implements Filter { + private String excludedPages; + private String[] excludedPageArray; + + public XssFilter(String excludedPages) { + this.excludedPages=excludedPages; + } + + public void init(FilterConfig config) throws ServletException { + if (StringUtils.isNotEmpty(this.excludedPages)) { + this.excludedPageArray = this.excludedPages.split(","); + } + + } + + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + boolean isExcludedPage = false; + if (this.isNotEmpty(this.excludedPageArray)) { + String[] excludedPages = this.excludedPageArray; + int excludedPageLength = excludedPages.length; + + for(int i = 0; i < excludedPageLength; ++i) { + String page = excludedPages[i]; + if (((HttpServletRequest)request).getRequestURI().contains(page)) { + isExcludedPage = true; + break; + } + } + } + + if (isExcludedPage) { + chain.doFilter(request, response); + } else { + XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest)request); + chain.doFilter(xssRequest, response); + } + + } + + public void destroy() { + } + + + public static String filterNull(Object o) { + return o != null && !"null".equals(o.toString()) ? o.toString().trim() : ""; + } + + public static boolean isNotEmpty(Object o) { + if (o == null) { + return false; + } else { + return !"".equals(filterNull(o.toString())); + } + } +} diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssHttpServletRequestWrapper.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssHttpServletRequestWrapper.java new file mode 100644 index 000000000..a0e2300fb --- /dev/null +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssHttpServletRequestWrapper.java @@ -0,0 +1,126 @@ +// +// Source code recreated from a .class file by IntelliJ IDEA +// (powered by FernFlower decompiler) +// + +package com.jero.config.safeFilter.Xss; + +import org.apache.commons.io.IOUtils; +import org.apache.commons.lang.StringUtils; + +import javax.servlet.ReadListener; +import javax.servlet.ServletInputStream; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletRequestWrapper; +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.util.Iterator; +import java.util.LinkedHashMap; +import java.util.Map; + +public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { + HttpServletRequest orgRequest; + private static final HTMLFilter htmlFilter = new HTMLFilter(); + private static final SQLFilter sqlFilter = new SQLFilter(); + + public XssHttpServletRequestWrapper(HttpServletRequest request) { + super(request); + this.orgRequest = request; + } + + public ServletInputStream getInputStream() throws IOException { + String type = super.getHeader("Content-Type"); + if (StringUtils.indexOfIgnoreCase(type, "application/json") < 0) { + return super.getInputStream(); + } else { + String json = IOUtils.toString(super.getInputStream(), "utf-8"); + if (StringUtils.isBlank(json)) { + return super.getInputStream(); + } else { + json = this.xssSqlEncode(json); + final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes("utf-8")); + return new ServletInputStream() { + public boolean isFinished() { + return true; + } + + public boolean isReady() { + return true; + } + + public void setReadListener(ReadListener readListener) { + } + + public int read() throws IOException { + return bis.read(); + } + }; + } + } + } + + public String getParameter(String name) { + String value = super.getParameter(this.xssSqlEncode(name)); + if (StringUtils.isNotBlank(value)) { + value = this.xssSqlEncode(value); + } + + return value; + } + + public String[] getParameterValues(String name) { + String[] parameters = super.getParameterValues(name); + if (parameters != null && parameters.length != 0) { + for(int i = 0; i < parameters.length; ++i) { + parameters[i] = this.xssSqlEncode(parameters[i]); + } + + return parameters; + } else { + return null; + } + } + + public Map getParameterMap() { + Map map = new LinkedHashMap(); + Map parameters = super.getParameterMap(); + Iterator var3 = parameters.keySet().iterator(); + + while(var3.hasNext()) { + String key = (String)var3.next(); + String[] values = (String[])parameters.get(key); + + for(int i = 0; i < values.length; ++i) { + values[i] = this.xssSqlEncode(values[i]); + } + + map.put(key, values); + } + + return map; + } + + public String getHeader(String name) { + String value = super.getHeader(this.xssSqlEncode(name)); + if (StringUtils.isNotBlank(value)) { + value = this.xssSqlEncode(value); + } + + return value; + } + + private String xssSqlEncode(String input) { + input=input.replaceAll("%5b","[").replaceAll("%5d","]"); + String htmlOutput=input; + htmlOutput= htmlFilter.filter(input); + return SQLFilter.sqlInject(htmlOutput); + } + + public HttpServletRequest getOrgRequest() { + return this.orgRequest; + } + + public static HttpServletRequest getOrgRequest(HttpServletRequest request) { + return request instanceof XssHttpServletRequestWrapper ? ((XssHttpServletRequestWrapper)request).getOrgRequest() : request; + } +} diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/cors/CorsFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/cors/CorsFilter.java new file mode 100644 index 000000000..f68c32864 --- /dev/null +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/cors/CorsFilter.java @@ -0,0 +1,100 @@ +package com.jero.config.safeFilter.cors; + + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.annotation.WebFilter; +import javax.servlet.http.HttpServletRequest; +import java.io.IOException; +import java.util.Objects; + +/** + * 设置响应信息 + */ +@WebFilter(urlPatterns = {"/verifyCode/**"}) +public class CorsFilter implements Filter { + + + private static final Log LOGGER = LogFactory.getLog(CorsFilter.class); + + private int size = 0; + + private String origin; + + private String notFilter; + + public CorsFilter(String origin, String notFilter) { + this.origin = origin; + this.notFilter = notFilter; + } + + + @Override + public void init(FilterConfig filterConfig) throws ServletException { + + } + + @Override + public void doFilter(ServletRequest request, ServletResponse response, + FilterChain chain) throws IOException, ServletException { + + HttpServletRequest req = (HttpServletRequest) request; + + final String origin = ((HttpServletRequest) request).getHeader("Origin"); + //请求头与系统的origin不通则咔嚓 +// if (Objects.nonNull(origin) || this.origin.contains(origin)){ +// return; +// } + if (Objects.nonNull(origin) && !this.origin.contains(origin)){ + return; + } + //获取请求路径 + String url = req.getRequestURL().toString(); + String[] interfaceNameArr = notFilter.split(","); + if (!isMSBrowser(req)){ + for (String name : interfaceNameArr) { + //如果包含,不需要判断Origin是否合法 + if(url.contains(name)){ + responseInfo(request, response, chain); +// return; + } + } + } + responseInfo(request, response, chain); + } + public boolean isMSBrowser(HttpServletRequest request) { + String[] IEBrowserSignals = {"MSIE", "Trident"}; + String userAgent = request.getHeader("User-Agent"); + for (String signal : IEBrowserSignals) { + if (userAgent.contains(signal)){ + return true; + } + } + return false; + } + private void responseInfo(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { +// HttpServletResponse httpServletResponse = (HttpServletResponse) response; +// httpServletResponse.setHeader("Access-Control-Allow-Origin", origin); +// httpServletResponse.addHeader("Access-Control-Allow-Headers", "Authorization"); +// httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true"); +// httpServletResponse.setHeader("Access-Control-Allow-Methods", "POST, GET, HEAD, OPTIONS, PUT, DELETE"); +// httpServletResponse.setHeader("Access-Control-Max-Age", "3600"); +// httpServletResponse.setHeader("Content-Security-Policy", "upgrade-insecure-requests;connect-src *"); +// httpServletResponse.setHeader("X-Content-Type-Options", "nosniff"); +// httpServletResponse.setHeader("X-XSS-Protection", "1;mode=block"); +// httpServletResponse.setHeader("Access-Control-Allow-Headers", "Origin, Accept, x-auth-token, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, authorization"); + chain.doFilter(request, response); + } + + @Override + public void destroy() { + } + +} diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/CsrfFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/CsrfFilter.java new file mode 100644 index 000000000..44ddb8d41 --- /dev/null +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/CsrfFilter.java @@ -0,0 +1,126 @@ +package com.jero.config.safeFilter.csrf; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.text.SimpleDateFormat; +import java.util.Arrays; +import java.util.Date; +import java.util.List; + +/** + * CsrfFilter + */ +public class CsrfFilter implements Filter { + + public CsrfFilter(String csrfList) { + this.csrfList = csrfList; + } + + /** + * LOGGER + */ + private static final Log LOGGER = LogFactory.getLog(CsrfFilter.class); + + /** + * 从配置文件读取的csrf白名单字符串 + */ + private final String csrfList; + + /** + * 白名单 + */ + private List whiteUrls; + + /** + * size + */ + private int size = 0; + + /** + * 读取文件 + * + * @param filterConfig + */ + public void init(FilterConfig filterConfig) { + // 读取文件 + String path = CsrfFilter.class.getResource("/").getFile(); +// whiteUrls = FileUtil.readAsStringList(path + "csrfWhite.txt"); + whiteUrls = Arrays.asList(csrfList.split(",")); + size = whiteUrls.size(); + } + + /** + * @param request + * @param response + * @param chain + * @throws IOException + * @throws ServletException + */ + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) + throws IOException, ServletException { +// try { + HttpServletRequest req = (HttpServletRequest) request; + HttpServletResponse res = (HttpServletResponse) response; + // 获取请求url地址 + String url = req.getRequestURL().toString(); + String referurl = req.getHeader("Referer"); + if (isWhiteReq(referurl)) { + chain.doFilter(request, response); + } else { + req.getRequestDispatcher("/").forward(req, res); + // 记录跨站请求日志 + String log = ""; + String date = new SimpleDateFormat("yyyyMMddHHmmss").format(new Date()); + String clientIp = RequestUtils.getClientIp(req); + + log = "跨站请求---->>>" + clientIp + "||" + date + "||" + referurl + "||" + url; + LOGGER.warn(log); + } + +// } catch (Exception e) { +// LOGGER.error("doFilter", e); +// } + + } + + /** + * 判断是否是白名单 + */ + private boolean isWhiteReq(String referUrl) { + if (referUrl == null || "".equals(referUrl) || size == 0) { + return true; + } else { + String refHost = ""; + referUrl = referUrl.toLowerCase(); + if (referUrl.startsWith("http://")) { + refHost = referUrl.substring(7); + } else if (referUrl.startsWith("https://")) { + refHost = referUrl.substring(8); + } + + for (String urlTemp : whiteUrls) { + if (refHost.contains(urlTemp.toLowerCase())) { + return true; + } + } + } + + return false; + } + + /** + * destroy + */ + public void destroy() { + } +} diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/RequestUtils.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/RequestUtils.java new file mode 100644 index 000000000..d38f544b2 --- /dev/null +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/RequestUtils.java @@ -0,0 +1,37 @@ +package com.jero.config.safeFilter.csrf; + +import org.apache.commons.lang3.StringUtils; + +import javax.servlet.http.HttpServletRequest; + +public class RequestUtils { + + public static final String LOGIN_USER = "LOGIN_USER"; + public static final String LOGIN_USER_ID = "LOGIN_USER_ID"; + public static final String LOGIN_ROLE_ID = "LOGIN_ROLE_ID"; + + /** + * 获取客户端IP地址 + * @param request + * @return + */ + public static String getClientIp(HttpServletRequest request) { + String remoteAddr = ""; + if (request != null) { + remoteAddr = request.getHeader("X-FORWARDED-FOR"); + if (StringUtils.isEmpty(remoteAddr)) { + remoteAddr = request.getRemoteAddr(); + } + } + return remoteAddr; + } + + public static String getLoginUserId(HttpServletRequest request) { + return (String) request.getSession().getAttribute(LOGIN_USER_ID); + } + + public static String getLoginRoleId(HttpServletRequest request) { + return (String) request.getSession().getAttribute(LOGIN_ROLE_ID); + } + +} diff --git a/jero-boot/jero-boot-base/jero-boot-base-generater/src/main/java/com/jero/generater/modules/online/cgform/entity/OnlCgformField.java b/jero-boot/jero-boot-base/jero-boot-base-generater/src/main/java/com/jero/generater/modules/online/cgform/entity/OnlCgformField.java index 4e916ce16..c8f6746aa 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-generater/src/main/java/com/jero/generater/modules/online/cgform/entity/OnlCgformField.java +++ b/jero-boot/jero-boot-base/jero-boot-base-generater/src/main/java/com/jero/generater/modules/online/cgform/entity/OnlCgformField.java @@ -75,6 +75,15 @@ public class OnlCgformField implements Serializable { private String queryValidType; private String queryMustInput; private String sortFlag; + private String isShowSearch; + + public String getIsShowSearch() { + return isShowSearch; + } + + public void setIsShowSearch(String isShowSearch) { + this.isShowSearch = isShowSearch; + } public String getDictId() { return dictId; diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/oss/service/impl/OSSFileServiceImpl.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/oss/service/impl/OSSFileServiceImpl.java index fcb42f016..9db7af050 100644 --- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/oss/service/impl/OSSFileServiceImpl.java +++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/oss/service/impl/OSSFileServiceImpl.java @@ -91,7 +91,7 @@ public class OSSFileServiceImpl extends ServiceImpl impl } } if (flag) { - throw new JeroBootException("只能够上传Word、Excel、PDF、静态图片类型的文件。请重新选择文件！"); + throw new JeroBootException("只能够上传pdf/word/excel/csv/ppt/txt/zip/rar/静态图片类型的文件。请重新选择文件！"); } } diff --git a/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/controller/BussDocumentLibraryEOController.java b/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/controller/BussDocumentLibraryEOController.java index 7b764cf6c..950a04437 100644 --- a/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/controller/BussDocumentLibraryEOController.java +++ b/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/controller/BussDocumentLibraryEOController.java @@ -168,7 +168,7 @@ public class BussDocumentLibraryEOController extends JeroController>> queryCondition(@RequestParam(name="flag",required=true) String flag, @RequestParam(name="cut",required=true) String cut) { - List> list = bussDocumentLibraryEOService.queryCondition(flag,cut); + List> list = bussDocumentLibraryEOService.queryCondition(flag,cut,null); return Result.OK(list); } @@ -183,7 +183,7 @@ public class BussDocumentLibraryEOController extends JeroController>> getHeader(@RequestParam(name="flag",required=true) String flag, @RequestParam(name="cut",required=true) String cut) { - List> list = bussDocumentLibraryEOService.getHeader(flag,cut); + List> list = bussDocumentLibraryEOService.getHeader(flag,cut,null); return Result.OK(list); } diff --git a/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/IBussDocumentLibraryEOService.java b/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/IBussDocumentLibraryEOService.java index 97e3a179e..943aecf76 100644 --- a/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/IBussDocumentLibraryEOService.java +++ b/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/IBussDocumentLibraryEOService.java @@ -54,14 +54,14 @@ public interface IBussDocumentLibraryEOService extends IService> queryCondition(String flag, String cut); + List> queryCondition(String flag, String cut,String searchFlag); /** * 列表表头 * * @return */ - List> getHeader(String flag, String cut); + List> getHeader(String flag, String cut,String searchFlag); /** * 新增表单 diff --git a/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/impl/BussDocumentLibraryEOServiceImpl.java b/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/impl/BussDocumentLibraryEOServiceImpl.java index 1f7ded078..26eae837f 100644 --- a/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/impl/BussDocumentLibraryEOServiceImpl.java +++ b/jero-boot/jero-boot-modules/src/main/java/com/jero/modules/document/service/impl/BussDocumentLibraryEOServiceImpl.java @@ -1,6 +1,7 @@ package com.jero.modules.document.service.impl; import cn.hutool.core.util.ZipUtil; +import com.alibaba.fastjson.JSON; import com.alibaba.fastjson.JSONObject; import com.aliyuncs.utils.IOUtils; import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper; @@ -15,6 +16,7 @@ import com.jero.common.constant.enums.IsMustEnum; import com.jero.common.constant.enums.MessageTypeEnum; import com.jero.common.constant.enums.ModuleEnum; import com.jero.common.constant.enums.YesOrNoEnum; +import com.jero.common.es.JeroElasticsearchTemplate; import com.jero.common.exception.JeroBootException; import com.jero.common.system.vo.LoginUser; import com.jero.common.util.DateUtils; @@ -136,6 +138,8 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl> queryCondition(String flag, String cut) { + public List> queryCondition(String flag, String cut,String searchFlag) { List fieldList = onlCgformFieldService.getFieldList(flag); if (fieldList.size() != 0) { //过滤出搜索条件() - fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsQuery()))).collect(Collectors.toList()); + if("search".equals(searchFlag)){ + fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsShowSearch()))).collect(Collectors.toList()); + }else{ + fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsQuery()))).collect(Collectors.toList()); + } + } //树形数据字典 List sysCategoryTree = sysCategoryService.getSysCategoryTree(); @@ -291,15 +302,21 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl> getHeader(String flag, String cut) { + public List> getHeader(String flag, String cut,String searchFlag) { List fieldList = onlCgformFieldService.getFieldList(flag); if (fieldList.size() != 0) { //过滤列表字段(is_show_list-->列表是否显示0否 1是) - fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsShowList()))).collect(Collectors.toList()); + if("search".equals(searchFlag)){ + fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsShowSearch()))).collect(Collectors.toList()); + }else{ + fieldList = fieldList.stream().filter(e -> YesOrNoEnum.YES.getValue().equals(String.valueOf(e.getIsShowList()))).collect(Collectors.toList()); + } } List> list = new ArrayList<>(); for (OnlCgformField onlCgformField : fieldList) { @@ -357,8 +374,33 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl sysCategoryTree = sysCategoryService.getSysCategoryTree(); - List> result = new ArrayList<>(); +// List> result = new ArrayList<>(); +// for (OnlCgformArea onlCgformAreaTemp : areaList) { +// String areaName = ""; +// if (CutEnum.CN.getValue().equals(cut)) { +// areaName = onlCgformAreaTemp.getShowArea(); +// } else { +// areaName = onlCgformAreaTemp.getEnName(); +// } +// List fieldListTemp = fieldList.stream().filter(e -> onlCgformAreaTemp.getId().equals(e.getShowArea())).collect(Collectors.toList()); +// for (OnlCgformField onlCgformField : fieldListTemp) { +// String dictId = onlCgformField.getDictId(); +// List sysCategoryTreeVOList = new ArrayList<>(); +// if (StringUtils.isNotBlank(dictId)) { +// sysCategoryTreeVOList = sysCategoryTree.stream().filter(e -> dictId.equals(e.getDictId())).collect(Collectors.toList()); +// } +// Map map = new HashMap<>(); +// mapPut(cut, map, "field_show_type", onlCgformField.getFieldShowType(), "dict_field", onlCgformField.getDictField(), "db_field_name", onlCgformField.getDbFieldName(), "db_field_txt", onlCgformField.getDbFieldTxt(), "db_field_en_name", onlCgformField.getDbFieldEnName(), "area", areaName, sysCategoryTreeVOList); +// map.put("field_must_input", onlCgformField.getFieldMustInput());//是否必填 +// map.put("db_length", onlCgformField.getDbLength());//字段长度 +// result.add(map); +// } +// } +// return result; + List> resultTemp = new ArrayList<>(); for (OnlCgformArea onlCgformAreaTemp : areaList) { + List> result = new ArrayList<>(); + Map mapTemp = new HashMap<>(); String areaName = ""; if (CutEnum.CN.getValue().equals(cut)) { areaName = onlCgformAreaTemp.getShowArea(); @@ -367,19 +409,23 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl fieldListTemp = fieldList.stream().filter(e -> onlCgformAreaTemp.getId().equals(e.getShowArea())).collect(Collectors.toList()); for (OnlCgformField onlCgformField : fieldListTemp) { - String dictId = onlCgformField.getDictId(); - List sysCategoryTreeVOList = new ArrayList<>(); - if (StringUtils.isNotBlank(dictId)) { - sysCategoryTreeVOList = sysCategoryTree.stream().filter(e -> dictId.equals(e.getDictId())).collect(Collectors.toList()); + if(onlCgformAreaTemp.getId().equals(onlCgformField.getShowArea())){ + String dictId = onlCgformField.getDictId(); + List sysCategoryTreeVOList = new ArrayList<>(); + if (StringUtils.isNotBlank(dictId)) { + sysCategoryTreeVOList = sysCategoryTree.stream().filter(e -> dictId.equals(e.getDictId())).collect(Collectors.toList()); + } + Map map = new HashMap<>(); + mapPut(cut, map, "field_show_type", onlCgformField.getFieldShowType(), "dict_field", onlCgformField.getDictField(), "db_field_name", onlCgformField.getDbFieldName(), "db_field_txt", onlCgformField.getDbFieldTxt(), "db_field_en_name", onlCgformField.getDbFieldEnName(), "area", areaName, sysCategoryTreeVOList); + map.put("field_must_input", onlCgformField.getFieldMustInput());//是否必填 + map.put("db_length", onlCgformField.getDbLength());//字段长度 + result.add(map); } - Map map = new HashMap<>(); - mapPut(cut, map, "field_show_type", onlCgformField.getFieldShowType(), "dict_field", onlCgformField.getDictField(), "db_field_name", onlCgformField.getDbFieldName(), "db_field_txt", onlCgformField.getDbFieldTxt(), "db_field_en_name", onlCgformField.getDbFieldEnName(), "area", areaName, sysCategoryTreeVOList); - map.put("field_must_input", onlCgformField.getFieldMustInput());//是否必填 - map.put("db_length", onlCgformField.getDbLength());//字段长度 - result.add(map); } + mapTemp.put(onlCgformAreaTemp.getShowArea(),result); + resultTemp.add(mapTemp); } - return result; + return resultTemp; } /** @@ -507,8 +553,13 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl> mapList = bussDocumentLibraryEOMapper.selectMapsAll(null); //原始对应标准,代替标准,被代替标准(原始数据存的是iD) - String correspondingStandardId = (String) dataList.get(0).get("corresponding_standard");//对应标准 - String replaceStandardId = (String) dataList.get(0).get("replace_standard");//代替标准 + String correspondingStandardId = ""; + String replaceStandardId = "";//代替标准 + if(dataList.size() != 0){ + correspondingStandardId = (String) dataList.get(0).get("corresponding_standard");//对应标准 + replaceStandardId = (String) dataList.get(0).get("replace_standard");//代替标准 + } + //被代替标准 List replacedStandardIdList = new ArrayList<>();//代替标准 @@ -879,6 +930,13 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl map, String idTemp) { @@ -1604,7 +1662,7 @@ public class BussDocumentLibraryEOServiceImpl extends ServiceImpl> mapList = queryCondition("1", null); + List> mapList = queryCondition("1", null,null); //查询条件处理 for (Map.Entry entry : parameter.entrySet()) {