WL/laws_weilai
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

文档库--表单数据结构

Browse Source
This commit is contained in:
zhn
2022-03-14 15:56:24 +08:00
parent b7f04e477c
commit c051d51c90
13 changed files with 1033 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/es/JeroElasticsearchTemplate.java
-17
View File
@@ -280,23 +280,6 @@ public class JeroElasticsearchTemplate {
*/
public boolean saveOrUpdate(String indexName, String typeName, String dataId, JSONObject data) {
String url = this.getBaseUrl(indexName, typeName).append("/").append(dataId).append("?refresh=wait_for").toString();
/* 返回结果（仅供参考）
"createIndexA2": {
"result": "created",
"_shards": {
"total": 2,
"successful": 1,
"failed": 0
},
"_seq_no": 0,
"_index": "test_index_1",
"_type": "test_type_1",
"_id": "a2",
"_version": 1,
"_primary_term": 1
}
*/
try {
// 去掉 data 中为空的值
Set<String> keys = data.keySet();
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/HTMLFilter.java
+450
View File
@@ -0,0 +1,450 @@
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package com.jero.config.safeFilter.Xss;
import cn.hutool.core.lang.Console;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public final class HTMLFilter {
private static final int REGEX_FLAGS_SI = 34;
private static final Pattern P_COMMENTS = Pattern.compile("<!--(.*?)-->", 32);
private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", 34);
private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", 32);
private static final Pattern P_END_TAG = Pattern.compile("^/([a-z0-9]+)", 34);
private static final Pattern P_START_TAG = Pattern.compile("^([a-z0-9]+)(.*?)(/?)$", 34);
private static final Pattern P_QUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)=([\"'])(.*?)\\2", 34);
private static final Pattern P_UNQUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)(=)([^\"\\s']+)", 34);
private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", 34);
private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?");
private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?");
private static final Pattern P_ENCODE = Pattern.compile("%([0-9a-f]{2});?");
private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))");
private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+?)(<|$)", 32);
private static final Pattern P_END_ARROW = Pattern.compile("^>");
private static final Pattern P_BODY_TO_END = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_XML_CONTENT = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_AMP = Pattern.compile("&");
private static final Pattern P_PERCENT = Pattern.compile("%");
private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']");
private static final Pattern P_LEFT_ARROW = Pattern.compile("<");
private static final Pattern P_RIGHT_ARROW = Pattern.compile(">");
private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>");
private static final ConcurrentMap<String, Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap();
private static final ConcurrentMap<String, Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap();
private final Map<String, List<String>> vAllowed;
private final Map<String, Integer> vTagCounts;
private final String[] vSelfClosingTags;
private final String[] vNeedClosingTags;
private final String[] vDisallowed;
private final String[] vProtocolAtts;
private final String[] vAllowedProtocols;
private final String[] vRemoveBlanks;
private final String[] vAllowedEntities;
private final boolean stripComment;
private final boolean encodeQuotes;
private boolean vDebug;
private final boolean alwaysMakeTags;
public HTMLFilter() {
this.vTagCounts = new HashMap();
this.vDebug = false;
this.vAllowed = new HashMap();
ArrayList<String> a_atts = new ArrayList();
a_atts.add("href");
a_atts.add("target");
this.vAllowed.put("a", a_atts);
ArrayList<String> img_atts = new ArrayList();
img_atts.add("src");
img_atts.add("width");
img_atts.add("height");
img_atts.add("alt");
this.vAllowed.put("img", img_atts);
ArrayList<String> no_atts = new ArrayList();
this.vAllowed.put("b", no_atts);
this.vAllowed.put("strong", no_atts);
this.vAllowed.put("i", no_atts);
this.vAllowed.put("em", no_atts);
this.vSelfClosingTags = new String[]{"img"};
this.vNeedClosingTags = new String[]{"a", "b", "strong", "i", "em"};
this.vDisallowed = new String[0];
this.vAllowedProtocols = new String[]{"http", "mailto", "https"};
this.vProtocolAtts = new String[]{"src", "href"};
this.vRemoveBlanks = new String[]{"a", "b", "strong", "i", "em"};
this.vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"};
this.stripComment = true;
this.encodeQuotes = true;
this.alwaysMakeTags = true;
}
public HTMLFilter(boolean debug) {
this();
this.vDebug = debug;
}
public HTMLFilter(Map<String, Object> conf) {
this.vTagCounts = new HashMap();
this.vDebug = false;
assert conf.containsKey("vAllowed") : "configuration requires vAllowed";
assert conf.containsKey("vSelfClosingTags") : "configuration requires vSelfClosingTags";
assert conf.containsKey("vNeedClosingTags") : "configuration requires vNeedClosingTags";
assert conf.containsKey("vDisallowed") : "configuration requires vDisallowed";
assert conf.containsKey("vAllowedProtocols") : "configuration requires vAllowedProtocols";
assert conf.containsKey("vProtocolAtts") : "configuration requires vProtocolAtts";
assert conf.containsKey("vRemoveBlanks") : "configuration requires vRemoveBlanks";
assert conf.containsKey("vAllowedEntities") : "configuration requires vAllowedEntities";
this.vAllowed = Collections.unmodifiableMap((HashMap)conf.get("vAllowed"));
this.vSelfClosingTags = (String[])((String[])conf.get("vSelfClosingTags"));
this.vNeedClosingTags = (String[])((String[])conf.get("vNeedClosingTags"));
this.vDisallowed = (String[])((String[])conf.get("vDisallowed"));
this.vAllowedProtocols = (String[])((String[])conf.get("vAllowedProtocols"));
this.vProtocolAtts = (String[])((String[])conf.get("vProtocolAtts"));
this.vRemoveBlanks = (String[])((String[])conf.get("vRemoveBlanks"));
this.vAllowedEntities = (String[])((String[])conf.get("vAllowedEntities"));
this.stripComment = conf.containsKey("stripComment") ? (Boolean)conf.get("stripComment") : true;
this.encodeQuotes = conf.containsKey("encodeQuotes") ? (Boolean)conf.get("encodeQuotes") : true;
this.alwaysMakeTags = conf.containsKey("alwaysMakeTags") ? (Boolean)conf.get("alwaysMakeTags") : true;
}
private void reset() {
this.vTagCounts.clear();
}
private void debug(String msg) {
if (this.vDebug) {
Console.log(msg);
}
}
public static String chr(int decimal) {
return String.valueOf((char)decimal);
}
public static String htmlSpecialChars(String s) {
String result = regexReplace(P_AMP, "&amp;", s);
result = regexReplace(P_PERCENT, "&permil;", result);
result = regexReplace(P_QUOTE, "&quot;", result);
result = regexReplace(P_LEFT_ARROW, "&lt;", result);
result = regexReplace(P_RIGHT_ARROW, "&gt;", result);
return result;
}
public String filter(String input) {
this.reset();
this.debug("************************************************");
this.debug(" INPUT: " + input);
String s = this.escapeComments(input);
this.debug(" escapeComments: " + s);
s = this.balanceHTML(s);
this.debug(" balanceHTML: " + s);
s = this.checkTags(s);
this.debug(" checkTags: " + s);
s = this.processRemoveBlanks(s);
this.debug("processRemoveBlanks: " + s);
s = this.validateEntities(s);
this.debug(" validateEntites: " + s);
this.debug("************************************************\n\n");
return s;
}
public boolean isAlwaysMakeTags() {
return this.alwaysMakeTags;
}
public boolean isStripComments() {
return this.stripComment;
}
private String escapeComments(String s) {
Matcher m = P_COMMENTS.matcher(s);
StringBuffer buf = new StringBuffer();
if (m.find()) {
String match = m.group(1);
m.appendReplacement(buf, Matcher.quoteReplacement("<!--" + htmlSpecialChars(match) + "-->"));
}
m.appendTail(buf);
return buf.toString();
}
private String balanceHTML(String s) {
if (this.alwaysMakeTags) {
/* s = regexReplace(P_END_ARROW, "", s);
s = regexReplace(P_BODY_TO_END, "<$1>", s);
s = regexReplace(P_XML_CONTENT, "$1<$2", s);*/
} else {
s = regexReplace(P_STRAY_LEFT_ARROW, "&lt;$1", s);
s = regexReplace(P_STRAY_RIGHT_ARROW, "$1$2&gt;<", s);
s = regexReplace(P_BOTH_ARROWS, "", s);
}
return s;
}
private String checkTags(String s) {
Matcher m = P_TAGS.matcher(s);
StringBuffer buf = new StringBuffer();
while(m.find()) {
String replaceStr = m.group(1);
replaceStr = this.processTag(replaceStr);
m.appendReplacement(buf, Matcher.quoteReplacement(replaceStr));
}
m.appendTail(buf);
StringBuilder sBuilder = new StringBuilder(buf.toString());
Iterator var5 = this.vTagCounts.keySet().iterator();
while(var5.hasNext()) {
String key = (String)var5.next();
for(int ii = 0; ii < (Integer)this.vTagCounts.get(key); ++ii) {
sBuilder.append("</").append(key).append(">");
}
}
s = sBuilder.toString();
return s;
}
private String processRemoveBlanks(String s) {
String result = s;
String[] var3 = this.vRemoveBlanks;
int var4 = var3.length;
for(int var5 = 0; var5 < var4; ++var5) {
String tag = var3[var5];
if (!P_REMOVE_PAIR_BLANKS.containsKey(tag)) {
P_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?></" + tag + ">"));
}
result = regexReplace((Pattern)P_REMOVE_PAIR_BLANKS.get(tag), "", result);
if (!P_REMOVE_SELF_BLANKS.containsKey(tag)) {
P_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?/>"));
}
result = regexReplace((Pattern)P_REMOVE_SELF_BLANKS.get(tag), "", result);
}
return result;
}
private static String regexReplace(Pattern regex_pattern, String replacement, String s) {
Matcher m = regex_pattern.matcher(s);
return m.replaceAll(replacement);
}
private String processTag(String s) {
Matcher m = P_END_TAG.matcher(s);
String name;
if (m.find()) {
name = m.group(1).toLowerCase();
if (this.allowed(name) && !inArray(name, this.vSelfClosingTags) && this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) - 1);
return "</" + name + ">";
}
}
m = P_START_TAG.matcher(s);
if (!m.find()) {
m = P_COMMENT.matcher(s);
return !this.stripComment && m.find() ? "<" + m.group() + ">" : "";
} else {
name = m.group(1).toLowerCase();
String body = m.group(2);
String ending = m.group(3);
if (!this.allowed(name)) {
return "";
} else {
StringBuilder params = new StringBuilder();
Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body);
Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body);
List<String> paramNames = new ArrayList();
ArrayList paramValues = new ArrayList();
while(m2.find()) {
paramNames.add(m2.group(1));
paramValues.add(m2.group(3));
}
while(m3.find()) {
paramNames.add(m3.group(1));
paramValues.add(m3.group(3));
}
for(int ii = 0; ii < paramNames.size(); ++ii) {
String paramName = ((String)paramNames.get(ii)).toLowerCase();
String paramValue = (String)paramValues.get(ii);
if (this.allowedAttribute(name, paramName)) {
if (inArray(paramName, this.vProtocolAtts)) {
paramValue = this.processParamProtocol(paramValue);
}
params.append(' ').append(paramName).append("=\"").append(paramValue).append("\"");
}
}
if (inArray(name, this.vSelfClosingTags)) {
ending = " /";
}
if (inArray(name, this.vNeedClosingTags)) {
ending = "";
}
if (ending != null && ending.length() >= 1) {
ending = " /";
} else if (this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) + 1);
} else {
this.vTagCounts.put(name, 1);
}
return "<" + name + params + ending + ">";
}
}
}
private String processParamProtocol(String s) {
s = this.decodeEntities(s);
Matcher m = P_PROTOCOL.matcher(s);
if (m.find()) {
String protocol = m.group(1);
if (!inArray(protocol, this.vAllowedProtocols)) {
s = "#" + s.substring(protocol.length() + 1);
if (s.startsWith("#//")) {
s = "#" + s.substring(3);
}
}
}
return s;
}
private String decodeEntities(String s) {
StringBuffer buf = new StringBuffer();
Matcher m = P_ENTITY.matcher(s);
String match;
int decimal;
while(m.find()) {
match = m.group(1);
decimal = Integer.decode(match);
m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
}
m.appendTail(buf);
s = buf.toString();
buf = new StringBuffer();
m = P_ENTITY_UNICODE.matcher(s);
while(m.find()) {
match = m.group(1);
decimal = Integer.valueOf(match, 16);
m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
}
m.appendTail(buf);
s = buf.toString();
buf = new StringBuffer();
m = P_ENCODE.matcher(s);
while(m.find()) {
match = m.group(1);
decimal = Integer.valueOf(match, 16);
m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
}
m.appendTail(buf);
s = buf.toString();
s = this.validateEntities(s);
return s;
}
private String validateEntities(String s) {
StringBuffer buf = new StringBuffer();
Matcher m = P_VALID_ENTITIES.matcher(s);
while(m.find()) {
String one = m.group(1);
String two = m.group(2);
m.appendReplacement(buf, Matcher.quoteReplacement(this.checkEntity(one, two)));
}
m.appendTail(buf);
return this.encodeQuotes(buf.toString());
}
private String encodeQuotes(String s) {
if (!this.encodeQuotes) {
return s;
} else {
StringBuffer buf = new StringBuffer();
Matcher m = P_VALID_QUOTES.matcher(s);
while(m.find()) {
String one = m.group(1);
String two = m.group(2);
String three = m.group(3);
m.appendReplacement(buf, Matcher.quoteReplacement(one + regexReplace(P_QUOTE, "&quot;", two) + three));
}
m.appendTail(buf);
return buf.toString();
}
}
private String checkEntity(String preamble, String term) {
return ";".equals(term) && this.isValidEntity(preamble) ? '&' + preamble : "&amp;" + preamble;
}
private boolean isValidEntity(String entity) {
return inArray(entity, this.vAllowedEntities);
}
private static boolean inArray(String s, String[] array) {
String[] var2 = array;
int var3 = array.length;
for(int var4 = 0; var4 < var3; ++var4) {
String item = var2[var4];
if (item != null && item.equals(s)) {
return true;
}
}
return false;
}
private boolean allowed(String name) {
return (this.vAllowed.isEmpty() || this.vAllowed.containsKey(name)) && !inArray(name, this.vDisallowed);
}
private boolean allowedAttribute(String name, String paramName) {
return this.allowed(name) && (this.vAllowed.isEmpty() || ((List)this.vAllowed.get(name)).contains(paramName));
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/SQLFilter.java
+33
View File
@@ -0,0 +1,33 @@
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package com.jero.config.safeFilter.Xss;
import org.apache.commons.lang.StringUtils;
public class SQLFilter {
public SQLFilter() {
}
public static String sqlInject(String str) {
if (StringUtils.isBlank(str)) {
return null;
} else {
str = StringUtils.replace(str, "\\", "");
String[] keywords = new String[]{"master", "truncate", "insert", "select", "delete", "update", "declare", "alter", "drop"};
String[] var2 = keywords;
int var3 = keywords.length;
for(int var4 = 0; var4 < var3; ++var4) {
String keyword = var2[var4];
if (StringUtils.indexOfIgnoreCase(str, keyword + " ") != -1) {
throw new RuntimeException("包含非法字符");
}
}
return str;
}
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssFilter.java
+69
View File
@@ -0,0 +1,69 @@
package com.jero.config.safeFilter.Xss;
import org.apache.commons.lang3.StringUtils;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
public class XssFilter implements Filter {
private String excludedPages;
private String[] excludedPageArray;
public XssFilter(String excludedPages) {
this.excludedPages=excludedPages;
}
public void init(FilterConfig config) throws ServletException {
if (StringUtils.isNotEmpty(this.excludedPages)) {
this.excludedPageArray = this.excludedPages.split(",");
}
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
boolean isExcludedPage = false;
if (this.isNotEmpty(this.excludedPageArray)) {
String[] excludedPages = this.excludedPageArray;
int excludedPageLength = excludedPages.length;
for(int i = 0; i < excludedPageLength; ++i) {
String page = excludedPages[i];
if (((HttpServletRequest)request).getRequestURI().contains(page)) {
isExcludedPage = true;
break;
}
}
}
if (isExcludedPage) {
chain.doFilter(request, response);
} else {
XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest)request);
chain.doFilter(xssRequest, response);
}
}
public void destroy() {
}
public static String filterNull(Object o) {
return o != null && !"null".equals(o.toString()) ? o.toString().trim() : "";
}
public static boolean isNotEmpty(Object o) {
if (o == null) {
return false;
} else {
return !"".equals(filterNull(o.toString()));
}
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/Xss/XssHttpServletRequestWrapper.java
+126
View File
@@ -0,0 +1,126 @@
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package com.jero.config.safeFilter.Xss;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang.StringUtils;
import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.util.Iterator;
import java.util.LinkedHashMap;
import java.util.Map;
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
HttpServletRequest orgRequest;
private static final HTMLFilter htmlFilter = new HTMLFilter();
private static final SQLFilter sqlFilter = new SQLFilter();
public XssHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
this.orgRequest = request;
}
public ServletInputStream getInputStream() throws IOException {
String type = super.getHeader("Content-Type");
if (StringUtils.indexOfIgnoreCase(type, "application/json") < 0) {
return super.getInputStream();
} else {
String json = IOUtils.toString(super.getInputStream(), "utf-8");
if (StringUtils.isBlank(json)) {
return super.getInputStream();
} else {
json = this.xssSqlEncode(json);
final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes("utf-8"));
return new ServletInputStream() {
public boolean isFinished() {
return true;
}
public boolean isReady() {
return true;
}
public void setReadListener(ReadListener readListener) {
}
public int read() throws IOException {
return bis.read();
}
};
}
}
}
public String getParameter(String name) {
String value = super.getParameter(this.xssSqlEncode(name));
if (StringUtils.isNotBlank(value)) {
value = this.xssSqlEncode(value);
}
return value;
}
public String[] getParameterValues(String name) {
String[] parameters = super.getParameterValues(name);
if (parameters != null && parameters.length != 0) {
for(int i = 0; i < parameters.length; ++i) {
parameters[i] = this.xssSqlEncode(parameters[i]);
}
return parameters;
} else {
return null;
}
}
public Map<String, String[]> getParameterMap() {
Map<String, String[]> map = new LinkedHashMap();
Map<String, String[]> parameters = super.getParameterMap();
Iterator var3 = parameters.keySet().iterator();
while(var3.hasNext()) {
String key = (String)var3.next();
String[] values = (String[])parameters.get(key);
for(int i = 0; i < values.length; ++i) {
values[i] = this.xssSqlEncode(values[i]);
}
map.put(key, values);
}
return map;
}
public String getHeader(String name) {
String value = super.getHeader(this.xssSqlEncode(name));
if (StringUtils.isNotBlank(value)) {
value = this.xssSqlEncode(value);
}
return value;
}
private String xssSqlEncode(String input) {
input=input.replaceAll("%5b","[").replaceAll("%5d","]");
String htmlOutput=input;
htmlOutput= htmlFilter.filter(input);
return SQLFilter.sqlInject(htmlOutput);
}
public HttpServletRequest getOrgRequest() {
return this.orgRequest;
}
public static HttpServletRequest getOrgRequest(HttpServletRequest request) {
return request instanceof XssHttpServletRequestWrapper ? ((XssHttpServletRequestWrapper)request).getOrgRequest() : request;
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/cors/CorsFilter.java
+100
View File
@@ -0,0 +1,100 @@
package com.jero.config.safeFilter.cors;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
import java.util.Objects;
/**
* 设置响应信息
*/
@WebFilter(urlPatterns = {"/verifyCode/**"})
public class CorsFilter implements Filter {
private static final Log LOGGER = LogFactory.getLog(CorsFilter.class);
private int size = 0;
private String origin;
private String notFilter;
public CorsFilter(String origin, String notFilter) {
this.origin = origin;
this.notFilter = notFilter;
}
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
final String origin = ((HttpServletRequest) request).getHeader("Origin");
//请求头与系统的origin不通则咔嚓
// if (Objects.nonNull(origin) || this.origin.contains(origin)){
// return;
// }
if (Objects.nonNull(origin) && !this.origin.contains(origin)){
return;
}
//获取请求路径
String url = req.getRequestURL().toString();
String[] interfaceNameArr = notFilter.split(",");
if (!isMSBrowser(req)){
for (String name : interfaceNameArr) {
//如果包含,不需要判断Origin是否合法
if(url.contains(name)){
responseInfo(request, response, chain);
// return;
}
}
}
responseInfo(request, response, chain);
}
public boolean isMSBrowser(HttpServletRequest request) {
String[] IEBrowserSignals = {"MSIE", "Trident"};
String userAgent = request.getHeader("User-Agent");
for (String signal : IEBrowserSignals) {
if (userAgent.contains(signal)){
return true;
}
}
return false;
}
private void responseInfo(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
// HttpServletResponse httpServletResponse = (HttpServletResponse) response;
// httpServletResponse.setHeader("Access-Control-Allow-Origin", origin);
// httpServletResponse.addHeader("Access-Control-Allow-Headers", "Authorization");
// httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true");
// httpServletResponse.setHeader("Access-Control-Allow-Methods", "POST, GET, HEAD, OPTIONS, PUT, DELETE");
// httpServletResponse.setHeader("Access-Control-Max-Age", "3600");
// httpServletResponse.setHeader("Content-Security-Policy", "upgrade-insecure-requests;connect-src *");
// httpServletResponse.setHeader("X-Content-Type-Options", "nosniff");
// httpServletResponse.setHeader("X-XSS-Protection", "1;mode=block");
// httpServletResponse.setHeader("Access-Control-Allow-Headers", "Origin, Accept, x-auth-token, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, authorization");
chain.doFilter(request, response);
}
@Override
public void destroy() {
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/CsrfFilter.java
+126
View File
@@ -0,0 +1,126 @@
package com.jero.config.safeFilter.csrf;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Arrays;
import java.util.Date;
import java.util.List;
/**
* CsrfFilter
*/
public class CsrfFilter implements Filter {
public CsrfFilter(String csrfList) {
this.csrfList = csrfList;
}
/**
* LOGGER
*/
private static final Log LOGGER = LogFactory.getLog(CsrfFilter.class);
/**
* 从配置文件读取的csrf白名单字符串
*/
private final String csrfList;
/**
* 白名单
*/
private List<String> whiteUrls;
/**
* size
*/
private int size = 0;
/**
* 读取文件
*
* @param filterConfig
*/
public void init(FilterConfig filterConfig) {
// 读取文件
String path = CsrfFilter.class.getResource("/").getFile();
// whiteUrls = FileUtil.readAsStringList(path + "csrfWhite.txt");
whiteUrls = Arrays.asList(csrfList.split(","));
size = whiteUrls.size();
}
/**
* @param request
* @param response
* @param chain
* @throws IOException
* @throws ServletException
*/
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
// try {
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
// 获取请求url地址
String url = req.getRequestURL().toString();
String referurl = req.getHeader("Referer");
if (isWhiteReq(referurl)) {
chain.doFilter(request, response);
} else {
req.getRequestDispatcher("/").forward(req, res);
// 记录跨站请求日志
String log = "";
String date = new SimpleDateFormat("yyyyMMddHHmmss").format(new Date());
String clientIp = RequestUtils.getClientIp(req);
log = "跨站请求---->>>" + clientIp + "||" + date + "||" + referurl + "||" + url;
LOGGER.warn(log);
}
// } catch (Exception e) {
// LOGGER.error("doFilter", e);
// }
}
/**
* 判断是否是白名单
*/
private boolean isWhiteReq(String referUrl) {
if (referUrl == null || "".equals(referUrl) || size == 0) {
return true;
} else {
String refHost = "";
referUrl = referUrl.toLowerCase();
if (referUrl.startsWith("http://")) {
refHost = referUrl.substring(7);
} else if (referUrl.startsWith("https://")) {
refHost = referUrl.substring(8);
}
for (String urlTemp : whiteUrls) {
if (refHost.contains(urlTemp.toLowerCase())) {
return true;
}
}
}
return false;
}
/**
* destroy
*/
public void destroy() {
}
}
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/safeFilter/csrf/RequestUtils.java
+37
View File
@@ -0,0 +1,37 @@
package com.jero.config.safeFilter.csrf;
import org.apache.commons.lang3.StringUtils;
import javax.servlet.http.HttpServletRequest;
public class RequestUtils {
public static final String LOGIN_USER = "LOGIN_USER";
public static final String LOGIN_USER_ID = "LOGIN_USER_ID";
public static final String LOGIN_ROLE_ID = "LOGIN_ROLE_ID";
/**
* 获取客户端IP地址
* @param request
* @return
*/
public static String getClientIp(HttpServletRequest request) {
String remoteAddr = "";
if (request != null) {
remoteAddr = request.getHeader("X-FORWARDED-FOR");
if (StringUtils.isEmpty(remoteAddr)) {
remoteAddr = request.getRemoteAddr();
}
}
return remoteAddr;
}
public static String getLoginUserId(HttpServletRequest request) {
return (String) request.getSession().getAttribute(LOGIN_USER_ID);
}
public static String getLoginRoleId(HttpServletRequest request) {
return (String) request.getSession().getAttribute(LOGIN_ROLE_ID);
}
}
jero-boot/jero-boot-base/jero-boot-base-generater/src/main/java/com/jero/generater/modules/online/cgform/entity/OnlCgformField.java
+9
View File
@@ -75,6 +75,15 @@ public class OnlCgformField implements Serializable {
private String queryValidType;
private String queryMustInput;
private String sortFlag;
private String isShowSearch;
public String getIsShowSearch() {
return isShowSearch;
}
public void setIsShowSearch(String isShowSearch) {
this.isShowSearch = isShowSearch;
}
public String getDictId() {
return dictId;