From 2455d0b859708e39fa9fd5b710bebee45c32b085 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=96=AF=E7=8B=82=E7=9A=84=E7=8B=AE=E5=AD=90li?= <15040126243@163.com> Date: Wed, 15 Dec 2021 15:03:44 +0800 Subject: [PATCH] =?UTF-8?q?add=20=E5=A2=9E=E5=8A=A0=20=E8=87=AA=E5=AE=9A?= =?UTF-8?q?=E4=B9=89=20Xss=20=E6=A0=A1=E9=AA=8C=E6=B3=A8=E8=A7=A3=20?= =?UTF-8?q?=E7=94=A8=E6=88=B7=E5=AF=BC=E5=85=A5=E5=A2=9E=E5=8A=A0=20Bean?= =?UTF-8?q?=20=E6=A0=A1=E9=AA=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../ruoyi/common/utils/ValidatorUtils.java | 4 +- .../common/utils/bean/BeanValidators.java | 24 --------- .../main/java/com/ruoyi/common/xss/Xss.java | 53 +++++++++---------- .../com/ruoyi/common/xss/XssValidator.java | 50 ++++++++--------- .../listener/SysUserImportListener.java | 3 ++ 5 files changed, 52 insertions(+), 82 deletions(-) delete mode 100644 ruoyi-common/src/main/java/com/ruoyi/common/utils/bean/BeanValidators.java diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/utils/ValidatorUtils.java b/ruoyi-common/src/main/java/com/ruoyi/common/utils/ValidatorUtils.java index e26e7846c..522b989b9 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/utils/ValidatorUtils.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/utils/ValidatorUtils.java @@ -1,11 +1,11 @@ package com.ruoyi.common.utils; +import com.ruoyi.common.utils.spring.SpringUtils; import lombok.AccessLevel; import lombok.NoArgsConstructor; import javax.validation.ConstraintViolation; import javax.validation.ConstraintViolationException; -import javax.validation.Validation; import javax.validation.Validator; import java.util.Set; @@ -17,7 +17,7 @@ import java.util.Set; @NoArgsConstructor(access = AccessLevel.PRIVATE) public class ValidatorUtils { - private static final Validator VALID = Validation.buildDefaultValidatorFactory().getValidator(); + private static final Validator VALID = SpringUtils.getBean(Validator.class); public static void validate(T object, Class... groups) { Set> validate = VALID.validate(object, groups); diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/utils/bean/BeanValidators.java b/ruoyi-common/src/main/java/com/ruoyi/common/utils/bean/BeanValidators.java deleted file mode 100644 index d9821e0ec..000000000 --- a/ruoyi-common/src/main/java/com/ruoyi/common/utils/bean/BeanValidators.java +++ /dev/null @@ -1,24 +0,0 @@ -package com.ruoyi.common.utils.bean; - -import java.util.Set; -import javax.validation.ConstraintViolation; -import javax.validation.ConstraintViolationException; -import javax.validation.Validator; - -/** - * bean对象属性验证 - * - * @author ruoyi - */ -public class BeanValidators -{ - public static void validateWithException(Validator validator, Object object, Class... groups) - throws ConstraintViolationException - { - Set> constraintViolations = validator.validate(object, groups); - if (!constraintViolations.isEmpty()) - { - throw new ConstraintViolationException(constraintViolations); - } - } -} diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/xss/Xss.java b/ruoyi-common/src/main/java/com/ruoyi/common/xss/Xss.java index 14e43dc55..0a26d60a5 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/xss/Xss.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/xss/Xss.java @@ -1,27 +1,26 @@ -package com.ruoyi.common.xss; - -import javax.validation.Constraint; -import javax.validation.Payload; -import java.lang.annotation.ElementType; -import java.lang.annotation.Retention; -import java.lang.annotation.RetentionPolicy; -import java.lang.annotation.Target; - -/** - * 自定义xss校验注解 - * - * @author ruoyi - */ -@Retention(RetentionPolicy.RUNTIME) -@Target(value = { ElementType.METHOD, ElementType.FIELD, ElementType.CONSTRUCTOR, ElementType.PARAMETER }) -@Constraint(validatedBy = { XssValidator.class }) -public @interface Xss -{ - String message() - - default "不允许任何脚本运行"; - - Class[] groups() default {}; - - Class[] payload() default {}; -} +package com.ruoyi.common.xss; + +import javax.validation.Constraint; +import javax.validation.Payload; +import java.lang.annotation.ElementType; +import java.lang.annotation.Retention; +import java.lang.annotation.RetentionPolicy; +import java.lang.annotation.Target; + +/** + * 自定义xss校验注解 + * + * @author Lion Li + */ +@Retention(RetentionPolicy.RUNTIME) +@Target(value = {ElementType.METHOD, ElementType.FIELD, ElementType.CONSTRUCTOR, ElementType.PARAMETER}) +@Constraint(validatedBy = {XssValidator.class}) +public @interface Xss { + + String message() default "不允许任何脚本运行"; + + Class[] groups() default {}; + + Class[] payload() default {}; + +} diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/xss/XssValidator.java b/ruoyi-common/src/main/java/com/ruoyi/common/xss/XssValidator.java index 43163721d..03102df66 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/xss/XssValidator.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/xss/XssValidator.java @@ -1,29 +1,21 @@ -package com.ruoyi.common.xss; - -import javax.validation.ConstraintValidator; -import javax.validation.ConstraintValidatorContext; -import java.util.regex.Matcher; -import java.util.regex.Pattern; - -/** - * 自定义xss校验注解实现 - * - * @author ruoyi - */ -public class XssValidator implements ConstraintValidator -{ - private final String HTML_PATTERN = "<(\\S*?)[^>]*>.*?|<.*? />"; - - @Override - public boolean isValid(String value, ConstraintValidatorContext constraintValidatorContext) - { - return !containsHtml(value); - } - - public boolean containsHtml(String value) - { - Pattern pattern = Pattern.compile(HTML_PATTERN); - Matcher matcher = pattern.matcher(value); - return matcher.matches(); - } -} \ No newline at end of file +package com.ruoyi.common.xss; + +import cn.hutool.core.util.ReUtil; +import cn.hutool.http.HtmlUtil; + +import javax.validation.ConstraintValidator; +import javax.validation.ConstraintValidatorContext; + +/** + * 自定义xss校验注解实现 + * + * @author Lion Li + */ +public class XssValidator implements ConstraintValidator { + + @Override + public boolean isValid(String value, ConstraintValidatorContext constraintValidatorContext) { + return !ReUtil.contains(HtmlUtil.RE_HTML_MARK, value); + } + +} diff --git a/ruoyi-system/src/main/java/com/ruoyi/system/listener/SysUserImportListener.java b/ruoyi-system/src/main/java/com/ruoyi/system/listener/SysUserImportListener.java index a53e9091a..3b700d48c 100644 --- a/ruoyi-system/src/main/java/com/ruoyi/system/listener/SysUserImportListener.java +++ b/ruoyi-system/src/main/java/com/ruoyi/system/listener/SysUserImportListener.java @@ -9,6 +9,7 @@ import com.ruoyi.common.excel.ExcelResult; import com.ruoyi.common.exception.ServiceException; import com.ruoyi.common.utils.SecurityUtils; import com.ruoyi.common.utils.StringUtils; +import com.ruoyi.common.utils.ValidatorUtils; import com.ruoyi.common.utils.spring.SpringUtils; import com.ruoyi.system.domain.vo.SysUserImportVo; import com.ruoyi.system.service.ISysConfigService; @@ -53,12 +54,14 @@ public class SysUserImportListener extends AnalysisEventListener").append(successNum).append("、账号 ").append(user.getUserName()).append(" 导入成功"); } else if (isUpdateSupport) { + ValidatorUtils.validate(user); user.setUpdateBy(operName); userService.updateUser(user); successNum++;