diff --git a/pom.xml b/pom.xml
index 0461bc40..ce84ab39 100644
--- a/pom.xml
+++ b/pom.xml
@@ -21,7 +21,7 @@
2020.0.4
2021.1
2.0.3
- 2.5.2
+ 2.5.3
2.2.0
3.0.0
1.6.2
diff --git a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java
index edb90246..d97ba692 100644
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java
@@ -112,4 +112,10 @@ public class Constants
* 资源映射路径 前缀
*/
public static final String RESOURCE_PREFIX = "/profile";
+
+ /**
+ * 定时任务违规的字符
+ */
+ public static final String[] JOB_ERROR_STR = { "java.net.URL", "javax.naming.InitialContext", "org.yaml.snakeyaml",
+ "org.springframework.jndi" };
}
diff --git a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/html/EscapeUtil.java b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/html/EscapeUtil.java
index 9ddae356..2f5a8721 100644
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/html/EscapeUtil.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/html/EscapeUtil.java
@@ -69,26 +69,37 @@ public class EscapeUtil
*/
private static String encode(String text)
{
- int len;
- if ((text == null) || ((len = text.length()) == 0))
+ if (StringUtils.isEmpty(text))
{
return StringUtils.EMPTY;
}
- StringBuilder buffer = new StringBuilder(len + (len >> 2));
+
+ final StringBuilder tmp = new StringBuilder(text.length() * 6);
char c;
- for (int i = 0; i < len; i++)
+ for (int i = 0; i < text.length(); i++)
{
c = text.charAt(i);
- if (c < 64)
+ if (c < 256)
{
- buffer.append(TEXT[c]);
+ tmp.append("%");
+ if (c < 16)
+ {
+ tmp.append("0");
+ }
+ tmp.append(Integer.toString(c, 16));
}
else
{
- buffer.append(c);
+ tmp.append("%u");
+ if (c <= 0xfff)
+ {
+ // issue#I49JU8@Gitee
+ tmp.append("0");
+ }
+ tmp.append(Integer.toString(c, 16));
}
}
- return buffer.toString();
+ return tmp.toString();
}
/**
@@ -145,11 +156,12 @@ public class EscapeUtil
public static void main(String[] args)
{
String html = "";
+ String escape = EscapeUtil.escape(html);
// String html = "ipt>alert(\"XSS\")ipt>";
// String html = "<123";
// String html = "123>";
- System.out.println(EscapeUtil.clean(html));
- System.out.println(EscapeUtil.escape(html));
- System.out.println(EscapeUtil.unescape(html));
+ System.out.println("clean: " + EscapeUtil.clean(html));
+ System.out.println("escape: " + escape);
+ System.out.println("unescape: " + EscapeUtil.unescape(escape));
}
}
diff --git a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java
index d3143984..f7e33a6e 100644
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java
@@ -2,7 +2,6 @@ package com.ruoyi.common.core.utils.poi;
import java.io.IOException;
import java.io.InputStream;
-import java.io.OutputStream;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.math.BigDecimal;
@@ -357,7 +356,7 @@ public class ExcelUtil
* @return 结果
* @throws IOException
*/
- public void exportExcel(HttpServletResponse response, List list, String sheetName)throws IOException
+ public void exportExcel(HttpServletResponse response, List list, String sheetName)
{
exportExcel(response, list, sheetName, StringUtils.EMPTY);
}
@@ -372,12 +371,12 @@ public class ExcelUtil
* @return 结果
* @throws IOException
*/
- public void exportExcel(HttpServletResponse response, List list, String sheetName, String title) throws IOException
+ public void exportExcel(HttpServletResponse response, List list, String sheetName, String title)
{
response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
response.setCharacterEncoding("utf-8");
this.init(list, sheetName, title, Type.EXPORT);
- exportExcel(response.getOutputStream());
+ exportExcel(response);
}
/**
@@ -392,7 +391,7 @@ public class ExcelUtil
* @param sheetName 工作表的名称
* @return 结果
*/
- public void importTemplateExcel(HttpServletResponse response, String sheetName) throws IOException
+ public void importTemplateExcel(HttpServletResponse response, String sheetName)
{
importTemplateExcel(response, sheetName, StringUtils.EMPTY);
}
@@ -404,12 +403,12 @@ public class ExcelUtil
* @param title 标题
* @return 结果
*/
- public void importTemplateExcel(HttpServletResponse response, String sheetName, String title) throws IOException
+ public void importTemplateExcel(HttpServletResponse response, String sheetName, String title)
{
response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
response.setCharacterEncoding("utf-8");
this.init(null, sheetName, title, Type.IMPORT);
- exportExcel(response.getOutputStream());
+ exportExcel(response);
}
/**
@@ -417,12 +416,12 @@ public class ExcelUtil
*
* @return 结果
*/
- public void exportExcel(OutputStream out)
+ public void exportExcel(HttpServletResponse response)
{
try
{
writeSheet();
- wb.write(out);
+ wb.write(response.getOutputStream());
}
catch (Exception e)
{
@@ -431,7 +430,6 @@ public class ExcelUtil
finally
{
IOUtils.closeQuietly(wb);
- IOUtils.closeQuietly(out);
}
}
diff --git a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
index 021cf436..08307fcf 100644
--- a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
+++ b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
@@ -7,7 +7,9 @@ import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.core.io.buffer.DataBuffer;
+import org.springframework.core.io.buffer.DataBufferFactory;
import org.springframework.core.io.buffer.DataBufferUtils;
+import org.springframework.core.io.buffer.DefaultDataBufferFactory;
import org.springframework.core.io.buffer.NettyDataBufferFactory;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
@@ -70,10 +72,12 @@ public class XssFilter implements GlobalFilter, Ordered
public Flux getBody()
{
Flux body = super.getBody();
- return body.map(dataBuffer -> {
- byte[] content = new byte[dataBuffer.readableByteCount()];
- dataBuffer.read(content);
- DataBufferUtils.release(dataBuffer);
+ return body.buffer().map(dataBuffers -> {
+ DataBufferFactory dataBufferFactory = new DefaultDataBufferFactory();
+ DataBuffer join = dataBufferFactory.join(dataBuffers);
+ byte[] content = new byte[join.readableByteCount()];
+ join.read(content);
+ DataBufferUtils.release(join);
String bodyStr = new String(content, StandardCharsets.UTF_8);
// 防xss攻击过滤
bodyStr = EscapeUtil.clean(bodyStr);
diff --git a/ruoyi-modules/ruoyi-gen/src/main/resources/vm/java/controller.java.vm b/ruoyi-modules/ruoyi-gen/src/main/resources/vm/java/controller.java.vm
index bc5d9bc6..e466592d 100644
--- a/ruoyi-modules/ruoyi-gen/src/main/resources/vm/java/controller.java.vm
+++ b/ruoyi-modules/ruoyi-gen/src/main/resources/vm/java/controller.java.vm
@@ -64,7 +64,7 @@ public class ${ClassName}Controller extends BaseController
@RequiresPermissions("${permissionPrefix}:export")
@Log(title = "${functionName}", businessType = BusinessType.EXPORT)
@PostMapping("/export")
- public void export(HttpServletResponse response, ${ClassName} ${className}) throws IOException
+ public void export(HttpServletResponse response, ${ClassName} ${className})
{
List<${ClassName}> list = ${className}Service.select${ClassName}List(${className});
ExcelUtil<${ClassName}> util = new ExcelUtil<${ClassName}>(${ClassName}.class);
diff --git a/ruoyi-modules/ruoyi-gen/src/main/resources/vm/vue/index.vue.vm b/ruoyi-modules/ruoyi-gen/src/main/resources/vm/vue/index.vue.vm
index f523981a..77d3d63e 100644
--- a/ruoyi-modules/ruoyi-gen/src/main/resources/vm/vue/index.vue.vm
+++ b/ruoyi-modules/ruoyi-gen/src/main/resources/vm/vue/index.vue.vm
@@ -561,7 +561,7 @@ export default {
handleExport() {
this.download('${moduleName}/${businessName}/export', {
...this.queryParams
- }, `${moduleName}_${businessName}.xlsx`)
+ }, `${businessName}_#[[${new Date().getTime()}]]#.xlsx`)
}
}
};
diff --git a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
index 4fbd5eae..1b5ec5dc 100644
--- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
+++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
@@ -1,6 +1,5 @@
package com.ruoyi.job.controller;
-import java.io.IOException;
import java.util.List;
import javax.servlet.http.HttpServletResponse;
import org.quartz.SchedulerException;
@@ -58,7 +57,7 @@ public class SysJobController extends BaseController
@RequiresPermissions("monitor:job:export")
@Log(title = "定时任务", businessType = BusinessType.EXPORT)
@PostMapping("/export")
- public void export(HttpServletResponse response, SysJob sysJob) throws IOException
+ public void export(HttpServletResponse response, SysJob sysJob)
{
List list = jobService.selectJobList(sysJob);
ExcelUtil util = new ExcelUtil(SysJob.class);
@@ -99,6 +98,10 @@ public class SysJobController extends BaseController
{
return error("新增任务'" + job.getJobName() + "'失败,目标字符串不允许'http(s)//'调用");
}
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败,目标字符串存在违规");
+ }
job.setCreateBy(SecurityUtils.getUsername());
return toAjax(jobService.insertJob(job));
}
@@ -127,6 +130,10 @@ public class SysJobController extends BaseController
{
return error("修改任务'" + job.getJobName() + "'失败,目标字符串不允许'http(s)//'调用");
}
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败,目标字符串存在违规");
+ }
job.setUpdateBy(SecurityUtils.getUsername());
return toAjax(jobService.updateJob(job));
}
diff --git a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobLogController.java b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobLogController.java
index abe2b7f5..9b133efa 100644
--- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobLogController.java
+++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobLogController.java
@@ -1,6 +1,5 @@
package com.ruoyi.job.controller;
-import java.io.IOException;
import java.util.List;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
@@ -50,7 +49,7 @@ public class SysJobLogController extends BaseController
@RequiresPermissions("monitor:job:export")
@Log(title = "任务调度日志", businessType = BusinessType.EXPORT)
@PostMapping("/export")
- public void export(HttpServletResponse response, SysJobLog sysJobLog) throws IOException
+ public void export(HttpServletResponse response, SysJobLog sysJobLog)
{
List list = jobLogService.selectJobLogList(sysJobLog);
ExcelUtil util = new ExcelUtil(SysJobLog.class);
diff --git a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/util/JobInvokeUtil.java b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/util/JobInvokeUtil.java
index f8ed1b32..a3527e10 100644
--- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/util/JobInvokeUtil.java
+++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/util/JobInvokeUtil.java
@@ -110,7 +110,7 @@ public class JobInvokeUtil
{
return null;
}
- String[] methodParams = methodStr.split(",");
+ String[] methodParams = methodStr.split(",(?=(?:[^\']*\"[^\']*\')*[^\']*$)");
List