From e165901506650822922cd2b84364f64dfe3f12c8 Mon Sep 17 00:00:00 2001 From: RuoYi Date: Mon, 1 Nov 2021 15:44:42 +0800 Subject: [PATCH 1/6] =?UTF-8?q?=E7=99=BB=E5=BD=95/=E9=AA=8C=E8=AF=81?= =?UTF-8?q?=E7=A0=81=E8=AF=B7=E6=B1=82headers=E4=B8=8D=E8=AE=BE=E7=BD=AEto?= =?UTF-8?q?ken?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ruoyi-ui/src/api/login.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ruoyi-ui/src/api/login.js b/ruoyi-ui/src/api/login.js index 74ed95ed..6b0cda03 100644 --- a/ruoyi-ui/src/api/login.js +++ b/ruoyi-ui/src/api/login.js @@ -4,6 +4,9 @@ import request from '@/utils/request' export function login(username, password, code, uuid) { return request({ url: '/auth/login', + headers: { + isToken: false + }, method: 'post', data: { username, password, code, uuid } }) @@ -49,6 +52,9 @@ export function logout() { export function getCodeImg() { return request({ url: '/code', + headers: { + isToken: false + }, method: 'get', timeout: 20000 }) From 92e5d2a97a3255954211d1bfbb62ce1a1f83df5c Mon Sep 17 00:00:00 2001 From: RuoYi Date: Mon, 1 Nov 2021 15:44:58 +0800 Subject: [PATCH 2/6] =?UTF-8?q?=E5=9B=9E=E6=98=BE=E6=95=B0=E6=8D=AE?= =?UTF-8?q?=E5=AD=97=E5=85=B8=E9=94=AE=E5=80=BC=E4=BF=AE=E6=AD=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ruoyi-ui/src/utils/ruoyi.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ruoyi-ui/src/utils/ruoyi.js b/ruoyi-ui/src/utils/ruoyi.js index 8d5bfc6d..0bdaa618 100644 --- a/ruoyi-ui/src/utils/ruoyi.js +++ b/ruoyi-ui/src/utils/ruoyi.js @@ -87,8 +87,8 @@ export function selectDictLabels(datas, value, separator) { var temp = value.split(currentSeparator); Object.keys(value.split(currentSeparator)).some((val) => { Object.keys(datas).some((key) => { - if (datas[key].dictValue == ('' + temp[val])) { - actions.push(datas[key].dictLabel + currentSeparator); + if (datas[key].value == ('' + temp[val])) { + actions.push(datas[key].label + currentSeparator); } }) }) From acf8d9719fe55260ee5ae2ccff3b1b4732bcbf72 Mon Sep 17 00:00:00 2001 From: RuoYi Date: Mon, 1 Nov 2021 15:45:10 +0800 Subject: [PATCH 3/6] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=AD=97=E7=AC=A6?= =?UTF-8?q?=E4=B8=B2=E6=97=A0=E6=B3=95=E8=A2=AB=E5=8F=8D=E8=BD=AC=E4=B9=89?= =?UTF-8?q?=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../common/core/utils/html/EscapeUtil.java | 34 +++++++++++++------ 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/html/EscapeUtil.java b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/html/EscapeUtil.java index 9ddae356..2f5a8721 100644 --- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/html/EscapeUtil.java +++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/html/EscapeUtil.java @@ -69,26 +69,37 @@ public class EscapeUtil */ private static String encode(String text) { - int len; - if ((text == null) || ((len = text.length()) == 0)) + if (StringUtils.isEmpty(text)) { return StringUtils.EMPTY; } - StringBuilder buffer = new StringBuilder(len + (len >> 2)); + + final StringBuilder tmp = new StringBuilder(text.length() * 6); char c; - for (int i = 0; i < len; i++) + for (int i = 0; i < text.length(); i++) { c = text.charAt(i); - if (c < 64) + if (c < 256) { - buffer.append(TEXT[c]); + tmp.append("%"); + if (c < 16) + { + tmp.append("0"); + } + tmp.append(Integer.toString(c, 16)); } else { - buffer.append(c); + tmp.append("%u"); + if (c <= 0xfff) + { + // issue#I49JU8@Gitee + tmp.append("0"); + } + tmp.append(Integer.toString(c, 16)); } } - return buffer.toString(); + return tmp.toString(); } /** @@ -145,11 +156,12 @@ public class EscapeUtil public static void main(String[] args) { String html = ""; + String escape = EscapeUtil.escape(html); // String html = "ipt>alert(\"XSS\")ipt>"; // String html = "<123"; // String html = "123>"; - System.out.println(EscapeUtil.clean(html)); - System.out.println(EscapeUtil.escape(html)); - System.out.println(EscapeUtil.unescape(html)); + System.out.println("clean: " + EscapeUtil.clean(html)); + System.out.println("escape: " + escape); + System.out.println("unescape: " + EscapeUtil.unescape(escape)); } } From 68db4092ed2926564d80692e5d1ea46112bbe61c Mon Sep 17 00:00:00 2001 From: RuoYi Date: Mon, 1 Nov 2021 15:45:22 +0800 Subject: [PATCH 4/6] =?UTF-8?q?=E4=BB=BB=E5=8A=A1=E5=B1=8F=E8=94=BD?= =?UTF-8?q?=E8=BF=9D=E8=A7=84=E5=AD=97=E7=AC=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../java/com/ruoyi/common/core/constant/Constants.java | 6 ++++++ .../java/com/ruoyi/job/controller/SysJobController.java | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java index edb90246..d97ba692 100644 --- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java +++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java @@ -112,4 +112,10 @@ public class Constants * 资源映射路径 前缀 */ public static final String RESOURCE_PREFIX = "/profile"; + + /** + * 定时任务违规的字符 + */ + public static final String[] JOB_ERROR_STR = { "java.net.URL", "javax.naming.InitialContext", "org.yaml.snakeyaml", + "org.springframework.jndi" }; } diff --git a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java index 4fbd5eae..5cf87af7 100644 --- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java +++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java @@ -99,6 +99,10 @@ public class SysJobController extends BaseController { return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用"); } + else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR)) + { + return error("新增任务'" + job.getJobName() + "'失败，目标字符串存在违规"); + } job.setCreateBy(SecurityUtils.getUsername()); return toAjax(jobService.insertJob(job)); } @@ -127,6 +131,10 @@ public class SysJobController extends BaseController { return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用"); } + else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR)) + { + return error("修改任务'" + job.getJobName() + "'失败，目标字符串存在违规"); + } job.setUpdateBy(SecurityUtils.getUsername()); return toAjax(jobService.updateJob(job)); } From 52111e4bf9ee2a11a6ad4dc99521a8387e2dc94a Mon Sep 17 00:00:00 2001 From: RuoYi Date: Wed, 10 Nov 2021 11:27:54 +0800 Subject: [PATCH 5/6] =?UTF-8?q?=E5=8D=87=E7=BA=A7axios=E5=88=B0=E6=9C=80?= =?UTF-8?q?=E6=96=B0=E7=89=88=E6=9C=AC0.24.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ruoyi-ui/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ruoyi-ui/package.json b/ruoyi-ui/package.json index fbcebb9a..4176a049 100644 --- a/ruoyi-ui/package.json +++ b/ruoyi-ui/package.json @@ -37,7 +37,7 @@ }, "dependencies": { "@riophae/vue-treeselect": "0.4.0", - "axios": "0.21.0", + "axios": "0.24.0", "clipboard": "2.0.6", "core-js": "3.8.1", "echarts": "4.9.0", From 6adc583c38df6116e5a9833b615ff910e422a814 Mon Sep 17 00:00:00 2001 From: RuoYi Date: Wed, 10 Nov 2021 11:29:39 +0800 Subject: [PATCH 6/6] =?UTF-8?q?=E5=8D=87=E7=BA=A7spring-boot-admin?= =?UTF-8?q?=E5=88=B0=E6=9C=80=E6=96=B0=E7=89=882.5.3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index d4ecdd6c..3336a503 100644 --- a/pom.xml +++ b/pom.xml @@ -21,7 +21,7 @@ 2020.0.4 2021.1 2.0.3 - 2.5.2 + 2.5.3 2.2.0 3.0.0 1.6.2