feat:upgrade to 2023.0.5. (#1588)
Haotian Zhang
3 months ago
committed by
GitHub
parent
8b7ce2fe29
commit
f58974bf3b
@ -1,59 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="UTF-8"?>
|
|
||||||
<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
||||||
xmlns="http://maven.apache.org/POM/4.0.0"
|
|
||||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
||||||
<parent>
|
|
||||||
<artifactId>spring-cloud-tencent-plugin-starters</artifactId>
|
|
||||||
<groupId>com.tencent.cloud</groupId>
|
|
||||||
<version>${revision}</version>
|
|
||||||
<relativePath>../pom.xml</relativePath>
|
|
||||||
</parent>
|
|
||||||
<modelVersion>4.0.0</modelVersion>
|
|
||||||
|
|
||||||
<artifactId>spring-cloud-tencent-security-protection-plugin</artifactId>
|
|
||||||
<name>Spring Cloud Tencent Lossless Plugin</name>
|
|
||||||
|
|
||||||
|
|
||||||
<dependencies>
|
|
||||||
<dependency>
|
|
||||||
<groupId>org.springframework.boot</groupId>
|
|
||||||
<artifactId>spring-boot-autoconfigure</artifactId>
|
|
||||||
</dependency>
|
|
||||||
|
|
||||||
<dependency>
|
|
||||||
<groupId>org.springframework</groupId>
|
|
||||||
<artifactId>spring-beans</artifactId>
|
|
||||||
</dependency>
|
|
||||||
|
|
||||||
<dependency>
|
|
||||||
<groupId>org.slf4j</groupId>
|
|
||||||
<artifactId>slf4j-api</artifactId>
|
|
||||||
</dependency>
|
|
||||||
|
|
||||||
<dependency>
|
|
||||||
<groupId>org.springframework</groupId>
|
|
||||||
<artifactId>spring-webmvc</artifactId>
|
|
||||||
<optional>true</optional>
|
|
||||||
</dependency>
|
|
||||||
|
|
||||||
<dependency>
|
|
||||||
<groupId>org.springframework</groupId>
|
|
||||||
<artifactId>spring-webflux</artifactId>
|
|
||||||
<optional>true</optional>
|
|
||||||
</dependency>
|
|
||||||
|
|
||||||
<dependency>
|
|
||||||
<groupId>org.springframework.boot</groupId>
|
|
||||||
<artifactId>spring-boot-starter-test</artifactId>
|
|
||||||
<scope>test</scope>
|
|
||||||
</dependency>
|
|
||||||
|
|
||||||
<dependency>
|
|
||||||
<groupId>org.mockito</groupId>
|
|
||||||
<artifactId>mockito-inline</artifactId>
|
|
||||||
<scope>test</scope>
|
|
||||||
</dependency>
|
|
||||||
|
|
||||||
</dependencies>
|
|
||||||
|
|
||||||
</project>
|
|
||||||
@ -1,52 +0,0 @@
|
|||||||
/*
|
|
||||||
* Tencent is pleased to support the open source community by making spring-cloud-tencent available.
|
|
||||||
*
|
|
||||||
* Copyright (C) 2021 THL A29 Limited, a Tencent company. All rights reserved.
|
|
||||||
*
|
|
||||||
* Licensed under the BSD 3-Clause License (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* https://opensource.org/licenses/BSD-3-Clause
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software distributed
|
|
||||||
* under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
||||||
* CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
||||||
* specific language governing permissions and limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package com.tencent.cloud.plugin.protection;
|
|
||||||
|
|
||||||
import org.springframework.context.ApplicationContext;
|
|
||||||
import org.springframework.context.ConfigurableApplicationContext;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* ExitUtils.
|
|
||||||
*
|
|
||||||
* @author Shedfree Wu
|
|
||||||
*/
|
|
||||||
public final class ExitUtils {
|
|
||||||
|
|
||||||
private ExitUtils() {
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void exit(ApplicationContext context) {
|
|
||||||
exit(context, 3000);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void exit(ApplicationContext context, int delay) {
|
|
||||||
if (context instanceof ConfigurableApplicationContext) {
|
|
||||||
ConfigurableApplicationContext configurableContext = (ConfigurableApplicationContext) context;
|
|
||||||
configurableContext.close();
|
|
||||||
}
|
|
||||||
|
|
||||||
try {
|
|
||||||
Thread.sleep(delay);
|
|
||||||
}
|
|
||||||
catch (InterruptedException e) {
|
|
||||||
// do nothing
|
|
||||||
}
|
|
||||||
System.exit(0);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,87 +0,0 @@
|
|||||||
/*
|
|
||||||
* Tencent is pleased to support the open source community by making spring-cloud-tencent available.
|
|
||||||
*
|
|
||||||
* Copyright (C) 2021 THL A29 Limited, a Tencent company. All rights reserved.
|
|
||||||
*
|
|
||||||
* Licensed under the BSD 3-Clause License (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* https://opensource.org/licenses/BSD-3-Clause
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software distributed
|
|
||||||
* under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
||||||
* CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
||||||
* specific language governing permissions and limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package com.tencent.cloud.plugin.protection;
|
|
||||||
|
|
||||||
|
|
||||||
import java.util.List;
|
|
||||||
|
|
||||||
import org.slf4j.Logger;
|
|
||||||
import org.slf4j.LoggerFactory;
|
|
||||||
|
|
||||||
import org.springframework.beans.factory.InitializingBean;
|
|
||||||
import org.springframework.beans.factory.annotation.Autowired;
|
|
||||||
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
|
|
||||||
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
|
|
||||||
import org.springframework.context.ApplicationContext;
|
|
||||||
import org.springframework.context.annotation.Configuration;
|
|
||||||
import org.springframework.web.servlet.function.RouterFunction;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* SecurityProtectionAutoConfiguration.
|
|
||||||
*
|
|
||||||
* @author Shedfree Wu
|
|
||||||
*/
|
|
||||||
@Configuration
|
|
||||||
public class SecurityProtectionAutoConfiguration {
|
|
||||||
|
|
||||||
private static final Logger LOGGER = LoggerFactory.getLogger(SecurityProtectionAutoConfiguration.class);
|
|
||||||
|
|
||||||
@Configuration
|
|
||||||
@ConditionalOnProperty(name = "spring.cloud.tencent.security.protection.servlet.enabled", matchIfMissing = true)
|
|
||||||
@ConditionalOnClass(name = {"org.springframework.web.servlet.function.RouterFunction"})
|
|
||||||
static class ServletProtectionConfiguration implements InitializingBean {
|
|
||||||
|
|
||||||
@Autowired(required = false)
|
|
||||||
List<RouterFunction> routerFunctions;
|
|
||||||
|
|
||||||
@Autowired
|
|
||||||
ApplicationContext applicationContext;
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public void afterPropertiesSet() {
|
|
||||||
if (routerFunctions != null && !routerFunctions.isEmpty()) {
|
|
||||||
LOGGER.error("Detected the presence of webmvc RouterFunction-related beans, which may trigger the CVE-2024-38819 vulnerability. The program will soon exit.");
|
|
||||||
LOGGER.error("routerFunctions:{}: ", routerFunctions);
|
|
||||||
|
|
||||||
ExitUtils.exit(applicationContext);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@Configuration
|
|
||||||
@ConditionalOnProperty(name = "spring.cloud.tencent.security.protection.reactive.enabled", matchIfMissing = true)
|
|
||||||
@ConditionalOnClass(name = {"org.springframework.web.reactive.function.server.RouterFunction"})
|
|
||||||
static class ReactiveProtectionConfiguration implements InitializingBean {
|
|
||||||
|
|
||||||
@Autowired(required = false)
|
|
||||||
List<org.springframework.web.reactive.function.server.RouterFunction> routerFunctions;
|
|
||||||
|
|
||||||
@Autowired
|
|
||||||
ApplicationContext applicationContext;
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public void afterPropertiesSet() {
|
|
||||||
if (routerFunctions != null && !routerFunctions.isEmpty()) {
|
|
||||||
LOGGER.error("Detected the presence of webflux RouterFunction-related beans, which may trigger the CVE-2024-38819 vulnerability. The program will soon exit.");
|
|
||||||
LOGGER.error("routerFunctions:{}: ", routerFunctions);
|
|
||||||
ExitUtils.exit(applicationContext);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@ -1 +0,0 @@
|
|||||||
com.tencent.cloud.plugin.protection.SecurityProtectionAutoConfiguration
|
|
||||||
Loading…
Reference in new issue