From 6f3e596a759856f93e80182c627b8b5844eb6c53 Mon Sep 17 00:00:00 2001
From: chenrui <1950717904@qq.com>
Date: Thu, 2 May 2024 21:14:35 +0800
Subject: [PATCH] =?UTF-8?q?=E6=8F=90=E4=BA=A4=E6=BC=8F=E6=B4=9E=E6=89=AB?=
=?UTF-8?q?=E6=8F=8F=E6=96=87=E4=BB=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
.../java/com/zdxt/common/util/PageUtil.java | 4 +-
lib/EmergencyService/pom.xml | 1 +
.../auth/framework/config/CookieFilter.java | 49 +
.../auth/framework/config/CorsFilter.java | 1 +
.../auth/framework/config/CsrfFilter.java | 28 +-
.../auth/framework/config/FilterConfig.java | 46 +-
.../auth/framework/config/HostFilter.java | 83 +
.../auth/framework/config/ShiroConfig.java | 2 +
.../auth/framework/config/TomcatConfig.java | 58 +
.../framework/config/XssAndSqlFilter.java | 79 +
.../XssAndSqlHttpServletRequestWrapper.java | 349 +
.../zdxt/auth/framework/config/XssFilter.java | 2 +-
.../shiro/service/PasswordService.java | 4 +-
.../auth/framework/web/page/PageDomain.java | 3 +-
.../dept/controller/DeptController.java | 2 +-
.../user/controller/ProfileController.java | 8 +-
.../src/main/resources/application.yml | 14 +-
.../ajax/libs/blockUI/jquery.blockUI.min.js | 6 +
.../bootstrap-table/bootstrap-table.min.js | 15 +-
.../src/main/resources/static/js/crypto-js.js | 6060 +----------------
.../main/resources/static/js/crypto-js.min.js | 1 +
.../main/resources/static/js/jquery.min.js | 6 +-
.../src/main/resources/static/ruoyi/index.js | 4 +-
.../resources/static/ruoyi/js/zdxtUtil.js | 6 +-
.../src/main/resources/templates/index.html | 2 +-
.../main/resources/templates/zdxtInclude.html | 2 +-
.../com/zdxt/message/tio/TioServerConfig.java | 2 +-
27 files changed, 727 insertions(+), 6110 deletions(-)
create mode 100644 lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java
create mode 100644 lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java
create mode 100644 lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java
create mode 100644 lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java
create mode 100644 lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlHttpServletRequestWrapper.java
create mode 100644 lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/static/ajax/libs/blockUI/jquery.blockUI.min.js
create mode 100644 lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/static/js/crypto-js.min.js
diff --git a/lib/EmergencyBaseLib/EmergencyCommon/src/main/java/com/zdxt/common/util/PageUtil.java b/lib/EmergencyBaseLib/EmergencyCommon/src/main/java/com/zdxt/common/util/PageUtil.java
index 8e0ee549..aa0d1254 100644
--- a/lib/EmergencyBaseLib/EmergencyCommon/src/main/java/com/zdxt/common/util/PageUtil.java
+++ b/lib/EmergencyBaseLib/EmergencyCommon/src/main/java/com/zdxt/common/util/PageUtil.java
@@ -20,8 +20,8 @@ public class PageUtil {
Integer pageSize = pageDomain.getPageSize();
if (StringUtils.isNotNull(pageNum) && StringUtils.isNotNull(pageSize))
{
- String orderBy = SqlUtil.escapeOrderBySql(pageDomain.getOrderBy());
- PageHelper.startPage(pageNum, pageSize, orderBy);
+// String orderBy = SqlUtil.escapeOrderBySql(pageDomain.getOrderBy());
+ PageHelper.startPage(pageNum, pageSize);
}
}
}
diff --git a/lib/EmergencyService/pom.xml b/lib/EmergencyService/pom.xml
index 5396639c..6e4d6ffd 100644
--- a/lib/EmergencyService/pom.xml
+++ b/lib/EmergencyService/pom.xml
@@ -97,6 +97,7 @@
mysql
mysql-connector-java
+ 8.0.26
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java
new file mode 100644
index 00000000..7944ad39
--- /dev/null
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java
@@ -0,0 +1,49 @@
+package com.zdxt.auth.framework.config;
+
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseCookie;
+import org.springframework.stereotype.Component;
+
+import javax.servlet.*;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+//@Component
+public class CookieFilter implements Filter {
+
+
+ @Override
+ public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+ HttpServletRequest httpRequest = (HttpServletRequest) servletRequest;
+ HttpServletResponse httpResponse = (HttpServletResponse) servletResponse;
+
+ //这里模拟下浏览器发送请求中包含三个cookie,
+ // 因为后端在request中无法添加cookie,咱们就先添加到response中，
+ //第一次请求把三个cookie带到客户端，再请求时浏览器就把这三个cookie带过来了
+// Cookie cookie1 = new Cookie("name","lsl");
+// httpResponse.addCookie(cookie1);
+// Cookie cookie2 = new Cookie("age","18");
+// httpResponse.addCookie(cookie2);
+// Cookie cookie3 = new Cookie("addr","beijing");
+// httpResponse.addCookie(cookie3);
+
+ String url = httpRequest.getRequestURL().toString();
+
+ Cookie[] cookies = httpRequest.getCookies();
+ if (cookies != null){
+ StringBuilder sb = new StringBuilder();
+ for (Cookie cookie : cookies){
+ String cookieName = cookie.getName();
+ String cookieValue = cookie.getValue();
+ System.out.println("url = " + url + ", cookieName = " + cookieName + ", cookieValue = " + cookieValue);
+ ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Lax").build();
+ httpResponse.addHeader(HttpHeaders.SET_COOKIE,lastCookie.toString());
+
+ }
+ }
+
+ filterChain.doFilter(httpRequest,httpResponse);
+ }
+}
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java
index 71ffe663..01fe4fde 100644
--- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java
@@ -22,6 +22,7 @@ public class CorsFilter implements Filter {
res.addHeader("Access-Control-Allow-Credentials", "true");
res.addHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("origin"));
res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
+ res.addHeader("X-Frame-Options", "SAMEORIGIN");
res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN");
if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) {
response.getWriter().println("ok");
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CsrfFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CsrfFilter.java
index 57da4c34..944ce770 100644
--- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CsrfFilter.java
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CsrfFilter.java
@@ -1,6 +1,7 @@
package com.zdxt.auth.framework.config;
import java.io.IOException;
+import java.util.Arrays;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -17,6 +18,7 @@ import javax.servlet.http.HttpServletResponse;
import com.alibaba.fastjson.JSONObject;
import com.zdxt.common.ZDResponse;
+import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Component;
@@ -35,6 +37,9 @@ import lombok.extern.slf4j.Slf4j;
@WebFilter(filterName = "CsrfFilter", urlPatterns = "/*")
public class CsrfFilter implements Filter {
+ @Value("${allowed.servernames}")
+ private String ALLOWED_SERVERNAMES;
+
/**
* 过滤器配置对象
*/
@@ -84,7 +89,7 @@ public class CsrfFilter implements Filter {
String serverName = request.getServerName();
// 判断是否存在外链请求本站
- if (null != referer && referer.indexOf(serverName) < 0) {
+ if (null != referer && ALLOWED_SERVERNAMES.indexOf(serverName) < 0) {
log.error("CSRF过滤器 => 服务器：{} => 当前域名：{}", serverName, referer);
// servletResponse.setContentType("text/html; charset=utf-8");
// servletResponse.getWriter().write(JSONObject.toJSONString(ZDResponse.error("系统不支持当前域名的访问！")));
@@ -119,4 +124,25 @@ public class CsrfFilter implements Filter {
return excludes.stream().map(pattern -> Pattern.compile("^" + pattern)).map(p -> p.matcher(url))
.anyMatch(Matcher::find);
}
+
+ /**
+ * 校验当前host是否在白名单中
+ */
+ private boolean checkBlankList(String serverName) {
+ String[] allowdServerName = ALLOWED_SERVERNAMES.split(",");
+ List serverNameList = Arrays.asList(allowdServerName);
+ for(String str : serverNameList){
+ if(!isEmpty(str) && str.equals(serverName)){
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * 判空
+ */
+ public boolean isEmpty(Object str) {
+ return str == null || "".equals(str);
+ }
}
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java
index 49c6caf6..cdb91325 100644
--- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java
@@ -2,6 +2,8 @@ package com.zdxt.auth.framework.config;
import java.util.Map;
import javax.servlet.DispatcherType;
+
+import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
@@ -29,13 +31,17 @@ public class FilterConfig
@Value("${xss.urlPatterns}")
private String urlPatterns;
+ //http host头攻击漏洞处理过滤器
+ @Autowired
+ HostFilter hostFilter;
+
@SuppressWarnings({ "rawtypes", "unchecked" })
@Bean
public FilterRegistrationBean xssFilterRegistration()
{
FilterRegistrationBean registration = new FilterRegistrationBean();
registration.setDispatcherTypes(DispatcherType.REQUEST);
- registration.setFilter(new XssFilter());
+ registration.setFilter(new XssAndSqlFilter());
registration.addUrlPatterns(StringUtils.split(urlPatterns, ","));
registration.setName("xssFilter");
registration.setOrder(Integer.MAX_VALUE);
@@ -45,20 +51,30 @@ public class FilterConfig
registration.setInitParameters(initParameters);
return registration;
}
-// @Bean
-// public FilterRegistrationBean corsFilter() {
-// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-// CorsConfiguration config = new CorsConfiguration();
-// config.setAllowCredentials(true);
-// config.addAllowedOrigin("http://localhost:9000");
-// config.addAllowedOrigin("null");
-// config.addAllowedHeader("*");
-// config.addAllowedMethod("*");
-// source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
-// FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter());
-// bean.setOrder(0);
-// return bean;
-// }
+ @Bean
+ public FilterRegistrationBean hostfilter() {
+ FilterRegistrationBean registration = new FilterRegistrationBean();
+ registration.setFilter(hostFilter);
+ registration.addUrlPatterns("/*");
+ registration.setName("hostFilter");
+ registration.setOrder(1); // 值越小，Filter越靠前。
+ return registration;
+ }
+ @Bean
+ public FilterRegistrationBean corsNewFilter() {
+ UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+ CorsConfiguration config = new CorsConfiguration();
+ config.setAllowCredentials(true);
+ config.addAllowedOrigin("http://10.132.108.3:85");
+ config.addAllowedOrigin("http://10.132.108.3:80");
+ config.addAllowedOrigin("http://10.132.108.3:81");
+ config.addAllowedHeader("*");
+ config.addAllowedMethod("*");
+ source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
+ FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter());
+ bean.setOrder(0);
+ return bean;
+ }
}
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java
new file mode 100644
index 00000000..83abab85
--- /dev/null
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java
@@ -0,0 +1,83 @@
+package com.zdxt.auth.framework.config;
+
+import org.springframework.beans.factory.annotation.Value;
+
+import org.springframework.stereotype.Component;
+
+import javax.servlet.*;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+
+
+/**
+ * http host头攻击漏洞处理过滤器，
+ * 需要在配置文件添加allowed.servernames可访问host白名单，
+ * 多个host用逗号隔开，本地开发使用127.0.0.1,localhost
+ * @author liufr
+ */
+@Component
+public class HostFilter implements Filter{
+ /**
+ * 自定义实现host白名单添加
+ */
+ @Value("${allowed.servernames}")
+ private String ALLOWED_SERVERNAMES;
+
+ /**
+ * host拦截
+ */
+ @Override
+ public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
+ FilterChain filterChain) throws IOException, ServletException {
+ HttpServletRequest request = (HttpServletRequest) servletRequest;
+ HttpServletResponse response = (HttpServletResponse) servletResponse;
+// String host = request.getHeader("host");
+ String serverName = request.getServerName();
+ System.out.println("serverName-debug:" + serverName);
+ if (!isEmpty(serverName)) {
+ if (checkBlankList(serverName)) {
+ filterChain.doFilter(servletRequest, servletResponse);
+ } else {
+ System.out.println("[serverName deny access tips]->" + serverName);
+// response.getWriter().print("host deny");
+ response.setStatus(403);
+ response.flushBuffer();
+ }
+ } else {
+ filterChain.doFilter(servletRequest, servletResponse);
+ }
+
+ }
+
+ @Override
+ public void destroy() {
+// System.out.println("Filter销毁");
+ }
+
+ /**
+ * 校验当前host是否在白名单中
+ */
+ private boolean checkBlankList(String serverName) {
+ String[] allowdServerName = ALLOWED_SERVERNAMES.split(",");
+ List serverNameList = Arrays.asList(allowdServerName);
+ for(String str : serverNameList){
+ if(!isEmpty(str) && str.equals(serverName)){
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * 判空
+ */
+ public boolean isEmpty(Object str) {
+ return str == null || "".equals(str);
+ }
+
+
+}
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java
index 28c3eb17..17fe8dfc 100644
--- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java
@@ -15,6 +15,7 @@ import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSource
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
+import org.apache.shiro.web.servlet.Cookie;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.crazycake.shiro.RedisCacheManager;
@@ -342,6 +343,7 @@ public class ShiroConfig {
cookie.setDomain(domain);
cookie.setPath(path);
cookie.setHttpOnly(httpOnly);
+ cookie.setSameSite(Cookie.SameSiteOptions.LAX);
cookie.setMaxAge(maxAge * 24 * 60 * 60);
return cookie;
}
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java
new file mode 100644
index 00000000..38a3a5d9
--- /dev/null
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java
@@ -0,0 +1,58 @@
+package com.zdxt.auth.framework.config;
+
+import org.apache.catalina.Context;
+import org.apache.tomcat.util.descriptor.web.SecurityCollection;
+import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
+import org.apache.tomcat.util.http.Rfc6265CookieProcessor;
+import org.apache.tomcat.util.http.SameSiteCookies;
+import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
+import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
+import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class TomcatConfig {
+
+ @Bean
+ public ServletWebServerFactory servletContainer() {
+
+ TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory();
+
+ tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){
+
+ @Override
+ public void customize(Context context) {
+ SecurityConstraint constraint = new SecurityConstraint();
+ SecurityCollection collection = new SecurityCollection();
+ //http方法
+ collection.addMethod("PUT");
+ collection.addMethod("DELETE");
+ collection.addMethod("HEAD");
+ collection.addMethod("OPTIONS");
+ collection.addMethod("TRACE");
+ //url匹配表达式 所有路径
+ collection.addPattern("/*");
+ constraint.addCollection(collection);
+ //设置以上HTTP方法在指定路径下需要身份验证约束
+ constraint.setAuthConstraint(true);
+ context.addConstraint(constraint);
+
+ //设置使用httpOnly
+ context.setUseHttpOnly(true);
+ }
+ });
+ return tomcatServletContainerFactory;
+ }
+ //tomcat配置
+ @Bean
+ public TomcatContextCustomizer sameSiteCookiesConfig() {
+ return context -> {
+ final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();
+ // 设置Cookie的SameSite
+ cookieProcessor.setSameSiteCookies(SameSiteCookies.LAX.getValue());
+ context.setCookieProcessor(cookieProcessor);
+ };
+ }
+}
+
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java
new file mode 100644
index 00000000..29e47bc7
--- /dev/null
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java
@@ -0,0 +1,79 @@
+package com.zdxt.auth.framework.config;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.PrintWriter;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+
+import com.alibaba.fastjson.JSONObject;
+import org.apache.commons.lang3.StringUtils;
+
+public class XssAndSqlFilter implements Filter {
+
+ @Override
+ public void destroy() {
+ // TODO Auto-generated method stub
+
+ }
+
+ @Override
+ public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+ throws IOException, ServletException {
+ String method = "GET";
+ String param = "";
+ XssAndSqlHttpServletRequestWrapper xssRequest = null;
+ if (request instanceof HttpServletRequest) {
+ method = ((HttpServletRequest) request).getMethod();
+ xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);
+ }
+ if ("POST".equalsIgnoreCase(method)) {
+ param = this.getBodyString(xssRequest.getReader());
+ if(StringUtils.isNotBlank(param)){
+ if(xssRequest.checkXSSAndSql(param)){
+ response.setCharacterEncoding("UTF-8");
+ response.setContentType("application/json;charset=UTF-8");
+ PrintWriter out = response.getWriter();
+ out.write(JSONObject.toJSONString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));
+ return;
+ }
+ }
+ }
+ if (xssRequest.checkParameter()) {
+ response.setCharacterEncoding("UTF-8");
+ response.setContentType("application/json;charset=UTF-8");
+ PrintWriter out = response.getWriter();
+ out.write(JSONObject.toJSONString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));
+ return;
+ }
+ chain.doFilter(xssRequest, response);
+ }
+
+ @Override
+ public void init(FilterConfig arg0) throws ServletException {
+ // TODO Auto-generated method stub
+
+ }
+
+ // 获取request请求body中参数
+ public static String getBodyString(BufferedReader br) {
+ String inputLine;
+ String str = "";
+ try {
+ while ((inputLine = br.readLine()) != null) {
+ str += inputLine;
+ }
+ br.close();
+ } catch (IOException e) {
+ System.out.println("IOException: " + e);
+ }
+ return str;
+
+ }
+}
+
diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlHttpServletRequestWrapper.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlHttpServletRequestWrapper.java
new file mode 100644
index 00000000..cf663161
--- /dev/null
+++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlHttpServletRequestWrapper.java
@@ -0,0 +1,349 @@
+package com.zdxt.auth.framework.config;
+
+import java.io.BufferedReader;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.Vector;
+import java.util.regex.Pattern;
+
+import javax.servlet.ReadListener;
+import javax.servlet.ServletInputStream;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+
+import org.springframework.util.StreamUtils;
+
+
+public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {
+
+ HttpServletRequest orgRequest = null;
+ private Map parameterMap;
+ private final byte[] body; //用于保存读取body中数据
+
+ public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{
+ super(request);
+ orgRequest = request;
+ parameterMap = request.getParameterMap();
+ body = StreamUtils.copyToByteArray(request.getInputStream());
+ }
+
+ // 重写几个HttpServletRequestWrapper中的方法
+ /**
+ * 获取所有参数名
+ *
+ * @return 返回所有参数名
+ */
+ @Override
+ public Enumeration getParameterNames() {
+ Vector vector = new Vector(parameterMap.keySet());
+ return vector.elements();
+ }
+
+ /**
+ * 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。
+ * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取
+ * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
+ */
+ @Override
+ public String getParameter(String name) {
+ String[] results = parameterMap.get(name);
+ if (results == null || results.length <= 0)
+ return null;
+ else {
+ String value = results[0];
+ if (value != null) {
+ value = xssEncode(value);
+ }
+ return value;
+ }
+ }
+
+ /**
+ * 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型
+ */
+ @Override
+ public String[] getParameterValues(String name) {
+ String[] results = parameterMap.get(name);
+ if (results == null || results.length <= 0)
+ return null;
+ else {
+ int length = results.length;
+ for (int i = 0; i < length; i++) {
+ results[i] = xssEncode(results[i]);
+ }
+ return results;
+ }
+ }
+
+ /**
+ * 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。
+ * 如果需要获得原始的值，则通过super.getHeaders(name)来获取
+ * getHeaderNames 也可能需要覆盖
+ */
+ @Override
+ public String getHeader(String name) {
+
+ String value = super.getHeader(xssEncode(name));
+ if (value != null) {
+ value = xssEncode(value);
+ }
+ return value;
+ }
+
+ /**
+ * 将容易引起xss & sql漏洞的半角字符直接替换成全角字符
+ *
+ * @param s
+ * @return
+ */
+ private static String xssEncode(String s) {
+ if (s == null || s.isEmpty()) {
+ return s;
+ } else {
+ s = stripXSSAndSql(s);
+ }
+ StringBuilder sb = new StringBuilder(s.length() + 16);
+ for (int i = 0; i < s.length(); i++) {
+ char c = s.charAt(i);
+ switch (c) {
+ case '>':
+ sb.append("＞");// 转义大于号
+ break;
+ case '<':
+ sb.append("＜");// 转义小于号
+ break;
+ // case '\'':
+ // sb.append("＇");// 转义单引号
+ // break;
+ // case '\"':
+ // sb.append("＂");// 转义双引号
+ // break;
+ case '&':
+ sb.append("＆");// 转义&
+ break;
+ case '#':
+ sb.append("＃");// 转义#
+ break;
+ default:
+ sb.append(c);
+ break;
+ }
+ }
+ return sb.toString();
+ }
+
+ /**
+ * 获取最原始的request
+ *
+ * @return
+ */
+ public HttpServletRequest getOrgRequest() {
+ return orgRequest;
+ }
+
+ /**
+ * 获取最原始的request的静态方法
+ *
+ * @return
+ */
+ public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
+ if (req instanceof XssAndSqlHttpServletRequestWrapper) {
+ return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();
+ }
+ return req;
+ }
+
+ /**
+ *
+ * 防止xss跨脚本攻击（替换，根据实际情况调整）
+ */
+
+ public static String stripXSSAndSql(String value) {
+ if (value != null) {
+ // NOTE: It's highly recommended to use the ESAPI library and
+ // uncomment the following line to
+ // avoid encoded attacks.
+ // value = ESAPI.encoder().canonicalize(value);
+ // Avoid null characters
+ /** value = value.replaceAll("", ""); ***/
+ // Avoid anything between script tags
+ Pattern scriptPattern = Pattern.compile(
+ "<[\r\n| | ]*script[\r\n| | ]*>(.*?)", Pattern.CASE_INSENSITIVE);
+ value = scriptPattern.matcher(value).replaceAll("");
+ // Avoid anything in a
+ // src="http://www.yihaomen.com/article/java/..." type of
+ // e-xpression
+ scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",
+ Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
+ value = scriptPattern.matcher(value).replaceAll("");
+ // Remove any lonesome tag
+ scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);
+ value = scriptPattern.matcher(value).replaceAll("");
+ // Remove any lonesome tag
+ scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);
+ flag = scriptPattern.matcher(value).find();
+ if (flag) {
+ return flag;
+ }
+ // Remove any lonesome
-
+
diff --git a/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/zdxtInclude.html b/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/zdxtInclude.html
index 68b5309b..3c2e378e 100644
--- a/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/zdxtInclude.html
+++ b/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/zdxtInclude.html
@@ -20,7 +20,7 @@
-
+
diff --git a/lib/EmergencyService/zdxtEmergencyMessageService/src/main/java/com/zdxt/message/tio/TioServerConfig.java b/lib/EmergencyService/zdxtEmergencyMessageService/src/main/java/com/zdxt/message/tio/TioServerConfig.java
index cb00398b..8188a788 100644
--- a/lib/EmergencyService/zdxtEmergencyMessageService/src/main/java/com/zdxt/message/tio/TioServerConfig.java
+++ b/lib/EmergencyService/zdxtEmergencyMessageService/src/main/java/com/zdxt/message/tio/TioServerConfig.java
@@ -23,7 +23,7 @@ public abstract class TioServerConfig {
/**
* 监听端口
*/
- public static final int SERVER_PORT = 9326;
+ public static final int SERVER_PORT = 9327;
/**
* 心跳超时时间，单位：毫秒