From ab29205a32d8ec0c20834c73db0db4e581726cf1 Mon Sep 17 00:00:00 2001 From: JyuHsin <729757837@qq.com> Date: Fri, 22 May 2026 14:16:41 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=94=B9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../platform/sys/SysLoginController.java | 1 + .../web/commons/proc/NutShiroProcessor.java | 4 +- .../commons/proc/XssSqlFilterProcessor.java | 123 +++++++----------- .../zhgh/mobile/mobileLoginController.java | 10 +- src/main/resources/views/mobile/home.html | 15 ++- .../views/platform/sys/home/quickEntry.js | 8 ++ 6 files changed, 74 insertions(+), 87 deletions(-) diff --git a/src/main/java/io/v/nutz/sys/controllers/platform/sys/SysLoginController.java b/src/main/java/io/v/nutz/sys/controllers/platform/sys/SysLoginController.java index 3cca9b9..d957ee2 100644 --- a/src/main/java/io/v/nutz/sys/controllers/platform/sys/SysLoginController.java +++ b/src/main/java/io/v/nutz/sys/controllers/platform/sys/SysLoginController.java @@ -83,6 +83,7 @@ public class SysLoginController { @Ok("re") @Filters public String login(HttpServletRequest req, HttpSession session) { +// return ""; return "beetl:/platform/sys/login.html"; } diff --git a/src/main/java/io/v/nutz/web/commons/proc/NutShiroProcessor.java b/src/main/java/io/v/nutz/web/commons/proc/NutShiroProcessor.java index 2eaac3e..8f902a3 100644 --- a/src/main/java/io/v/nutz/web/commons/proc/NutShiroProcessor.java +++ b/src/main/java/io/v/nutz/web/commons/proc/NutShiroProcessor.java @@ -68,11 +68,11 @@ public class NutShiroProcessor extends AbstractProcessor { //不需要认证授权的url String[] authIgnoreUrlArr = Lang.array("/", "/sso/login", - "/platform/login", +// "/platform/login", "/platform/login(/doLogin|/logout|/captcha)", "/platform/qywechat/.*", "/platform/home/(500|403|404|UnknownAccountError|LockedAccountError)", - "/mobile/login", +// "/mobile/login", "/mobile/login/doLogin", "/platform/jsz/login", "/platform/activity/basic/scope/getScopeUser", diff --git a/src/main/java/io/v/nutz/web/commons/proc/XssSqlFilterProcessor.java b/src/main/java/io/v/nutz/web/commons/proc/XssSqlFilterProcessor.java index d8780e2..7f71173 100644 --- a/src/main/java/io/v/nutz/web/commons/proc/XssSqlFilterProcessor.java +++ b/src/main/java/io/v/nutz/web/commons/proc/XssSqlFilterProcessor.java @@ -19,10 +19,11 @@ import javax.servlet.http.HttpServletRequest; import java.util.Arrays; import java.util.Iterator; import java.util.List; +import java.util.regex.Pattern; /** - * SQL XSS拦截 - * Created by wizzer on 2016/7/1. + * SQL XSS拦截 终极最终版（强制拦截ORDER BY注入 *号） + * 拦截所有3个PDF漏洞：time注入、pageOrderName注入、applyTime*注入 */ public class XssSqlFilterProcessor extends AbstractProcessor { @@ -31,16 +32,21 @@ public class XssSqlFilterProcessor extends AbstractProcessor { private PropertiesProxy conf; private List ignoreList; - private final static String regxpForHtml = "<([^>]*)>"; // 过滤所有以<开头以>结尾的标签 + // ====================== 终极正则：强制拦截 * 号 ====================== + private static final Pattern SQL_PATTERN = Pattern.compile( + "([\\'\\\"\\;\\*\\\\]+)|(--+)|(\\b(and|or|union|select|delete|insert|exec|execute|drop|count)\\b)|(&&)|(\\|\\|)", + Pattern.CASE_INSENSITIVE + ); - private final static String regxpForImgTag = "<\\s*img\\s+([^>]*)\\s*>"; // 找出IMG标签 - - private final static String regxpForImaTagSrcAttrib = "src=\"([^\"]+)\""; // 找出IMG标签的SRC属性 + private static final Pattern XSS_PATTERN = Pattern.compile( + "( values = req.getParameterMap().values().iterator();// 获取所有的表单参数 - Iterator values2 = req.getParameterMap().values().iterator();// 因为是游标所以要重新获取 boolean isError = false; - //use remove -|, - String regEx_sql = """ - and|exec|execute|insert|select|delete|update|count|drop|*|%|chr|mid|master|truncate| - char|declare|sitename|net user|xp_cmdshell|or|+|like'|and|exec|execute|insert|create|drop| - table|from|grant|group_concat|column_name| - information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*| - chr|mid|master|truncate|char|declare|or|--|+|like|//|/|%|# - """; - regEx_sql = "select|update|and|or|delete|insert|trancate|char|chr|into|substr|ascii|declare|exec|count|master|drop|execute"; + Iterator values = req.getParameterMap().values().iterator(); - String regEx_xss = "script|iframe|img"; - //SQL过滤 - while (values.hasNext()) { - String[] valueArray = (String[]) values.next(); - for (int i = 0; i < valueArray.length; i++) { - String value = valueArray[i].toLowerCase(); + while (values.hasNext() && !isError) { + String[] valueArray = values.next(); + for (String value : valueArray) { + if (Strings.isBlank(value)) continue; + if (value.startsWith("data:image/")) continue; + if (value.startsWith("{") || value.startsWith("[")) continue; + if (value.matches(".*\\.(png|jpg|jpeg|gif|bmp|svg|ico|pdf|xls|xlsx|doc|docx)$")) continue; + // 普通日期：2026-02-21 / 2026/02/21 / 2026-02-21 05:59:43 + if (value.matches("\\d{4}(-|\\/)\\d{1,2}(-|\\/)\\d{1,2}(\\s\\d{1,2}:\\d{1,2}:\\d{1,2})?")) continue; - //排除掉base64 - if (value.startsWith("data:image/png;base64,")) { + // ISO时间：2026-02-21T05:59:43.167Z + if (value.matches("\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,3})?Z?")) continue; + if (value.startsWith("#")) continue; + if (value.matches("-?\\d+")) continue; + if (value.startsWith("ST-")) continue; + + // ====================== 强制拦截 * 号 ====================== + if (value.contains("*")) { + log.errorf("[SQL拦截*号] %s %s 参数=%s", req.getMethod(), req.getRequestURI(), value); + isError = true; + break; + } + Pattern SQL_PATTERN2 = Pattern.compile( + "([\\'\\\"\\;\\*\\\\]+)|(--+)|(\\b(and|or|union|select|delete|insert|exec|execute|drop|count)\\b)|(&&)|(\\|\\|)", + Pattern.CASE_INSENSITIVE + ); + if (SQL_PATTERN2.matcher(value).find()) { + log.errorf("[SQL拦截] %s %s 参数=%s", req.getMethod(), req.getRequestURI(), value); + isError = true; break; } - //分拆关键字 - String[] inj_stra = StringUtils.split(regEx_sql, "\\|"); - for (int j = 0; j < inj_stra.length; j++) { - // 判断如果路径参数值中含有关键字则返回true,并且结束循环 - if (value.contains(inj_stra[j] + " ") || value.contains(" " + inj_stra[j] + " ") || value.contains(" " + inj_stra[j])) { -// if (value.contains(inj_stra[j])) { - isError = true; - log.debugf("[%-4s]URI=%s %s", req.getMethod(), req.getRequestURI(), "SQL关键字过滤:" + value); - break; - } - } - if (isError) { - break; - } - } - if (isError) { - break; - } - } - if (!isError) { - // XSS漏洞过滤 - while (values2.hasNext()) { - String[] valueArray = (String[]) values2.next(); - for (int i = 0; i < valueArray.length; i++) { - String value = valueArray[i].toLowerCase(); - - value = HtmlUtil.escape(value); - - if (value.trim().startsWith("<") || value.trim().endsWith(">") || - value.trim().endsWith("/")) { - log.debugf("[%-4s]URI=%s %s", req.getMethod(), req.getRequestURI(), "XSS关键字过滤(已被我转义):" + value); - } - - // 分拆关键字 - String[] inj_stra = StringUtils.split(regEx_xss, "|"); - for (int j = 0; j < inj_stra.length; j++) { - // 判断如果路径参数值中含有关键字则返回true,并且结束循环 - if (value.contains("<" + inj_stra[j] + ">") - || value.contains("<" + inj_stra[j]) - || value.contains(inj_stra[j] + ">")) { - log.debugf("[%-4s]URI=%s %s", req.getMethod(), req.getRequestURI(), "XSS关键字过滤:" + value); - isError = true; - break; - } - } - if (isError) { - break; - } - } - if (isError) { + if (XSS_PATTERN.matcher(value).find()) { + log.errorf("[XSS拦截] %s %s 参数=%s", req.getMethod(), req.getRequestURI(), value); + isError = true; break; } } } return isError; } -} +} \ No newline at end of file diff --git a/src/main/java/io/v/nutz/zhgh/mobile/mobileLoginController.java b/src/main/java/io/v/nutz/zhgh/mobile/mobileLoginController.java index b87763b..81104a5 100644 --- a/src/main/java/io/v/nutz/zhgh/mobile/mobileLoginController.java +++ b/src/main/java/io/v/nutz/zhgh/mobile/mobileLoginController.java @@ -31,11 +31,11 @@ public class mobileLoginController { /** * 登录页 */ - @At("") - @Ok("beetl:/mobile/login.html") - public void index() { - - } +// @At("") +// @Ok("beetl:/mobile/login.html") +// public void index() { +// +// } /** * 首页 diff --git a/src/main/resources/views/mobile/home.html b/src/main/resources/views/mobile/home.html index 658e39b..2987822 100644 --- a/src/main/resources/views/mobile/home.html +++ b/src/main/resources/views/mobile/home.html @@ -201,6 +201,10 @@ layout("/mobile/platform.html"){ {{item.moduleName}} +
+ + 阅读打卡 +
@@ -224,10 +228,12 @@ layout("/mobile/platform.html"){ - +
@@ -583,9 +589,12 @@ layout("/mobile/platform.html"){ pjaxReplace(menu) } }, + ydClick() { + window.location.href = "https://api.hd.chaoxing.com/activity/4204275/preview" + }, tabbrChange(o) { console.log(o) - sessionStorage.setItem("zhgh-mobile-home-active",o) + sessionStorage.setItem("zhgh-mobile-home-active", o) this.needItems = [] this.initData() }, diff --git a/src/main/resources/views/platform/sys/home/quickEntry.js b/src/main/resources/views/platform/sys/home/quickEntry.js index c3f1b6f..bae28d5 100644 --- a/src/main/resources/views/platform/sys/home/quickEntry.js +++ b/src/main/resources/views/platform/sys/home/quickEntry.js @@ -4,6 +4,14 @@ const quickEntry = {
快速入口
+
+ +
+ +
+ + 阅读打卡 +