From ad954dacb7ced3509e5985e3e9a04cfccc348ae7 Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Thu, 06 Jul 2023 22:29:09 +0800
Subject: [PATCH] 屏蔽定时任务bean违规的字符
---
ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java | 92 +++++++++++++++++++++++++++++++++------------
1 files changed, 67 insertions(+), 25 deletions(-)
diff --git a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
index feae666..1f09787 100644
--- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
+++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
@@ -1,11 +1,9 @@
package com.ruoyi.job.controller;
-import java.io.IOException;
import java.util.List;
import javax.servlet.http.HttpServletResponse;
import org.quartz.SchedulerException;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
@@ -14,17 +12,21 @@
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
+import com.ruoyi.common.core.constant.Constants;
import com.ruoyi.common.core.exception.job.TaskException;
+import com.ruoyi.common.core.utils.StringUtils;
import com.ruoyi.common.core.utils.poi.ExcelUtil;
import com.ruoyi.common.core.web.controller.BaseController;
import com.ruoyi.common.core.web.domain.AjaxResult;
import com.ruoyi.common.core.web.page.TableDataInfo;
import com.ruoyi.common.log.annotation.Log;
import com.ruoyi.common.log.enums.BusinessType;
+import com.ruoyi.common.security.annotation.RequiresPermissions;
import com.ruoyi.common.security.utils.SecurityUtils;
import com.ruoyi.job.domain.SysJob;
import com.ruoyi.job.service.ISysJobService;
import com.ruoyi.job.util.CronUtils;
+import com.ruoyi.job.util.ScheduleUtils;
/**
* 调度任务信息操作处理
@@ -41,7 +43,7 @@
/**
* 查询定时任务列表
*/
- @PreAuthorize("@ss.hasPermi('monitor:job:list')")
+ @RequiresPermissions("monitor:job:list")
@GetMapping("/list")
public TableDataInfo list(SysJob sysJob)
{
@@ -53,10 +55,10 @@
/**
* 导出定时任务列表
*/
- @PreAuthorize("@ss.hasPermi('monitor:job:export')")
+ @RequiresPermissions("monitor:job:export")
@Log(title = "定时任务", businessType = BusinessType.EXPORT)
@PostMapping("/export")
- public void export(HttpServletResponse response, SysJob sysJob) throws IOException
+ public void export(HttpServletResponse response, SysJob sysJob)
{
List<SysJob> list = jobService.selectJobList(sysJob);
ExcelUtil<SysJob> util = new ExcelUtil<SysJob>(SysJob.class);
@@ -66,49 +68,89 @@
/**
* 获取定时任务详细信息
*/
- @PreAuthorize("@ss.hasPermi('monitor:job:query')")
+ @RequiresPermissions("monitor:job:query")
@GetMapping(value = "/{jobId}")
public AjaxResult getInfo(@PathVariable("jobId") Long jobId)
{
- return AjaxResult.success(jobService.selectJobById(jobId));
+ return success(jobService.selectJobById(jobId));
}
/**
* 新增定时任务
*/
- @PreAuthorize("@ss.hasPermi('monitor:job:add')")
+ @RequiresPermissions("monitor:job:add")
@Log(title = "定时任务", businessType = BusinessType.INSERT)
@PostMapping
- public AjaxResult add(@RequestBody SysJob sysJob) throws SchedulerException, TaskException
+ public AjaxResult add(@RequestBody SysJob job) throws SchedulerException, TaskException
{
- if (!CronUtils.isValid(sysJob.getCronExpression()))
+ if (!CronUtils.isValid(job.getCronExpression()))
{
- return AjaxResult.error("cron表达式不正确");
+ return error("新增任务'" + job.getJobName() + "'失败，Cron表达式不正确");
}
- sysJob.setCreateBy(SecurityUtils.getUsername());
- return toAjax(jobService.insertJob(sysJob));
+ else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_RMI))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.LOOKUP_LDAP, Constants.LOOKUP_LDAPS }))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap(s)'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS }))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串存在违规");
+ }
+ else if (!ScheduleUtils.whiteList(job.getInvokeTarget()))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不在白名单内");
+ }
+ job.setCreateBy(SecurityUtils.getUsername());
+ return toAjax(jobService.insertJob(job));
}
/**
* 修改定时任务
*/
- @PreAuthorize("@ss.hasPermi('monitor:job:edit')")
+ @RequiresPermissions("monitor:job:edit")
@Log(title = "定时任务", businessType = BusinessType.UPDATE)
@PutMapping
- public AjaxResult edit(@RequestBody SysJob sysJob) throws SchedulerException, TaskException
+ public AjaxResult edit(@RequestBody SysJob job) throws SchedulerException, TaskException
{
- if (!CronUtils.isValid(sysJob.getCronExpression()))
+ if (!CronUtils.isValid(job.getCronExpression()))
{
- return AjaxResult.error("cron表达式不正确");
+ return error("修改任务'" + job.getJobName() + "'失败，Cron表达式不正确");
}
- sysJob.setUpdateBy(SecurityUtils.getUsername());
- return toAjax(jobService.updateJob(sysJob));
+ else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_RMI))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.LOOKUP_LDAP, Constants.LOOKUP_LDAPS }))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap(s)'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS }))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串存在违规");
+ }
+ else if (!ScheduleUtils.whiteList(job.getInvokeTarget()))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不在白名单内");
+ }
+ job.setUpdateBy(SecurityUtils.getUsername());
+ return toAjax(jobService.updateJob(job));
}
/**
* 定时任务状态修改
*/
- @PreAuthorize("@ss.hasPermi('monitor:job:changeStatus')")
+ @RequiresPermissions("monitor:job:changeStatus")
@Log(title = "定时任务", businessType = BusinessType.UPDATE)
@PutMapping("/changeStatus")
public AjaxResult changeStatus(@RequestBody SysJob job) throws SchedulerException
@@ -121,24 +163,24 @@
/**
* 定时任务立即执行一次
*/
- @PreAuthorize("@ss.hasPermi('monitor:job:changeStatus')")
+ @RequiresPermissions("monitor:job:changeStatus")
@Log(title = "定时任务", businessType = BusinessType.UPDATE)
@PutMapping("/run")
public AjaxResult run(@RequestBody SysJob job) throws SchedulerException
{
- jobService.run(job);
- return AjaxResult.success();
+ boolean result = jobService.run(job);
+ return result ? success() : error("任务不存在或已过期！");
}
/**
* 删除定时任务
*/
- @PreAuthorize("@ss.hasPermi('monitor:job:remove')")
+ @RequiresPermissions("monitor:job:remove")
@Log(title = "定时任务", businessType = BusinessType.DELETE)
@DeleteMapping("/{jobIds}")
public AjaxResult remove(@PathVariable Long[] jobIds) throws SchedulerException, TaskException
{
jobService.deleteJobByIds(jobIds);
- return AjaxResult.success();
+ return success();
}
}
--
Gitblit v1.9.3