From af479c78385fc3ebdfd345ae12a42858b0f79d2e Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Thu, 27 May 2021 21:13:01 +0800
Subject: [PATCH] 修复两处存在SQL注入漏洞问题
---
ruoyi-common/ruoyi-common-datascope/src/main/java/com/ruoyi/common/datascope/aspect/DataScopeAspect.java | 44 ++++++++++++++++++++++++++++++++++----------
1 files changed, 34 insertions(+), 10 deletions(-)
diff --git a/ruoyi-common/ruoyi-common-datascope/src/main/java/com/ruoyi/common/datascope/aspect/DataScopeAspect.java b/ruoyi-common/ruoyi-common-datascope/src/main/java/com/ruoyi/common/datascope/aspect/DataScopeAspect.java
index 8567e0d..453c79c 100644
--- a/ruoyi-common/ruoyi-common-datascope/src/main/java/com/ruoyi/common/datascope/aspect/DataScopeAspect.java
+++ b/ruoyi-common/ruoyi-common-datascope/src/main/java/com/ruoyi/common/datascope/aspect/DataScopeAspect.java
@@ -12,10 +12,10 @@
import com.ruoyi.common.core.utils.StringUtils;
import com.ruoyi.common.core.web.domain.BaseEntity;
import com.ruoyi.common.datascope.annotation.DataScope;
-import com.ruoyi.common.datascope.service.AwaitUserService;
+import com.ruoyi.common.security.service.TokenService;
import com.ruoyi.system.api.domain.SysRole;
import com.ruoyi.system.api.domain.SysUser;
-import com.ruoyi.system.api.model.UserInfo;
+import com.ruoyi.system.api.model.LoginUser;
/**
* 数据过滤处理
@@ -51,8 +51,13 @@
*/
public static final String DATA_SCOPE_SELF = "5";
+ /**
+ * 数据权限过滤关键字
+ */
+ public static final String DATA_SCOPE = "dataScope";
+
@Autowired
- private AwaitUserService awaitUserService;
+ private TokenService tokenService;
// 配置织入点
@Pointcut("@annotation(com.ruoyi.common.datascope.annotation.DataScope)")
@@ -63,6 +68,7 @@
@Before("dataScopePointCut()")
public void doBefore(JoinPoint point) throws Throwable
{
+ clearDataScope(point);
handleDataScope(point);
}
@@ -75,12 +81,12 @@
return;
}
// 获取当前的用户
- UserInfo loginUser = awaitUserService.info();
- SysUser currentUser = loginUser.getSysUser();
- if (currentUser != null)
+ LoginUser loginUser = tokenService.getLoginUser();
+ if (StringUtils.isNotNull(loginUser))
{
+ SysUser currentUser = loginUser.getSysUser();
// 如果是超级管理员，则不过滤数据
- if (!currentUser.isAdmin())
+ if (StringUtils.isNotNull(currentUser) && !currentUser.isAdmin())
{
dataScopeFilter(joinPoint, currentUser, controllerDataScope.deptAlias(),
controllerDataScope.userAlias());
@@ -93,7 +99,8 @@
*
* @param joinPoint 切点
* @param user 用户
- * @param alias 别名
+ * @param deptAlias 部门别名
+ * @param userAlias 用户别名
*/
public static void dataScopeFilter(JoinPoint joinPoint, SysUser user, String deptAlias, String userAlias)
{
@@ -139,8 +146,12 @@
if (StringUtils.isNotBlank(sqlString.toString()))
{
- BaseEntity baseEntity = (BaseEntity) joinPoint.getArgs()[0];
- baseEntity.setDataScope(" AND (" + sqlString.substring(4) + ")");
+ Object params = joinPoint.getArgs()[0];
+ if (StringUtils.isNotNull(params) && params instanceof BaseEntity)
+ {
+ BaseEntity baseEntity = (BaseEntity) params;
+ baseEntity.getParams().put(DATA_SCOPE, " AND (" + sqlString.substring(4) + ")");
+ }
}
}
@@ -159,4 +170,17 @@
}
return null;
}
+
+ /**
+ * 拼接权限sql前先清空params.dataScope参数防止注入
+ */
+ private void clearDataScope(final JoinPoint joinPoint)
+ {
+ Object params = joinPoint.getArgs()[0];
+ if (StringUtils.isNotNull(params) && params instanceof BaseEntity)
+ {
+ BaseEntity baseEntity = (BaseEntity) params;
+ baseEntity.getParams().put(DATA_SCOPE, "");
+ }
+ }
}
--
Gitblit v1.9.3