From e549210ad6c05fd2cf2e199c5c081ce984ca060f Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Fri, 20 Jun 2025 11:56:03 +0800
Subject: [PATCH] 优化定时任务包名白名单匹配方式
---
ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java | 35 ++++++++++++++++++++++-------------
1 files changed, 22 insertions(+), 13 deletions(-)
diff --git a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
index 1b5ec5d..87f2775 100644
--- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
+++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java
@@ -26,6 +26,7 @@
import com.ruoyi.job.domain.SysJob;
import com.ruoyi.job.service.ISysJobService;
import com.ruoyi.job.util.CronUtils;
+import com.ruoyi.job.util.ScheduleUtils;
/**
* 调度任务信息操作处理
@@ -71,7 +72,7 @@
@GetMapping(value = "/{jobId}")
public AjaxResult getInfo(@PathVariable("jobId") Long jobId)
{
- return AjaxResult.success(jobService.selectJobById(jobId));
+ return success(jobService.selectJobById(jobId));
}
/**
@@ -88,19 +89,23 @@
}
else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_RMI))
{
- return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi://'调用");
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi'调用");
}
- else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_LDAP))
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.LOOKUP_LDAP, Constants.LOOKUP_LDAPS }))
{
- return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap://'调用");
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap(s)'调用");
}
else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS }))
{
- return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用");
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)'调用");
}
else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR))
{
return error("新增任务'" + job.getJobName() + "'失败，目标字符串存在违规");
+ }
+ else if (!ScheduleUtils.whiteList(job.getInvokeTarget()))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不在白名单内");
}
job.setCreateBy(SecurityUtils.getUsername());
return toAjax(jobService.insertJob(job));
@@ -120,19 +125,23 @@
}
else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_RMI))
{
- return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi://'调用");
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi'调用");
}
- else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_LDAP))
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.LOOKUP_LDAP, Constants.LOOKUP_LDAPS }))
{
- return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap://'调用");
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap(s)'调用");
}
else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS }))
{
- return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用");
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)'调用");
}
else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR))
{
return error("修改任务'" + job.getJobName() + "'失败，目标字符串存在违规");
+ }
+ else if (!ScheduleUtils.whiteList(job.getInvokeTarget()))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不在白名单内");
}
job.setUpdateBy(SecurityUtils.getUsername());
return toAjax(jobService.updateJob(job));
@@ -159,8 +168,8 @@
@PutMapping("/run")
public AjaxResult run(@RequestBody SysJob job) throws SchedulerException
{
- jobService.run(job);
- return AjaxResult.success();
+ boolean result = jobService.run(job);
+ return result ? success() : error("任务不存在或已过期！");
}
/**
@@ -169,9 +178,9 @@
@RequiresPermissions("monitor:job:remove")
@Log(title = "定时任务", businessType = BusinessType.DELETE)
@DeleteMapping("/{jobIds}")
- public AjaxResult remove(@PathVariable Long[] jobIds) throws SchedulerException, TaskException
+ public AjaxResult remove(@PathVariable Long[] jobIds) throws SchedulerException
{
jobService.deleteJobByIds(jobIds);
- return AjaxResult.success();
+ return success();
}
}
--
Gitblit v1.9.3