Ludc
4 小时以前 9bb1ee8d456d1a6c1149963eeb9c8285844466ef
文件后缀校验逻辑修改
已修改7个文件
65 ■■■■■ 文件已修改
Source/UBCS/ubcs-common/src/main/java/com/vci/ubcs/common/constant/CommonConstant.java 1 ●●●● 补丁 | 查看 | 原始文档 | blame | 历史
Source/UBCS/ubcs-common/src/main/java/com/vci/ubcs/common/constant/LauncherConstant.java 12 ●●●● 补丁 | 查看 | 原始文档 | blame | 历史
Source/UBCS/ubcs-common/src/main/java/com/vci/ubcs/common/validator/ComprehensiveFileValidator.java 16 ●●●●● 补丁 | 查看 | 原始文档 | blame | 历史
Source/UBCS/ubcs-service/ubcs-code/src/main/java/com/vci/ubcs/code/controller/CodeClassifyValueController.java 2 ●●● 补丁 | 查看 | 原始文档 | blame | 历史
Source/UBCS/ubcs-service/ubcs-code/src/main/java/com/vci/ubcs/code/service/impl/MdmProductCodeServiceImpl.java 10 ●●●●● 补丁 | 查看 | 原始文档 | blame | 历史
Source/UBCS/ubcs-service/ubcs-code/src/main/java/com/vci/ubcs/code/service/impl/UniversalInterfaceImpl.java 16 ●●●●● 补丁 | 查看 | 原始文档 | blame | 历史
Source/UBCS/ubcs-service/ubcs-deploy/src/main/java/com/vci/ubcs/deploy/service/impl/DeployAppsServiceImpl.java 8 ●●●● 补丁 | 查看 | 原始文档 | blame | 历史
Source/UBCS/ubcs-common/src/main/java/com/vci/ubcs/common/constant/CommonConstant.java
@@ -93,5 +93,4 @@
     */
    Integer API_SCOPE_CATEGORY = 2;
}
Source/UBCS/ubcs-common/src/main/java/com/vci/ubcs/common/constant/LauncherConstant.java
@@ -40,20 +40,20 @@
    /**
     * nacos dev 地址
     */
    String NACOS_DEV_ADDR = "dev.vci-tech.com:38848";
    //String NACOS_DEV_ADDR = "127.0.0.1:8848";
    //String NACOS_DEV_ADDR = "dev.vci-tech.com:38848";
    String NACOS_DEV_ADDR = "127.0.0.1:8848";
    /**
     * nacos prod 地址
     */
    String NACOS_PROD_ADDR = "dev.vci-tech.com:38848";
    //String NACOS_PROD_ADDR = "127.0.0.1:8848";
    //String NACOS_PROD_ADDR = "dev.vci-tech.com:38848";
    String NACOS_PROD_ADDR = "127.0.0.1:8848";
    /**
     * nacos test 地址
     */
    String NACOS_TEST_ADDR = "dev.vci-tech.com:38848";
    //String NACOS_TEST_ADDR = "127.0.0.1:8848";
    //String NACOS_TEST_ADDR = "dev.vci-tech.com:38848";
    String NACOS_TEST_ADDR = "127.0.0.1:8848";
    /**
     * sentinel dev 地址
Source/UBCS/ubcs-common/src/main/java/com/vci/ubcs/common/validator/ComprehensiveFileValidator.java
@@ -21,7 +21,7 @@
    /**
     * 文件白名单
     */
    @Value("${app.upload.security.allowed-extensions:jpg,jpeg,png,pdf}")
    @Value("${app.upload.security.allowed-extensions:xls,xlsx,jar,doc,docx,jpg,jpeg,png,pdf}")
    private String allowedExtensionsConfig;
    /**
@@ -274,9 +274,13 @@
    private boolean contentSecurityValidation(MultipartFile file, UploadValidationResult result) {
        // 内容类型验证
        if (validateContentType && !validateContentType(file)) {
            result.setMessage("文件内容类型不匹配");
            return false;
        if (validateContentType) { //配置了校验位true
            //后缀不在白名单中,并且文件内容与类型不匹配直接返回
            String finalExtension = getFinalExtension(file.getOriginalFilename().toLowerCase());
            if(!allowedExtensions.contains(finalExtension) && !validateContentType(file)){
                result.setMessage("文件内容类型不匹配[后缀:"+finalExtension+";ContentType:"+file.getContentType()+"]");
                return false;
            }
        }
        // 文件头验证
@@ -313,9 +317,11 @@
            if (declaredType == null) {
                return true; // 没有声明类型,放过
            }
            log.info("===========================ContentType: " + declaredType);
            // 简单的类型匹配检查
            String finalExtension = getFinalExtension(file.getOriginalFilename()).toLowerCase();
            log.info("===========================finalExtension: " + finalExtension);
            return isContentTypeConsistent(declaredType, finalExtension);
        } catch (Exception e) {
            log.error("内容类型验证失败", e);
Source/UBCS/ubcs-service/ubcs-code/src/main/java/com/vci/ubcs/code/controller/CodeClassifyValueController.java
@@ -43,7 +43,7 @@
     */
    @GetMapping("/treeCodeClassifyValue")
    public List<Tree> treeCodeClassifyValue(TreeQueryObject treeQueryObject)  {
        return  codeClassifyValueService.treeCodeClassifyValue(treeQueryObject);
        return codeClassifyValueService.treeCodeClassifyValue(treeQueryObject);
    }
    /**
Source/UBCS/ubcs-service/ubcs-code/src/main/java/com/vci/ubcs/code/service/impl/MdmProductCodeServiceImpl.java
@@ -1,13 +1,12 @@
package com.vci.ubcs.code.service.impl;
import com.alibaba.fastjson.JSON;
import com.alibaba.nacos.common.utils.StringUtils;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.vci.ubcs.code.algorithm.CustomSerialEnum;
import com.vci.ubcs.code.annotation.MdmSerialAlgorithm;
import com.vci.ubcs.code.annotation.MdmSerialAlgorithmMethod;
import com.vci.ubcs.code.dto.CodeCustomSerialDTO;
import com.alibaba.nacos.common.utils.StringUtils;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.vci.ubcs.code.bo.CodeClassifyFullInfoBO;
import com.vci.ubcs.code.dto.CodeCustomSerialDTO;
import com.vci.ubcs.code.dto.CodeOrderSecDTO;
import com.vci.ubcs.code.entity.CodeAllCode;
import com.vci.ubcs.code.entity.CodeClassifyValue;
@@ -41,7 +40,6 @@
import org.springblade.core.secure.BladeUser;
import org.springblade.core.secure.utils.AuthUtil;
import org.springblade.core.tool.utils.Func;
import org.springblade.core.tool.utils.WebUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Lazy;
import org.springframework.stereotype.Service;
@@ -49,10 +47,8 @@
import org.springframework.util.CollectionUtils;
import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import java.lang.reflect.Method;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.CopyOnWriteArrayList;
import java.util.concurrent.atomic.AtomicInteger;
import java.util.concurrent.atomic.AtomicReference;
Source/UBCS/ubcs-service/ubcs-code/src/main/java/com/vci/ubcs/code/service/impl/UniversalInterfaceImpl.java
@@ -250,7 +250,7 @@
        return request;
    }
    /***
    /**
     * 申请编码接口
     * @param data 传递的数据参数
     * @param dataType 标识data是xml格式还是json格式,接口返回数据也是按照这个格式,以下接口类同
@@ -1494,7 +1494,7 @@
                            errorid ="101";
                            throw new Throwable("系统标识为【"+ systemId +"】,集成分类为【"+currentCodeClassify[0].getName()+"】以上分类,"+sysIntegrationPushTypeEnum.ACCPET_QUERYDATA.getText()+"接口配置已停用或者未配置,请联系编码管理员!");
                        }
                        isCodeOrGroupCode="true".equals(dockingSystemConfig.getIsGroupCodeFlag())?true:false;
                        isCodeOrGroupCode = "true".equals(dockingSystemConfig.getIsGroupCodeFlag());
                    }
                    List<CodeClassifyVO> dataCodeClassifyVOList =new ArrayList<>();
                    String oid= currentCodeClassify[0].getOid();
@@ -2461,24 +2461,26 @@
                    CodeOrderSecDTO.setSecOid(codeBasicSecVO.getOid());
                    String sectypeValue = sectionVOMap.get(name);
                    log.info("码段值:"+sectypeValue);
                //  CodeSecTypeEnum secType = CodeSecTypeEnum.forValue(sectype);
                    // CodeSecTypeEnum secType = CodeSecTypeEnum.forValue(sectype);
                    if(CODE_CLASSIFY_SEC.getValue().equals(sectype)) {//如果是分类的话,则需要匹配传过来的分类代号与
                        //先简称是否有关联模板,有模板要先删除
                        List<CodeClassifyValue> codeClassifyValueDOList = codeClassifyValueService.list(Wrappers.<CodeClassifyValue>query().lambda().eq(CodeClassifyValue::getCodeClassifySecOid,classifySecOid));
                        if (!CollectionUtils.isEmpty(codeClassifyValueDOList)) {
                            Map<String, CodeClassifyValue> codeClassifyValueDOMap = codeClassifyValueDOList.stream().collect(Collectors.toMap(s -> s.getId(), t -> t, (o1, o2) -> o2));
                            if(codeClassifyValueDOMap.containsKey(sectypeValue) || nullSymbol.equals(sectypeValue)){
                            if(codeClassifyValueDOMap.containsKey(sectypeValue)){
                                CodeClassifyValue codeClassifyValue = codeClassifyValueDOMap.get(sectypeValue);
                                sectypeValue=codeClassifyValue.getOid();
                            }else {
                                //throw new Throwable("传入的分类码段:【" + name + " 值:" + sectypeValue + "】,不符合当前分类层级代号");
                            }else if (nullSymbol.equals(sectypeValue)) {
                                CodeClassifyValue codeClassifyValue = (CodeClassifyValue)codeClassifyValueDOMap
                                                .getOrDefault((Object)null, codeClassifyValueDOMap.get(""));
                                sectypeValue = codeClassifyValue.getOid();
                            } else {
                                message="传入的分类码段:【" + name + " 值:" + sectypeValue + "】,不符合当前分类层级代号";
                                errorMap.put("error",errorMap.getOrDefault("error","")+";"+message);
                            }
                        }
                    }else if(CODE_REFER_SEC.getValue().equals(sectype)){
                        String referBtmId=codeBasicSecVO.getReferBtmId();
                        String btmName=codeBasicSecVO.getReferBtmName();
                        String referConfig= codeBasicSecVO.getReferConfig();
                        CoderefersecSearchVO coderefersecSearchVO=new CoderefersecSearchVO();
                        if(StringUtils.isNotBlank(referConfig)){
Source/UBCS/ubcs-service/ubcs-deploy/src/main/java/com/vci/ubcs/deploy/service/impl/DeployAppsServiceImpl.java
@@ -102,15 +102,21 @@
        String cookie = request.getHeaders("Cookie").nextElement();
        // 免密登录接口地址
        String loginUrl = "http://"+pwdFreeAddr+":"+this.getGatewayPort("ubcs-gateway")+"/ubcs-admin/applications";
        log.debug("获取服务信息调用地址:"+loginUrl);
        log.info("获取服务信息调用地址:"+loginUrl);
        System.out.println("=================获取服务信息调用地址:"+loginUrl);
        // 请求ubcs-admin获取服务信息
        HttpHeaders headers = new HttpHeaders();
        ArrayList<MediaType> mediaTypes = new ArrayList<>();
        mediaTypes.add(MediaType.APPLICATION_JSON);
        headers.set("Authorization","Basic c2FiZXI6c2FiZXJfc2VjcmV0");
        headers.set("Blade-Auth",baldeAuth);
        System.out.println("============Blade-Auth:"+baldeAuth);
        headers.set("Cookie",cookie);
        System.out.println("============Cookie:"+cookie);
        headers.setAccept(mediaTypes);
        List<DeployAppsVO> deployAppsVOList = new ArrayList<>();
        try {
            // 发送GET请求