lywsvip/easy-admin
1
0
Fork 0
mirror of https://gitee.com/lakernote/easy-admin.git synced 2026-09-03 05:33:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

code refactor

Browse Source
This commit is contained in:
laker
2024-03-26 12:20:39 +08:00
parent 9c8a836ace
commit c5f52fb167
6 changed files with 28 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
src/main/java/com/laker/admin/framework/ext/filter/waf/WafFilter.java
View File

@@ -5,12 +5,14 @@ import com.laker.admin.framework.model.Response;
import com.laker.admin.framework.utils.EasyHttpResponseUtil;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.fileupload.servlet.ServletFileUpload;
import org.springframework.http.HttpMethod;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -20,6 +22,8 @@ import java.util.regex.Pattern;
*/
@Slf4j
public class WafFilter implements Filter {
private static final List<HttpMethod> ALLOW_METHODS = Arrays.asList(HttpMethod.POST,
HttpMethod.PUT, HttpMethod.DELETE, HttpMethod.PATCH);
/**
* 排除链接
*/
@@ -35,8 +39,7 @@ public class WafFilter implements Filter {
@Override
public void init(FilterConfig config) throws ServletException {
String excludesUrls = config.getInitParameter("excludes");
excludes = StrUtil.split(excludesUrls, ',');
excludes = StrUtil.split(config.getInitParameter("excludes"), ',');
xssEnabled = getParamConfig(config.getInitParameter("xssEnabled"));
sqlEnabled = getParamConfig(config.getInitParameter("sqlEnabled"));
}
@@ -46,19 +49,16 @@ public class WafFilter implements Filter {
HttpServletRequest request = (HttpServletRequest) servletRequest;
HttpServletResponse response = (HttpServletResponse) servletResponse;
// 是否可以在iframe显示视图： DENY=不可以 | SAMEORIGIN=同域下可以 | ALLOW-FROM uri=指定域名下可以
response.setHeader("X-Frame-Options", "SAMEORIGIN");
// 禁用浏览器内容嗅探
response.setHeader("X-Content-Type-Options", "nosniff");
// 是否启用浏览器默认XSS防护： 0=禁用 | 1=启用 | 1; mode=block 启用, 并在检查到XSS攻击时，停止渲染页面
response.setHeader("X-XSS-Protection", "1; mode=block");
// 设置安全响应头
setSecurityHeaders(response);
// 只处理 POST PUT DELETE
if (!request.getMethod().equals("POST")) {
// 只处理 POST PUT DELETE PATCH
if (!ALLOW_METHODS.contains(HttpMethod.resolve(request.getMethod()))) {
chain.doFilter(request, response);
return;
}
// 处理文件上传请求
if (ServletFileUpload.isMultipartContent(request)) {
Response<Void> check = MultipartRequestChecker.check(request);
if (!check.getSuccess()) {
@@ -69,7 +69,8 @@ public class WafFilter implements Filter {
return;
}
if (handle(request)) {
if (shouldHandleRequest(request)) {
try {
//Request请求过滤
chain.doFilter(new WafRequestWrapper(request, xssEnabled, sqlEnabled), servletResponse);
@@ -84,8 +85,16 @@ public class WafFilter implements Filter {
log.warn(" WafFilter destroy .");
}
private void setSecurityHeaders(HttpServletResponse response) {
// 是否可以在iframe显示视图： DENY=不可以 | SAMEORIGIN=同域下可以 | ALLOW-FROM uri=指定域名下可以
response.setHeader("X-Frame-Options", "SAMEORIGIN");
// 禁用浏览器内容嗅探
response.setHeader("X-Content-Type-Options", "nosniff");
// 是否启用浏览器默认XSS防护： 0=禁用 | 1=启用 | 1; mode=block 启用, 并在检查到XSS攻击时，停止渲染页面
response.setHeader("X-XSS-Protection", "1; mode=block");
}
private boolean handle(HttpServletRequest request) {
private boolean shouldHandleRequest(HttpServletRequest request) {
if (!xssEnabled && !sqlEnabled) {
return false;
}

2
src/main/java/com/laker/admin/framework/utils/EasyHttpResponseUtil.java
View File

@@ -13,7 +13,7 @@ public class EasyHttpResponseUtil {
response.setStatus(HttpServletResponse.SC_OK);
// 防止json 中文乱码
response.setContentType("application/json; charset=UTF-8");
ObjectMapper objectMapper = SpringUtils.getBean(ObjectMapper.class);
ObjectMapper objectMapper = EasySpringUtils.getBean(ObjectMapper.class);
PrintWriter out = response.getWriter();
out.print(objectMapper.writeValueAsString(check));
out.flush();

4
src/main/java/com/laker/admin/framework/utils/SpringUtils.java → src/main/java/com/laker/admin/framework/utils/EasySpringUtils.java
View File

@@ -13,13 +13,13 @@ import java.util.Arrays;
import java.util.Map;
@Component
public class SpringUtils implements ApplicationContextAware {
public class EasySpringUtils implements ApplicationContextAware {
private static ApplicationContext applicationContext;
@Override
public void setApplicationContext(ApplicationContext applicationContext) {
SpringUtils.applicationContext = applicationContext;
EasySpringUtils.applicationContext = applicationContext;
}
/**

2
src/main/java/com/laker/admin/module/sys/controller/LoginController.java
View File

@@ -72,7 +72,7 @@ public class LoginController {
if (sysUser == null) {
return Response.error("5001", "用户名或密码不正确");
}
if (sysUser.getEnable().intValue() == 0) {
if (sysUser.getEnable() == 0) {
return Response.error("5001", "用户:" + loginDto.getUsername() + "已被禁用");
}
StpUtil.login(sysUser.getUserId());

4
src/main/java/com/laker/admin/module/task/core/processor/EasyTaskProcessor.java
View File

@@ -7,7 +7,7 @@ import cn.hutool.core.util.IdUtil;
import cn.hutool.core.util.StrUtil;
import com.baomidou.mybatisplus.core.toolkit.Wrappers;
import com.laker.admin.framework.EasyAdminConstants;
import com.laker.admin.framework.utils.SpringUtils;
import com.laker.admin.framework.utils.EasySpringUtils;
import com.laker.admin.module.enums.TaskStateEnum;
import com.laker.admin.module.task.core.IJob;
import com.laker.admin.module.task.core.TaskJob;
@@ -74,7 +74,7 @@ public class EasyTaskProcessor {
jobListener.start(task);
});
String taskClassName = task.getTaskClassName();
Map<String, IJob> beansOfType = SpringUtils.getBeansOfType(IJob.class);
Map<String, IJob> beansOfType = EasySpringUtils.getBeansOfType(IJob.class);
for (IJob iJob : beansOfType.values()) {
if (StrUtil.equals(taskClassName, iJob.getClass().getName())) {
iJob.execute(param);

2
src/main/resources/logback.xml
View File

@@ -82,7 +82,7 @@
<logger name="org.snaker.engine" level="ERROR"/>
<!-- 不支持通配符 com.laker.admin.module.**.mapper-->
<logger name="com.laker.admin.module" level="INFO"/>
<logger name="com.laker.admin.framework" level="INFO"/>
<logger name="com.laker.admin.framework" level="WARN"/>
<!-- 默认日志输出级别 -->
<root level="WARN">
<appender-ref ref="DEFAULT"/>