From 524ad4e6ddc04f2f0cfacb33f42c2f022629bbbb Mon Sep 17 00:00:00 2001
From: abbfun <819589789@qq.com>
Date: Mon, 23 May 2022 15:36:18 +0800
Subject: [PATCH] fastjson 版本升级 fastjson <= 1.2.80 存在反序列化任意代码执行漏洞
---
ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java | 10 +++-------
1 files changed, 3 insertions(+), 7 deletions(-)
diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java
index 33c9c87..b956b3f 100644
--- a/ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java
+++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/interceptor/impl/SameUrlDataInterceptor.java
@@ -60,14 +60,10 @@
String url = request.getRequestURI();
// 唯一值（没有消息头则使用请求地址）
- String submitKey = request.getHeader(header);
- if (StringUtils.isEmpty(submitKey))
- {
- submitKey = url;
- }
+ String submitKey = StringUtils.trimToEmpty(request.getHeader(header));
- // 唯一标识（指定key + 消息头）
- String cacheRepeatKey = Constants.REPEAT_SUBMIT_KEY + submitKey;
+ // 唯一标识（指定key + url + 消息头）
+ String cacheRepeatKey = Constants.REPEAT_SUBMIT_KEY + url + submitKey;
Object sessionObj = redisCache.getCacheObject(cacheRepeatKey);
if (sessionObj != null)
--
Gitblit v1.9.2