From 578d65dfb4c07bd75aa5a6d2f46fc63fa5701fc3 Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Wed, 05 Jan 2022 14:56:05 +0800
Subject: [PATCH] 定时任务目标字符串过滤特殊字符
---
ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java | 60 ++++++++++++++++++++++++++++++++++++++++++------------------
1 files changed, 42 insertions(+), 18 deletions(-)
diff --git a/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java b/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java
index e779b64..56857e0 100644
--- a/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java
+++ b/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java
@@ -1,6 +1,7 @@
package com.ruoyi.quartz.controller;
import java.util.List;
+import javax.servlet.http.HttpServletResponse;
import org.quartz.SchedulerException;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.prepost.PreAuthorize;
@@ -19,7 +20,6 @@
import com.ruoyi.common.core.page.TableDataInfo;
import com.ruoyi.common.enums.BusinessType;
import com.ruoyi.common.exception.job.TaskException;
-import com.ruoyi.common.utils.SecurityUtils;
import com.ruoyi.common.utils.StringUtils;
import com.ruoyi.common.utils.poi.ExcelUtil;
import com.ruoyi.quartz.domain.SysJob;
@@ -55,12 +55,12 @@
*/
@PreAuthorize("@ss.hasPermi('monitor:job:export')")
@Log(title = "定时任务", businessType = BusinessType.EXPORT)
- @GetMapping("/export")
- public AjaxResult export(SysJob sysJob)
+ @PostMapping("/export")
+ public void export(HttpServletResponse response, SysJob sysJob)
{
List<SysJob> list = jobService.selectJobList(sysJob);
ExcelUtil<SysJob> util = new ExcelUtil<SysJob>(SysJob.class);
- return util.exportExcel(list, "定时任务");
+ util.exportExcel(response, list, "定时任务");
}
/**
@@ -79,18 +79,30 @@
@PreAuthorize("@ss.hasPermi('monitor:job:add')")
@Log(title = "定时任务", businessType = BusinessType.INSERT)
@PostMapping
- public AjaxResult add(@RequestBody SysJob sysJob) throws SchedulerException, TaskException
+ public AjaxResult add(@RequestBody SysJob job) throws SchedulerException, TaskException
{
- if (!CronUtils.isValid(sysJob.getCronExpression()))
+ if (!CronUtils.isValid(job.getCronExpression()))
{
- return AjaxResult.error("新增任务'" + sysJob.getJobName() + "'失败，Cron表达式不正确");
+ return error("新增任务'" + job.getJobName() + "'失败，Cron表达式不正确");
}
- else if (StringUtils.containsIgnoreCase(sysJob.getInvokeTarget(), Constants.LOOKUP_RMI))
+ else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_RMI))
{
- return AjaxResult.error("新增任务'" + sysJob.getJobName() + "'失败，目标字符串不允许'rmi://'调用");
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi'调用");
}
- sysJob.setCreateBy(SecurityUtils.getUsername());
- return toAjax(jobService.insertJob(sysJob));
+ else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_LDAP))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS }))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR))
+ {
+ return error("新增任务'" + job.getJobName() + "'失败，目标字符串存在违规");
+ }
+ job.setCreateBy(getUsername());
+ return toAjax(jobService.insertJob(job));
}
/**
@@ -99,18 +111,30 @@
@PreAuthorize("@ss.hasPermi('monitor:job:edit')")
@Log(title = "定时任务", businessType = BusinessType.UPDATE)
@PutMapping
- public AjaxResult edit(@RequestBody SysJob sysJob) throws SchedulerException, TaskException
+ public AjaxResult edit(@RequestBody SysJob job) throws SchedulerException, TaskException
{
- if (!CronUtils.isValid(sysJob.getCronExpression()))
+ if (!CronUtils.isValid(job.getCronExpression()))
{
- return AjaxResult.error("修改任务'" + sysJob.getJobName() + "'失败，Cron表达式不正确");
+ return error("修改任务'" + job.getJobName() + "'失败，Cron表达式不正确");
}
- else if (StringUtils.containsIgnoreCase(sysJob.getInvokeTarget(), Constants.LOOKUP_RMI))
+ else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_RMI))
{
- return AjaxResult.error("修改任务'" + sysJob.getJobName() + "'失败，目标字符串不允许'rmi://'调用");
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi'调用");
}
- sysJob.setUpdateBy(SecurityUtils.getUsername());
- return toAjax(jobService.updateJob(sysJob));
+ else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_LDAP))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS }))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用");
+ }
+ else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR))
+ {
+ return error("修改任务'" + job.getJobName() + "'失败，目标字符串存在违规");
+ }
+ job.setUpdateBy(getUsername());
+ return toAjax(jobService.updateJob(job));
}
/**
--
Gitblit v1.9.2