From 1a5b024df65f503488c19e95bdbdaa1b30014e7b Mon Sep 17 00:00:00 2001 From: RuoYi <yzz_ivy@163.com> Date: 星期四, 06 一月 2022 14:50:56 +0800 Subject: [PATCH] 定时任务目标字符串验证包名白名单 --- ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java | 17 +++++++++++++---- 1 files changed, 13 insertions(+), 4 deletions(-) diff --git a/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java b/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java index 56857e0..40c516f 100644 --- a/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java +++ b/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java @@ -25,6 +25,7 @@ import com.ruoyi.quartz.domain.SysJob; import com.ruoyi.quartz.service.ISysJobService; import com.ruoyi.quartz.util.CronUtils; +import com.ruoyi.quartz.util.ScheduleUtils; /** * 调度任务信息操作处理 @@ -89,17 +90,21 @@ { return error("新增任务'" + job.getJobName() + "'失败,目标字符串不允许'rmi'调用"); } - else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_LDAP)) + else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.LOOKUP_LDAP, Constants.LOOKUP_LDAPS })) { return error("新增任务'" + job.getJobName() + "'失败,目标字符串不允许'ldap'调用"); } else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS })) { - return error("新增任务'" + job.getJobName() + "'失败,目标字符串不允许'http(s)//'调用"); + return error("新增任务'" + job.getJobName() + "'失败,目标字符串不允许'http(s)'调用"); } else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR)) { return error("新增任务'" + job.getJobName() + "'失败,目标字符串存在违规"); + } + else if (!ScheduleUtils.whiteList(job.getInvokeTarget())) + { + return error("新增任务'" + job.getJobName() + "'失败,目标字符串不在白名单内"); } job.setCreateBy(getUsername()); return toAjax(jobService.insertJob(job)); @@ -121,18 +126,22 @@ { return error("修改任务'" + job.getJobName() + "'失败,目标字符串不允许'rmi'调用"); } - else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_LDAP)) + else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.LOOKUP_LDAP, Constants.LOOKUP_LDAPS })) { return error("修改任务'" + job.getJobName() + "'失败,目标字符串不允许'ldap'调用"); } else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS })) { - return error("修改任务'" + job.getJobName() + "'失败,目标字符串不允许'http(s)//'调用"); + return error("修改任务'" + job.getJobName() + "'失败,目标字符串不允许'http(s)'调用"); } else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR)) { return error("修改任务'" + job.getJobName() + "'失败,目标字符串存在违规"); } + else if (!ScheduleUtils.whiteList(job.getInvokeTarget())) + { + return error("新增任务'" + job.getJobName() + "'失败,目标字符串不在白名单内"); + } job.setUpdateBy(getUsername()); return toAjax(jobService.updateJob(job)); } -- Gitblit v1.9.2