From 50236ae4e5e6009cfeefbbd48dce097b75222cd5 Mon Sep 17 00:00:00 2001 From: RuoYi <yzz_ivy@163.com> Date: 星期四, 10 二月 2022 17:17:51 +0800 Subject: [PATCH] 修复Xss注解字段值为空时的异常问题 --- ruoyi-common/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java | 27 +++++++++++++++++---------- 1 files changed, 17 insertions(+), 10 deletions(-) diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java b/ruoyi-common/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java index 4169360..e8f2950 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java @@ -86,6 +86,8 @@ { private static final Logger log = LoggerFactory.getLogger(ExcelUtil.class); + public static final String[] FORMULA_STR = { "=", "-", "+", "@" }; + /** * Excel sheet最大行数,默认65536 */ @@ -431,7 +433,7 @@ * @return 结果 * @throws IOException */ - public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)throws IOException + public void exportExcel(HttpServletResponse response, List<T> list, String sheetName) { exportExcel(response, list, sheetName, StringUtils.EMPTY); } @@ -446,12 +448,12 @@ * @return 结果 * @throws IOException */ - public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title) throws IOException + public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title) { response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"); response.setCharacterEncoding("utf-8"); this.init(list, sheetName, title, Type.EXPORT); - exportExcel(response.getOutputStream()); + exportExcel(response); } /** @@ -484,7 +486,7 @@ * @param sheetName 工作表的名称 * @return 结果 */ - public void importTemplateExcel(HttpServletResponse response, String sheetName) throws IOException + public void importTemplateExcel(HttpServletResponse response, String sheetName) { importTemplateExcel(response, sheetName, StringUtils.EMPTY); } @@ -496,12 +498,12 @@ * @param title 标题 * @return 结果 */ - public void importTemplateExcel(HttpServletResponse response, String sheetName, String title) throws IOException + public void importTemplateExcel(HttpServletResponse response, String sheetName, String title) { response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"); response.setCharacterEncoding("utf-8"); this.init(null, sheetName, title, Type.IMPORT); - exportExcel(response.getOutputStream()); + exportExcel(response); } /** @@ -509,12 +511,12 @@ * * @return 结果 */ - public void exportExcel(OutputStream out) + public void exportExcel(HttpServletResponse response) { try { writeSheet(); - wb.write(out); + wb.write(response.getOutputStream()); } catch (Exception e) { @@ -523,7 +525,6 @@ finally { IOUtils.closeQuietly(wb); - IOUtils.closeQuietly(out); } } @@ -711,7 +712,13 @@ { if (ColumnType.STRING == attr.cellType()) { - cell.setCellValue(StringUtils.isNull(value) ? attr.defaultValue() : value + attr.suffix()); + String cellValue = Convert.toStr(value); + // 对于任何以表达式触发字符 =-+@开头的单元格,直接使用tab字符作为前缀,防止CSV注入。 + if (StringUtils.containsAny(cellValue, FORMULA_STR)) + { + cellValue = StringUtils.replaceEach(cellValue, FORMULA_STR, new String[] { "\t=", "\t-", "\t+", "\t@" }); + } + cell.setCellValue(StringUtils.isNull(cellValue) ? attr.defaultValue() : cellValue + attr.suffix()); } else if (ColumnType.NUMERIC == attr.cellType()) { -- Gitblit v1.9.2