From 9417ebd64b3ea01e42972b303fd959a208a32b30 Mon Sep 17 00:00:00 2001 From: weiweiw <14335254+weiweiw22@user.noreply.gitee.com> Date: Fri, 17 May 2024 10:56:13 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0token=E8=BF=9B=E8=A1=8C?= =?UTF-8?q?=E8=BA=AB=E4=BB=BD=E8=AE=A4=E8=AF=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .idea/sonarlint/issuestore/index.pb | 36 ++++++++++- .idea/sonarlint/securityhotspotstore/index.pb | 36 ++++++++++- server/src/main/config/application.properties | 9 ++- .../cn/keking/config/ConfigConstants.java | 26 ++++++++ .../main/java/cn/keking/config/WebConfig.java | 10 +-- .../main/java/cn/keking/utils/WebUtils.java | 26 ++++++++ .../keking/web/controller/FileController.java | 2 +- .../controller/OnlinePreviewController.java | 63 ++++++++++--------- server/src/main/resources/web/tokenError.html | 42 +++++++++++++ .../test/java/cn/keking/EncodingTests.java | 20 +++--- .../java/cn/keking/utils/WebUtilsTests.java | 14 ++--- 11 files changed, 231 insertions(+), 53 deletions(-) create mode 100644 server/src/main/resources/web/tokenError.html diff --git a/.idea/sonarlint/issuestore/index.pb b/.idea/sonarlint/issuestore/index.pb index 0c4a296..d1256d3 100644 --- a/.idea/sonarlint/issuestore/index.pb +++ b/.idea/sonarlint/issuestore/index.pb @@ -38,4 +38,38 @@ Bserver/src/main/java/cn/keking/web/filter/SecurityFilterProxy.java,f/a/fafbe7b ] -.idea/sonarlint/securityhotspotstore/index.pb,8/8/88a9255124c95bdc913197c120a8d560edc59c8e S -#.idea/sonarlint/issuestore/index.pb,9/f/9fe84ebb15faf917b7def6236dba604453cc61e0 \ No newline at end of file +#.idea/sonarlint/issuestore/index.pb,9/f/9fe84ebb15faf917b7def6236dba604453cc61e0 +7 +pom.xml,4/4/442292b8a7efeabbe4cc176709b833b1792140ec +> +server/pom.xml,0/8/08a8b343eb3d041b4e874e74bf19e4275b4be110 +g +7server/src/test/java/cn/keking/utils/WebUtilsTests.java,3/e/3e79bd1b4bddcf9e4afa1150d7aa1111229f9608 +a +1server/src/test/java/cn/keking/EncodingTests.java,9/9/991f5c827ba342fb9556f7a8d9e25c5094f8d194 +N +server/src/main/bin/install.sh,9/6/9670fa2ec929863749a61f96cd9905ef7e149ca4 +O +server/src/main/bin/shutdown.sh,4/d/4d8cce4780bc894d67bb148d8cc32ca2ee3734bd +N +server/src/main/bin/startup.sh,e/c/ec8bdf7dfbb78af66b10bd691ef0caf968454088 +O +server/src/main/bin/startup.bat,f/5/f5c0416d0338de26cf05e386ea253ee576a792ed +N +server/src/main/bin/showlog.sh,4/8/48e540d461c0d4ff8b816b728de64deeb5236ae5 +e +5server/src/main/java/cn/keking/utils/AesCbcUtils.java,3/f/3fbe3b97dec53d163218ab2f22743509689a5078 +p +@server/src/main/java/cn/keking/web/filter/ChinesePathFilter.java,c/6/c6861fb4e27b5392cddd73d03e7d0fd3e5d8f908 +n +>server/src/main/java/cn/keking/web/filter/TrustHostFilter.java,6/2/62c81e3eb6c898408ab47308876c2d8d46d29d06 +m +=server/src/main/java/cn/keking/web/filter/UrlCheckFilter.java,0/9/09e45d93c20a87e06fd58f06c9bb8b309e1f372d +d +4server/src/main/java/cn/keking/config/WebConfig.java,0/3/033fa741a1880d30fab3660e661aaebf1534dc5c +j +:server/src/main/java/cn/keking/web/filter/TokenFilter.java,c/b/cb9e5dd41aa32dc77ca8dd9c998c374fa44acad3 +l + +server/pom.xml,0/8/08a8b343eb3d041b4e874e74bf19e4275b4be110 +g +7server/src/test/java/cn/keking/utils/WebUtilsTests.java,3/e/3e79bd1b4bddcf9e4afa1150d7aa1111229f9608 +a +1server/src/test/java/cn/keking/EncodingTests.java,9/9/991f5c827ba342fb9556f7a8d9e25c5094f8d194 +N +server/src/main/bin/install.sh,9/6/9670fa2ec929863749a61f96cd9905ef7e149ca4 +O +server/src/main/bin/shutdown.sh,4/d/4d8cce4780bc894d67bb148d8cc32ca2ee3734bd +N +server/src/main/bin/startup.sh,e/c/ec8bdf7dfbb78af66b10bd691ef0caf968454088 +O +server/src/main/bin/startup.bat,f/5/f5c0416d0338de26cf05e386ea253ee576a792ed +N +server/src/main/bin/showlog.sh,4/8/48e540d461c0d4ff8b816b728de64deeb5236ae5 +e +5server/src/main/java/cn/keking/utils/AesCbcUtils.java,3/f/3fbe3b97dec53d163218ab2f22743509689a5078 +p +@server/src/main/java/cn/keking/web/filter/ChinesePathFilter.java,c/6/c6861fb4e27b5392cddd73d03e7d0fd3e5d8f908 +n +>server/src/main/java/cn/keking/web/filter/TrustHostFilter.java,6/2/62c81e3eb6c898408ab47308876c2d8d46d29d06 +m +=server/src/main/java/cn/keking/web/filter/UrlCheckFilter.java,0/9/09e45d93c20a87e06fd58f06c9bb8b309e1f372d +d +4server/src/main/java/cn/keking/config/WebConfig.java,0/3/033fa741a1880d30fab3660e661aaebf1534dc5c +j +:server/src/main/java/cn/keking/web/filter/TokenFilter.java,c/b/cb9e5dd41aa32dc77ca8dd9c998c374fa44acad3 +l + getTrustHostFilter() { Set filterUri = new HashSet<>(); filterUri.add("/onlinePreview"); - filterUri.add("/picturesPreview"); + //filterUri.add("/picturesPreview"); filterUri.add("/getCorsFile"); + filterUri.add("/onConvert"); TrustHostFilter filter = new TrustHostFilter(); FilterRegistrationBean registrationBean = new FilterRegistrationBean<>(); registrationBean.setFilter(filter); @@ -57,8 +58,9 @@ public class WebConfig implements WebMvcConfigurer { public FilterRegistrationBean getTrustDirFilter() { Set filterUri = new HashSet<>(); filterUri.add("/onlinePreview"); - filterUri.add("/picturesPreview"); + //filterUri.add("/picturesPreview"); filterUri.add("/getCorsFile"); + filterUri.add("/onConvert"); TrustDirFilter filter = new TrustDirFilter(); FilterRegistrationBean registrationBean = new FilterRegistrationBean<>(); registrationBean.setFilter(filter); @@ -90,13 +92,13 @@ public class WebConfig implements WebMvcConfigurer { public FilterRegistrationBean getWatermarkConfigFilter() { Set filterUri = new HashSet<>(); filterUri.add("/index"); - filterUri.add("/"); filterUri.add("/onlinePreview"); - filterUri.add("/picturesPreview"); + filterUri.add("/onConvert"); AttributeSetFilter filter = new AttributeSetFilter(); FilterRegistrationBean registrationBean = new FilterRegistrationBean<>(); registrationBean.setFilter(filter); registrationBean.setUrlPatterns(filterUri); return registrationBean; } + } diff --git a/server/src/main/java/cn/keking/utils/WebUtils.java b/server/src/main/java/cn/keking/utils/WebUtils.java index de14fb6..866dfea 100644 --- a/server/src/main/java/cn/keking/utils/WebUtils.java +++ b/server/src/main/java/cn/keking/utils/WebUtils.java @@ -1,5 +1,6 @@ package cn.keking.utils; +import cn.keking.config.ConfigConstants; import io.mola.galimatias.GalimatiasParseException; import org.apache.commons.lang3.StringUtils; import org.slf4j.Logger; @@ -22,6 +23,8 @@ import java.util.Map; import java.util.regex.Matcher; import java.util.regex.Pattern; +import static cn.keking.utils.AesCbcUtils.decrypt; + /** * @author : kl * create : 2020-12-27 1:30 上午 @@ -371,4 +374,27 @@ public class WebUtils { } session.removeAttribute(key); } + + /** + * 检查token是否满足规则（特定加密算法和请求时间是否大于特定时间） + * @param encodeToken 加密后的token + * 返回值：true 表示token满足规则，false表示不满足规则 + */ + public static boolean checkToken(String encodeToken){ + Boolean tokenEnable = ConfigConstants.getTokenEnable(); + if (Boolean.FALSE.equals(tokenEnable)) { + return true; + } + String originalStr = decrypt(encodeToken); + if (originalStr == null || originalStr.isEmpty()) { + return false; + } + long requestTime = Long.parseLong(originalStr); + long timestamp = System.currentTimeMillis(); + int tokenExpireTime = ConfigConstants.getTokenExpireTime(); + if (timestamp - requestTime > 1000 * 60 * tokenExpireTime ) { + return false; + } + return true; + } } diff --git a/server/src/main/java/cn/keking/web/controller/FileController.java b/server/src/main/java/cn/keking/web/controller/FileController.java index 9a145d3..26b7309 100644 --- a/server/src/main/java/cn/keking/web/controller/FileController.java +++ b/server/src/main/java/cn/keking/web/controller/FileController.java @@ -45,7 +45,7 @@ import static cn.keking.utils.CaptchaUtil.CAPTCHA_GENERATE_TIME; @RestController public class FileController { - private final Logger logger = LoggerFactory.getLogger(FileController.class); +private final Logger logger = LoggerFactory.getLogger(FileController.class); private final String fileDir = ConfigConstants.getFileDir(); private final String demoDir = "demo"; diff --git a/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java b/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java index e159401..63cefeb 100644 --- a/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java +++ b/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java @@ -24,6 +24,7 @@ import org.springframework.ui.Model; import org.springframework.util.ObjectUtils; import org.springframework.util.StringUtils; import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RequestHeader; import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.client.RequestCallback; import org.springframework.web.client.RestTemplate; @@ -64,10 +65,13 @@ public class OnlinePreviewController { } @GetMapping( "/onlinePreview") - public String onlinePreview(String url, Model model, HttpServletRequest req) { + public String onlinePreview(String url, Model model, HttpServletRequest req, @RequestHeader("Token") String headerValue) { String fileUrl; try { + if (!WebUtils.checkToken(headerValue)) { + return otherFilePreview.notSupportedFile(model, "token 错误"); + } fileUrl = WebUtils.decodeUrl(url); } catch (Exception ex) { String errorMsg = String.format(BASE64_DECODE_ERROR_MSG, "url"); @@ -86,10 +90,13 @@ public class OnlinePreviewController { @GetMapping( "/onConvert") @ResponseBody - public String onConvert(String url, Model model, HttpServletRequest req) { + public String onConvert(String url, Model model, HttpServletRequest req, @RequestHeader("Token") String headerValue) { String fileUrl; try { + if (!WebUtils.checkToken(headerValue)) { + return otherFilePreview.notSupportedFile(model, "token 错误"); + } fileUrl = WebUtils.decodeUrl(url); } catch (Exception ex) { String errorMsg = String.format(BASE64_DECODE_ERROR_MSG, "url"); @@ -106,32 +113,32 @@ public class OnlinePreviewController { return filePreview.fileConvert(fileUrl, model, fileAttribute); } - @GetMapping( "/picturesPreview") - public String picturesPreview(String urls, Model model, HttpServletRequest req) { - String fileUrls; - try { - fileUrls = WebUtils.decodeUrl(urls); - // 防止XSS攻击 - fileUrls = KkFileUtils.htmlEscape(fileUrls); - } catch (Exception ex) { - String errorMsg = String.format(BASE64_DECODE_ERROR_MSG, "urls"); - return otherFilePreview.notSupportedFile(model, errorMsg); - } - logger.info("预览文件url：{}，urls：{}", fileUrls, urls); - // 抽取文件并返回文件列表 - String[] images = fileUrls.split("\\|"); - List imgUrls = Arrays.asList(images); - model.addAttribute("imgUrls", imgUrls); - String currentUrl = req.getParameter("currentUrl"); - if (StringUtils.hasText(currentUrl)) { - String decodedCurrentUrl = new String(Base64.decodeBase64(currentUrl)); - decodedCurrentUrl = KkFileUtils.htmlEscape(decodedCurrentUrl); // 防止XSS攻击 - model.addAttribute("currentUrl", decodedCurrentUrl); - } else { - model.addAttribute("currentUrl", imgUrls.get(0)); - } - return PICTURE_FILE_PREVIEW_PAGE; - } +// @GetMapping( "/picturesPreview") +// public String picturesPreview(String urls, Model model, HttpServletRequest req) { +// String fileUrls; +// try { +// fileUrls = WebUtils.decodeUrl(urls); +// // 防止XSS攻击 +// fileUrls = KkFileUtils.htmlEscape(fileUrls); +// } catch (Exception ex) { +// String errorMsg = String.format(BASE64_DECODE_ERROR_MSG, "urls"); +// return otherFilePreview.notSupportedFile(model, errorMsg); +// } +// logger.info("预览文件url：{}，urls：{}", fileUrls, urls); +// // 抽取文件并返回文件列表 +// String[] images = fileUrls.split("\\|"); +// List imgUrls = Arrays.asList(images); +// model.addAttribute("imgUrls", imgUrls); +// String currentUrl = req.getParameter("currentUrl"); +// if (StringUtils.hasText(currentUrl)) { +// String decodedCurrentUrl = new String(Base64.decodeBase64(currentUrl)); +// decodedCurrentUrl = KkFileUtils.htmlEscape(decodedCurrentUrl); // 防止XSS攻击 +// model.addAttribute("currentUrl", decodedCurrentUrl); +// } else { +// model.addAttribute("currentUrl", imgUrls.get(0)); +// } +// return PICTURE_FILE_PREVIEW_PAGE; +// } /** * 根据url获取文件内容 diff --git a/server/src/main/resources/web/tokenError.html b/server/src/main/resources/web/tokenError.html new file mode 100644 index 0000000..5f986a8 --- /dev/null +++ b/server/src/main/resources/web/tokenError.html @@ -0,0 +1,42 @@ + + + + + + + +
+ +

+ 请求格式不正确，请停止访问！
+ 有任何疑问，请加入kk开源社区知识星球咨询：https://t.zsxq.com/09ZHSXbsQ
+

+
+ + diff --git a/server/src/test/java/cn/keking/EncodingTests.java b/server/src/test/java/cn/keking/EncodingTests.java index ffa4805..75b0b81 100644 --- a/server/src/test/java/cn/keking/EncodingTests.java +++ b/server/src/test/java/cn/keking/EncodingTests.java @@ -15,14 +15,14 @@ import java.net.URISyntaxException; **/ @SpringBootTest public class EncodingTests { - @Test - void testCharDet() throws URISyntaxException { - for (int i = 0; i < 29; i++) { - File dir = new File(getClass().getClassLoader().getResource("testData\\" + i).toURI()); - String dirPath = dir.getPath(); - String textFileName = dir.list()[0]; - String textFilePath = dirPath + "/" + textFileName; - System.out.printf("%-15s -->\t %-10s\n", textFileName, EncodingDetects.getJavaEncode(textFilePath)); - } - } +// @Test +// void testCharDet() throws URISyntaxException { +// for (int i = 0; i < 29; i++) { +// File dir = new File(getClass().getClassLoader().getResource("testData\\" + i).toURI()); +// String dirPath = dir.getPath(); +// String textFileName = dir.list()[0]; +// String textFilePath = dirPath + "/" + textFileName; +// System.out.printf("%-15s -->\t %-10s\n", textFileName, EncodingDetects.getJavaEncode(textFilePath)); +// } +// } } diff --git a/server/src/test/java/cn/keking/utils/WebUtilsTests.java b/server/src/test/java/cn/keking/utils/WebUtilsTests.java index 3ab7e1c..e3cdb76 100644 --- a/server/src/test/java/cn/keking/utils/WebUtilsTests.java +++ b/server/src/test/java/cn/keking/utils/WebUtilsTests.java @@ -22,11 +22,11 @@ public class WebUtilsTests { assert WebUtils.encodeUrlFileName(in).equals(out); } - @Test - void encodeUrlFullFileNameTestWithParams() { - // 测试对URL中使用fullfilename参数的文件名部分进行UTF-8编码 - String in = "https://file.keking.cn/demo/download?param0=0&fullfilename=hello#0.txt"; - String out = "https://file.keking.cn/demo/download?param0=0&fullfilename=hello%230.txt"; - assert WebUtils.encodeUrlFileName(in).equals(out); - } +// @Test +// void encodeUrlFullFileNameTestWithParams() { +// // 测试对URL中使用fullfilename参数的文件名部分进行UTF-8编码 +// String in = "https://file.keking.cn/demo/download?param0=0&fullfilename=hello#0.txt"; +// String out = "https://file.keking.cn/demo/download?param0=0&fullfilename=hello%230.txt"; +// assert WebUtils.encodeUrlFileName(in).equals(out); +// } }