前端校验

src/utils/request.js

@@ -119,7 +119,10 @@ service.interceptors.request.use(
                         requestUrl += '?' + paramsString
                     }
                 }
+                
                 const signature = generateRequestSignature(userId, timestamp, method, requestUrl, userSecret)
+                console.log(signature);
+                console.log(requestUrl);
                 config.headers['timestamp'] = timestamp
                 config.headers['X-Signature'] = signature
             } catch (error) {

src/utils/validate.js

@@ -5,7 +5,10 @@
  * @returns {Boolean}
  */
 export function isPathMatch(pattern, path) {
-  const regexPattern = pattern.replace(/\//g, '\\/').replace(/\*\*/g, '.*').replace(/\*/g, '[^\\/]*')
+    const regexPattern = pattern
+        .replace(/\//g, '\\/')
+        .replace(/\*\*/g, '.*')
+        .replace(/\*/g, '[^\\/]*')
     const regex = new RegExp(`^${regexPattern}$`)
     return regex.test(path)
 }
@@ -16,7 +19,12 @@ export function isPathMatch(pattern, path) {
  * @returns {Boolean}
  */
 export function isEmpty(value) {
-  if (value == null || value == "" || value == undefined || value == "undefined") {
+    if (
+        value == null ||
+        value == '' ||
+        value == undefined ||
+        value == 'undefined'
+    ) {
         return true
     }
     return false
@@ -54,7 +62,8 @@ export function validUsername(str) {
  * @returns {Boolean}
  */
 export function validURL(url) {
-  const reg = /^(https?|ftp):\/\/([a-zA-Z0-9.-]+(:[a-zA-Z0-9.&%$-]+)*@)*((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+\.(com|edu|gov|int|mil|net|org|biz|arpa|info|name|pro|aero|coop|museum|[a-zA-Z]{2}))(:[0-9]+)*(\/($|[a-zA-Z0-9.,?'\\+&%$#=~_-]+))*$/
+    const reg =
+        /^(https?|ftp):\/\/([a-zA-Z0-9.-]+(:[a-zA-Z0-9.&%$-]+)*@)*((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+\.(com|edu|gov|int|mil|net|org|biz|arpa|info|name|pro|aero|coop|museum|[a-zA-Z]{2}))(:[0-9]+)*(\/($|[a-zA-Z0-9.,?'\\+&%$#=~_-]+))*$/
     return reg.test(url)
 }
 
@@ -90,7 +99,8 @@ export function validAlphabets(str) {
  * @returns {Boolean}
  */
 export function validEmail(email) {
-  const reg = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
+    const reg =
+        /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
     return reg.test(email)
 }
 
@@ -154,3 +164,24 @@ export function isIPv4RangeOrder(start, end) {
     if (!isIPv4(start) || !isIPv4(end)) return false
     return ipv4ToInt(start) <= ipv4ToInt(end)
 }
+
+/**
+ * 统一安全校验方法
+ * 使用方法：validSecurity(str) 返回 true/false
+ */
+
+/**
+ * 统一安全校验方法
+ * 使用方法：validSecurity(str) 返回 true/false
+ */
+
+export function validSecurity(str) {
+  if (!str || typeof str !== 'string') {
+    return true;
+  }
+
+  // 将所有正则模式合并为一个统一的正则表达式
+  const securityRegex = /<script>(.*?)<\/script>|src[\r\n]*=[\r\n]*'(.*?)'|src[\r\n]*=[\r\n]*"(.*?)"|<\/script>|<script(.*?)>|eval\((.*?)\)|e-xpression\((.*?)\)|javascript:|vbscript:|onload(.*?)=|onerror(.*?)=|onclick(.*?)=|onmouseover(.*?)=|alert\((.*?)\)|<.*>|\[.*\]|\(.*\)|'.*'|".*"|%3c|%3e|%2f|%27|%22|%2b|%3b|%28|%29|%5b|%5d|@.*|!.*|%.*|\\x3c|\\x3e|\\x2f|\\x27|\\x22|data:text\/html|base64|document\.|window\.|location\.|cookie|--|\/\*.*?\*\/|#|'|"|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|\bdrop\b|\btruncate\b|\balter\b|\bcreate\b|\bexec\b|\bexecute\b|\bdeclare\b|\bxp_cmdshell\b|\bsp_\w+\b|\bchar\b|\bascii\b|\bsubstr\b|\bsubstring\b|\bconcat\b|\bmaster\b|\bsys\b|\binformation_schema\b|\bunion\b|\binto\b|\bfrom\b|\bwhere\b|\band\b|\bor\b/i;
+
+  return !securityRegex.test(str);
+}

src/views/archivesManagement/archClass/archCatalogue/components/leftTree.vue

@@ -55,6 +55,7 @@
 <script>
 import { getArchivalCatalogueTreeApi,delArchiveApi } from '@/api/archivesManagement/index.js'
 import AddTreeData from './addTreeData.vue'
+import { validSecurity } from '@/utils/validate'
 export default {
     name: 'LeftTree',
     components: { AddTreeData },
@@ -154,6 +155,7 @@ export default {
             this.selectedNodeId = data.id;
             this.$emit('handleNodeClick', data)
         },
+        
         // 树数据过滤 - 支持无限层级转换
         convertToVueTree(data) {
             if (!data || !Array.isArray(data)) {
@@ -205,6 +207,11 @@ export default {
         },
         // 搜索
         onHandleSearch() {
+            // 安全校验
+            if (this.filterText && !validSecurity(this.filterText)) {
+                this.$message.error('搜索内容包含非法字符，请重新输入')
+                return
+            }
             this.$refs.leftTreeRef.filter(this.filterText)
         },
         // 树节点过滤方法

src/views/archivesManagement/fileManager/components/leftTree.vue

@@ -56,6 +56,7 @@
 <script>
 import { getFileManageTreeApi, delFileManageApi } from '@/api/archivesManagement/fileManager/fileManager.js'
 import FileAddTreeData from './addTreeData.vue'
+import { validSecurity } from '@/utils/validate'
 export default {
     name: 'FileLeftTree',
     components: { FileAddTreeData },
@@ -154,6 +155,7 @@ export default {
             this.selectedNodeId = data.id;
             this.$emit('handleNodeClick', data)
         },
+        
         // 树数据过滤 - 支持无限层级转换
         convertToVueTree(data) {
             if (!data || !Array.isArray(data)) {
@@ -208,6 +210,11 @@ export default {
         },
         // 搜索
         onHandleSearch() {
+            // 安全校验
+            if (this.filterText && !validSecurity(this.filterText)) {
+                this.$message.error('搜索内容包含非法字符，请重新输入')
+                return
+            }
             this.$refs.leftTreeRef.filter(this.filterText)
         },
         // 树节点过滤方法

src/views/common/fileTree.vue

@@ -35,6 +35,7 @@ import _ from 'lodash'
 import {
     getFileManageTreeApi
 } from '@/api/filesTransfer/apply'
+import { validSecurity } from '@/utils/validate'
 export default {
     name: "FileTree",
     props: ["width", "title", "rowData"],
@@ -121,8 +122,14 @@ export default {
             // 保存选中的节点ID
             this.selectedNodeId = data.id;
         },
+        
         // 搜索
         onHandleSearch() {
+            // 安全校验
+            if (this.filterText && !validSecurity(this.filterText)) {
+                this.$message.error('搜索内容包含非法字符，请重新输入')
+                return
+            }
             this.$refs.leftTreeRef.filter(this.filterText)
         },
         // 树节点过滤方法

src/views/data-collect/data-set-manage/components/left-tree.vue

@@ -25,6 +25,7 @@
 
 <script>
 import { getLeftTreeListAPI } from '@/api/data-collect/data-set-manage'
+import { validSecurity } from '@/utils/validate'
 export default {
     name: 'LeftTree',
     data() {
@@ -48,6 +49,7 @@ export default {
         onHandleNodeClick(data) {
             this.$emit('handleNodeClick', data)
         },
+        
         convertToVueTree(data) {
             return data.map(item => ({
                 id: item.code,
@@ -75,6 +77,13 @@ export default {
                 this.displayedTreeData = JSON.parse(JSON.stringify(this.treeDataList))
                 return
             }
+            
+            // 安全校验
+            if (!validSecurity(this.filterText)) {
+                this.$message.error('输入内容包含非法字符，请重新输入')
+                return
+            }
+            
             this.displayedTreeData = this.filterTreeData(this.treeDataList)
         },
         // 递归过滤树数据

src/views/data-collect/data-set-manage/components/right-table.vue

@@ -39,6 +39,7 @@
 <script>
 import { getListDataSetAPI } from '@/api/data-collect/data-set-manage'
 import Share from './share.vue'
+import { validSecurity } from '@/utils/validate'
 export default {
     name: 'RightTable',
     components: {
@@ -95,6 +96,7 @@ export default {
         showColose() {
             this.isflag = false;
         },
+        
         // 查询：按第一列字段做模糊匹配
         onHandleQuery() {
             if (!Array.isArray(this.columns) || this.columns.length < 1) return
@@ -106,6 +108,13 @@ export default {
                 this.filteredManual = null
                 return
             }
+            
+            // 安全校验
+            if (!validSecurity(keyword)) {
+                this.$message.error('搜索内容包含非法字符，请重新输入')
+                return
+            }
+            
             // 执行一次性本地过滤
             const source = Array.isArray(this.tableData) ? this.tableData : []
             const kw = keyword.toLowerCase()