漏洞修复

hcp-app/src/main/java/com/yingyangfly/app/controller/AppUserController.java

@@ -7,6 +7,7 @@ import com.yingyangfly.core.dto.AppCurrentLoginUser;
 import com.yingyangfly.core.mapper.LoginRecordMapper;
 import com.yingyangfly.core.security.util.TokenUtil;
 import com.yingyangfly.core.service.impl.AppUserService;
+import com.yingyangfly.core.util.IDCardUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -43,6 +44,7 @@ public class AppUserController {
         }else {
             appCurrentLoginUser.setFirstLogin("1");
         }
+        appCurrentLoginUser.setIdCard(IDCardUtils.desensitizeIdCard(appCurrentLoginUser.getIdCard()));
         return ResultResponse.success(appCurrentLoginUser);
     }
 

hcp-core/src/main/java/com/yingyangfly/core/dto/AppCurrentLoginUser.java

@@ -30,8 +30,8 @@ public class AppCurrentLoginUser implements UserDetails {
     private String password;
     private Date createTime;
     private Date updateTime;
-    private String updateBy;
-    private String createBy;
+//    private String updateBy;
+//    private String createBy;
     private Date lastLoginDate;
     private String birthDate;
     private String  orderStartTime;

hcp-core/src/main/java/com/yingyangfly/core/util/Constants.java

@@ -0,0 +1,14 @@
+package com.yingyangfly.core.util;
+
+public class Constants {
+
+    public static final String LOOKUP_RMI="rmi";
+
+    public static final String LOOKUP_LDAP="ldap";
+
+    public static final String LOOKUP_LDAPS="ldaps";
+
+    public static final String HTTP="http";
+
+    public static final String HTTPS="https";
+}

hcp-core/src/main/java/com/yingyangfly/core/util/IDCardUtils.java

@@ -0,0 +1,16 @@
+package com.yingyangfly.core.util;
+
+public class IDCardUtils {
+
+    /**
+     * 只显示前三位和后四位，其余显示为‘*’：
+     * @param idCard
+     * @return
+     */
+    public static String desensitizeIdCard(String idCard) {
+        if (idCard == null || idCard.length() != 18) {
+            return idCard; // 或者返回其他错误提示
+        }
+        return idCard.substring(0, 3) + "***********" + idCard.substring(14);
+    }
+}

hcp-platform/src/main/java/com/yingyangfly/platform/sys/job/controller/SysJobController.java

@@ -2,9 +2,11 @@ package com.yingyangfly.platform.sys.job.controller;
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.yingyangfly.common.dto.ResultResponse;
 import com.yingyangfly.common.log.annotation.TraceLog;
+import com.yingyangfly.core.util.Constants;
 import com.yingyangfly.platform.sys.job.domain.SysJob;
 import com.yingyangfly.platform.sys.job.service.SysJobService;
 import com.yingyangfly.platform.sys.job.util.CronUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -51,6 +53,12 @@ public class SysJobController {
     public ResultResponse add(@RequestBody SysJob job) throws Exception {
         if (!CronUtils.isValid(job.getCronExpression())) {
             return  ResultResponse.fail("新增任务'" + job.getJobName() + "'失败，Cron表达式不正确");
+        }else if (StringUtils.containsIgnoreCase(job.getInvokeTarget(), Constants.LOOKUP_RMI)){
+            return  ResultResponse.fail("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'rmi'调用");
+        } else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.LOOKUP_LDAP, Constants.LOOKUP_LDAPS })) {
+            return ResultResponse.fail("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'ldap(s)'调用");
+        } else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), new String[] { Constants.HTTP, Constants.HTTPS })){
+            return  ResultResponse.fail("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)'调用");
         }
         return ResultResponse.success(jobService.insertJob(job));
     }