fix(规则脚本): 规则引擎 Groovy 脚本注入导致远程代码执行漏洞修复

springboot/fastbee-common/src/main/java/com/fastbee/common/core/domain/model/LoginUser.java

@@ -80,6 +80,11 @@ public class LoginUser implements UserDetails {
 
     private Boolean neverExpire = Boolean.FALSE;
 
+    // Nullable for sessions created before this upgrade. The server migrates them.
+    private Boolean needChangePwd;
+    public Boolean getNeedChangePwd() { return needChangePwd; }
+    public void setNeedChangePwd(Boolean value) { needChangePwd = value; }
+
     public LoginUser() {
     }
 

springboot/fastbee-common/src/main/java/com/fastbee/common/core/domain/model/MqttClientPrincipal.java

@@ -0,0 +1,60 @@
+package com.fastbee.common.core.domain.model;
+
+import lombok.Data;
+
+import java.io.Serializable;
+
+/**
+ * MQTT 客户端认证主体。
+ *
+ * <p>认证阶段只校验凭据是否合法，这里额外记录"这条连接代表谁"，供 PUBLISH 阶段做 topic 归属校验。
+ * web / phone 客户端使用平台登录 JWT 作为 MQTT 密码，若不绑定用户身份，任意一个登录用户都能向
+ * 任意设备的 topic 发布消息，进而触发该产品的规则脚本执行。</p>
+ *
+ * @author fastbee security
+ */
+@Data
+public class MqttClientPrincipal implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    public enum ClientType {
+        /** 平台内部服务端，配置账号密码认证 */
+        SERVER,
+        /** Web 端 / 移动端，登录 JWT 认证 */
+        WEB,
+        /** 设备端，一机一密认证 */
+        DEVICE
+    }
+
+    private String clientId;
+
+    private ClientType clientType;
+
+    /** WEB 类型时对应的平台用户id，其余类型为 null */
+    private Long userId;
+
+    /** 是否为超级管理员，管理员不受设备归属限制 */
+    private boolean admin;
+
+    /** Redis login identifier, never the raw JWT or password. */
+    private String sessionId;
+
+    public static MqttClientPrincipal of(String clientId, ClientType clientType) {
+        MqttClientPrincipal principal = new MqttClientPrincipal();
+        principal.setClientId(clientId);
+        principal.setClientType(clientType);
+        return principal;
+    }
+
+    public static MqttClientPrincipal ofWeb(String clientId, Long userId, boolean admin) {
+        MqttClientPrincipal principal = of(clientId, ClientType.WEB);
+        principal.setUserId(userId);
+        principal.setAdmin(admin);
+        return principal;
+    }
+
+    public boolean isWeb() {
+        return clientType == ClientType.WEB;
+    }
+}

springboot/fastbee-common/src/main/java/com/fastbee/common/utils/PasswordPolicy.java

@@ -0,0 +1,33 @@
+package com.fastbee.common.utils;
+
+import com.fastbee.common.core.domain.model.LoginUser;
+
+/** Server-owned password-change state, also applied to pre-upgrade sessions. */
+public final class PasswordPolicy {
+    private PasswordPolicy() {}
+    public static boolean isDefault(String raw) { return "admin123".equals(raw) || "123456".equals(raw); }
+    /** The explicitly designated demo account only; never exempt the built-in administrator. */
+    public static boolean isDemoAccount(LoginUser login) {
+        return login != null && login.getUser() != null && !login.getUser().isAdmin()
+                && "fastbee".equals(login.getUser().getUserName());
+    }
+    public static boolean requiresChange(LoginUser login) {
+        if (login == null || login.getUser() == null) return true;
+        if (isDemoAccount(login)) {
+            // Also migrate a demo session cached before this exception was introduced.
+            login.setNeedChangePwd(false);
+            return false;
+        }
+        if (login.getNeedChangePwd() == null) {
+            String hash = login.getUser().getPassword();
+            login.setNeedChangePwd(hash == null || SecurityUtils.matchesPassword("admin123", hash)
+                    || SecurityUtils.matchesPassword("123456", hash));
+        }
+        return Boolean.TRUE.equals(login.getNeedChangePwd());
+    }
+    public static boolean allowedWhileChanging(String method, String path) {
+        return "GET".equals(method) && ("/getInfo".equals(path) || "/getRouters".equals(path) || "/system/user/profile".equals(path))
+                || "PUT".equals(method) && "/system/user/profile/updatePwd".equals(path)
+                || "POST".equals(method) && "/logout".equals(path);
+    }
+}