code-image-backup-public/fastbee
1
0
Fork 0
mirror of https://gitee.com/beecue/fastbee.git synced 2026-11-06 17:09:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(规则脚本): 规则引擎 Groovy 脚本注入导致远程代码执行漏洞修复

Browse Source
This commit is contained in:
gx_ma
2026-10-01 03:05:41 +08:00
parent 284b714c1e
commit 890a338460
56 changed files with 2124 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
springboot/fastbee-framework/src/main/java/com/fastbee/framework/security/filter/JwtAuthenticationTokenFilter.java
View File

@@ -32,6 +32,18 @@ public class JwtAuthenticationTokenFilter extends OncePerRequestFilter
throws ServletException, IOException
{
LoginUser loginUser = tokenService.getLoginUser(request);
if (loginUser != null) {
Boolean previousPasswordState = loginUser.getNeedChangePwd();
boolean required = com.fastbee.common.utils.PasswordPolicy.requiresChange(loginUser);
if (!java.util.Objects.equals(previousPasswordState, loginUser.getNeedChangePwd())) tokenService.setLoginUser(loginUser);
if (required && !com.fastbee.common.utils.PasswordPolicy.allowedWhileChanging(
request.getMethod(), request.getServletPath())) {
response.setStatus(HttpServletResponse.SC_FORBIDDEN);
response.setContentType("application/json;charset=UTF-8");
response.getWriter().write("{\"code\":403,\"needChangePwd\":true,\"msg\":\"请先修改出厂默认密码\"}");
return;
}
}
if (StringUtils.isNotNull(loginUser) && StringUtils.isNull(SecurityUtils.getAuthentication()))
{
tokenService.verifyToken(loginUser);

35
springboot/fastbee-framework/src/main/java/com/fastbee/framework/web/service/SysLoginService.java
View File

@@ -18,6 +18,8 @@ import com.fastbee.framework.manager.factory.AsyncFactory;
import com.fastbee.framework.security.context.AuthenticationContextHolder;
import com.fastbee.system.service.ISysConfigService;
import com.fastbee.system.service.ISysUserService;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
@@ -27,6 +29,10 @@ import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import javax.annotation.Resource;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.Set;
/**
* 登录校验方法
@@ -36,6 +42,17 @@ import javax.annotation.Resource;
@Component
public class SysLoginService
{
private static final Logger log = LoggerFactory.getLogger(SysLoginService.class);
/**
* 出厂默认口令。命中的账号视为未改密。
*
* <p>默认口令是规则引擎脚本注入类漏洞的前置条件：脚本编辑权限只有管理员角色持有，
* 而 admin/admin123 是开源仓库公开的默认值，攻击者无需任何凭据即可拿到管理员会话。</p>
*/
private static final Set<String> DEFAULT_PASSWORDS = Collections.unmodifiableSet(
new HashSet<>(Arrays.asList("admin123", "123456")));
@Autowired
private TokenService tokenService;
@@ -102,10 +119,28 @@ public class SysLoginService
LoginUser loginUser = (LoginUser) authentication.getPrincipal();
loginUser.setLanguage(language);
recordLoginInfo(loginUser.getUserId());
warnIfDefaultPassword(loginUser, password);
// 生成token
return tokenService.createToken(loginUser);
}
/**
* 判断登录使用的口令是否为出厂默认口令
*/
public boolean isDefaultPassword(String rawPassword)
{
return rawPassword != null && DEFAULT_PASSWORDS.contains(rawPassword);
}
private void warnIfDefaultPassword(LoginUser loginUser, String rawPassword)
{
if (!isDefaultPassword(rawPassword) || com.fastbee.common.utils.PasswordPolicy.isDemoAccount(loginUser))
{
return;
}
log.warn("账号 {} 使用出厂默认口令，当前会话仅允许完成改密和退出，请立即更换。", loginUser.getUsername());
}
/**
* 第三方验证后，调用登录方法
* @param username 用户名

2
springboot/fastbee-framework/src/main/java/com/fastbee/framework/web/service/TokenService.java
View File

@@ -152,6 +152,7 @@ public class TokenService {
* @return 令牌
*/
public String createToken(LoginUser loginUser) {
com.fastbee.common.utils.PasswordPolicy.requiresChange(loginUser);
String token = IdUtils.fastUUID();
loginUser.setToken(token);
setUserAgent(loginUser);
@@ -198,6 +199,7 @@ public class TokenService {
}
public String createToken(LoginUser loginUser, String secret, int expireTime) {
com.fastbee.common.utils.PasswordPolicy.requiresChange(loginUser);
String token = IdUtils.fastUUID();
loginUser.setToken(token);
setUserAgent(loginUser);