code-image-backup-public/lilishop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

同步 master

Browse Source
This commit is contained in:
lifenlong
2021-06-07 10:02:23 +08:00
parent 431f7c014f 7e8ba50970
commit 4849e7d57e
88 changed files with 182 additions and 422 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
framework/src/main/java/cn/lili/base/mybatisplus/MybatisPlusConfig.java
View File

@@ -1,10 +1,15 @@
package cn.lili.base.mybatisplus;
import com.baomidou.mybatisplus.core.parser.ISqlParser;
import com.baomidou.mybatisplus.extension.parsers.BlockAttackSqlParser;
import com.baomidou.mybatisplus.extension.plugins.PaginationInterceptor;
import org.mybatis.spring.annotation.MapperScan;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.ArrayList;
import java.util.List;
/**
* @author Chopper
*/
@@ -16,6 +21,12 @@ public class MybatisPlusConfig {
*/
@Bean
public PaginationInterceptor paginationInterceptor() {
return new PaginationInterceptor();
PaginationInterceptor paginationInterceptor = new PaginationInterceptor();
List<ISqlParser> sqlParserList = new ArrayList<>();
// 攻击 SQL 阻断解析器、加入解析链
sqlParserList.add(new BlockAttackSqlParser());
paginationInterceptor.setSqlParserList(sqlParserList);
return paginationInterceptor;
}
}

46
framework/src/main/java/cn/lili/common/security/filter/XssAndSqlHttpServletRequestWrapper.java Normal file
View File

@@ -0,0 +1,46 @@
package cn.lili.common.security.filter;
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.text.StringEscapeUtils;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
/**
* 防止Xss sql注入
*
* @author Chopper
* @version v1.0
* 2021-06-04 10:39
*/
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {
private HttpServletRequest request;
public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
this.request = request;
}
@Override
public String getParameter(String name) {
String value = request.getParameter(name);
if (!StringUtils.isEmpty(value)) {
value = StringEscapeUtils.escapeHtml4(value);
}
return value;
}
@Override
public String[] getParameterValues(String name) {
String[] parameterValues = super.getParameterValues(name);
if (parameterValues == null) {
return null;
}
for (int i = 0; i < parameterValues.length; i++) {
String value = parameterValues[i];
parameterValues[i] = StringEscapeUtils.escapeHtml4(value);
}
return parameterValues;
}
}

60
framework/src/main/java/cn/lili/common/security/filter/XssFilter.java Normal file
View File

@@ -0,0 +1,60 @@
package cn.lili.common.security.filter;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.module.SimpleModule;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Primary;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
import org.springframework.stereotype.Component;
import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
/**
* 防止XSS攻击过滤器
*
* @author Chopper
* @version v1.0
* 2021-06-04 10:37
*/
@WebFilter
@Component
public class XssFilter implements Filter {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
XssAndSqlHttpServletRequestWrapper xssRequestWrapper = new XssAndSqlHttpServletRequestWrapper(req);
chain.doFilter(xssRequestWrapper, response);
}
@Override
public void destroy() {
}
/**
* 过滤json类型的
*
* @param builder
* @return
*/
@Bean
@Primary
public ObjectMapper xssObjectMapper(Jackson2ObjectMapperBuilder builder) {
//解析器
ObjectMapper objectMapper = builder.createXmlMapper(false).build();
//注册xss解析器
SimpleModule xssModule = new SimpleModule("XssStringJsonSerializer");
xssModule.addSerializer(new XssStringJsonSerializer());
objectMapper.registerModule(xssModule);
//返回
return objectMapper;
}
}

32
framework/src/main/java/cn/lili/common/security/filter/XssStringJsonSerializer.java Normal file
View File

@@ -0,0 +1,32 @@
package cn.lili.common.security.filter;
import com.fasterxml.jackson.core.JsonGenerator;
import com.fasterxml.jackson.databind.JsonSerializer;
import com.fasterxml.jackson.databind.SerializerProvider;
import org.apache.commons.text.StringEscapeUtils;
import java.io.IOException;
/**
* 防止xss攻击 过滤字符串解析
*
* @author Chopper
* @version v1.0
* 2021-06-04 10:40
*/
public class XssStringJsonSerializer extends JsonSerializer<String> {
@Override
public Class<String> handledType() {
return String.class;
}
@Override
public void serialize(String value, JsonGenerator jsonGenerator,
SerializerProvider serializerProvider) throws IOException {
if (value != null) {
String encodedValue = StringEscapeUtils.escapeHtml4(value);
jsonGenerator.writeString(encodedValue);
}
}
}

10
framework/src/main/java/cn/lili/modules/goods/mapper/SpecificationMapper.java
View File

@@ -3,10 +3,13 @@ package cn.lili.modules.goods.mapper;
import cn.lili.modules.goods.entity.dos.Specification;
import cn.lili.modules.goods.entity.vos.SpecificationVO;
import com.baomidou.mybatisplus.core.conditions.Wrapper;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.baomidou.mybatisplus.core.toolkit.Constants;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;
import java.util.List;
import java.util.Map;
/**
* 规格数据处理层
@@ -18,8 +21,9 @@ public interface SpecificationMapper extends BaseMapper<Specification> {
/**
* 查询规格信息列表
* @param param
* @return
*/
List<SpecificationVO> findSpecList(Map<String,Object> param);
@Select("SELECT s.id, s.spec_name,s.create_time ,GROUP_CONCAT(sv.spec_value SEPARATOR ',') AS spec_value" +
" FROM li_specification s LEFT JOIN li_spec_values sv ON s.id = sv.spec_id ${ew.customSqlSegment} ")
List<SpecificationVO> findSpecList(@Param(Constants.WRAPPER) Wrapper queryWrapper);
}

5
framework/src/main/java/cn/lili/modules/goods/service/SpecificationService.java
View File

@@ -10,7 +10,6 @@ import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.service.IService;
import java.util.List;
import java.util.Map;
/**
* 规格业务层
@@ -23,10 +22,10 @@ public interface SpecificationService extends IService<Specification> {
/**
* 查询规格信息列表
*
* @param param 查询参数
* @param specName 规格名
* @return 规格列表
*/
List<SpecificationVO> getSpecList(Map<String, Object> param);
List<SpecificationVO> getSpecList(String specName);
/**
* 根据分类id获取规格信息

15
framework/src/main/java/cn/lili/modules/goods/serviceimpl/SpecificationServiceImpl.java
View File

@@ -5,6 +5,7 @@ import cn.hutool.core.util.StrUtil;
import cn.lili.common.enums.ResultCode;
import cn.lili.common.exception.ServiceException;
import cn.lili.common.utils.PageUtil;
import cn.lili.common.utils.StringUtils;
import cn.lili.common.vo.PageVO;
import cn.lili.modules.goods.entity.dos.CategorySpecification;
import cn.lili.modules.goods.entity.dos.SpecValues;
@@ -49,8 +50,13 @@ public class SpecificationServiceImpl extends ServiceImpl<SpecificationMapper, S
private SpecValuesService specValuesService;
@Override
public List<SpecificationVO> getSpecList(Map<String, Object> param) {
return this.baseMapper.findSpecList(param);
public List<SpecificationVO> getSpecList(String specName) {
QueryWrapper queryWrapper = new QueryWrapper();
queryWrapper.eq(StringUtils.isNotEmpty(specName), "s.spec_name", specName);
queryWrapper.orderByDesc("s.create_time");
queryWrapper.groupBy("s.id");
return this.baseMapper.findSpecList(queryWrapper);
}
@Override
@@ -96,9 +102,8 @@ public class SpecificationServiceImpl extends ServiceImpl<SpecificationMapper, S
@Override
public IPage<SpecificationVO> getSpecificationPage(SpecificationSearchParams searchParams, PageVO pageVo) {
Map<String, Object> param = new HashMap<>();
param.put("specName", searchParams.getSpecName());
List<SpecificationVO> specList = this.getSpecList(param);
List<SpecificationVO> specList = this.getSpecList(searchParams.getSpecName());
IPage<SpecificationVO> page = new Page<>(pageVo.getPageNumber(), pageVo.getPageSize(), specList.size());
page.setRecords(PageUtil.listToPage(pageVo, specList));
return page;

1
framework/src/main/java/cn/lili/modules/page/serviceimpl/PageDataServiceImpl.java
View File

@@ -72,7 +72,6 @@ public class PageDataServiceImpl extends ServiceImpl<PageDataMapper, PageData> i
lambdaUpdateWrapper.set(PageData::getPageShow, SwitchEnum.CLOSE.name());
this.update(lambdaUpdateWrapper);
}
LambdaUpdateWrapper<PageData> lambdaUpdateWrapper = Wrappers.lambdaUpdate();
lambdaUpdateWrapper.set(PageData::getPageData, pageData.getPageData());
lambdaUpdateWrapper.eq(PageData::getId, pageData.getId());