renkang/xj-platform
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 防止HTML注入(用户姓名中的 · )，对用户输入姓名进行转义处理

Browse Source 
- 在AccountDTO中对doctorName字段进行HTML转义处理
- 在ConDoctorDTO中对doctorName字段进行HTML转义处理
- 在ConEvaluateDTO中对userName和expertName字段进行HTML转义处理
- 在ConHealthInfoAnswerDTO中对fromName字段进行HTML转义处理
- 在ConHelperDTO中对userName字段进行HTML转义处理
- 在ConSessionDTO中对fromName和doctorName字段进行HTML转义处理
- 在CallLogDTO中对realName字段进行HTML转义处理
- 在PhoneListDTO中对realName字段进行HTML转义处理
- 在TblQimoNoticeDTO中对realName字段进行HTML转义处理
- 在EmergencyProfessionUserController中对name参数进行HTML转义处理
- 在OrderServiceImpl中对salvageUserName字段进行HTML转义处理
- 在AbnormalEventFilter中对userName字段进行HTML转义处理
- 在CalorieDataByUserDTO中对realName字段进行HTML转义处理
- 在WatchBindHisServiceImpl中对bindRealName字段进行HTML转义处理
- 在WatchDataServiceImpl中对username字段进行HTML转义处理
- 在WatchDeviceServiceImpl中对bindRealName字段进行HTML转义处理
- 在HealthUserEmployeeExController中对realname字段进行HTML转义处理
- 在SysUserController中对realname字段进行HTML转义处理
- 在SysUserDepartChangeApplyController中对userName参数进行HTML转义处理
- 在SelectWrapperDTO中对realName字段进行HTML转义处理
- 在SysBaseApiImpl中对username参数进行HTML转义处理
- 在SysUserServiceImpl中对name参数进行HTML转义处理
This commit is contained in:
hejiayang
2026-03-30 17:54:36 +08:00
parent 690f688c6a
commit a47f27967e
23 changed files with 100 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
health-watch/health-watch-api/src/main/java/com/renkang/watch/bean/request/AbnormalEventFilter.java
+4
View File
@@ -1,5 +1,6 @@
package com.renkang.watch.bean.request;
import cn.hutool.http.HtmlUtil;
import com.fasterxml.jackson.annotation.JsonFormat;
import lombok.Data;
import org.springframework.format.annotation.DateTimeFormat;
@@ -19,6 +20,9 @@ public class AbnormalEventFilter {
private String departOrgCode;
// 用户名称
private String userName;
public void setUserName(String userName) {
this.userName = userName != null ? HtmlUtil.unescape(userName) : null;
}
// 工具编码
private String watchNo;
//员工编号
health-watch/health-watch-api/src/main/java/com/renkang/watch/dto/CalorieDataByUserDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.watch.dto;
import cn.hutool.http.HtmlUtil;
import com.fasterxml.jackson.annotation.JsonFormat;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -18,6 +19,10 @@ public class CalorieDataByUserDTO {
private Integer pageSize = 10;
@Schema(title = "用户姓名")
private String realName;
public void setRealName(String realName) {
this.realName = realName != null ? HtmlUtil.unescape(realName) : null;
}
@Schema(title = "工号")
private String workNo;
@Schema(title = "用户id组")
health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchBindHisServiceImpl.java
+3
View File
@@ -3,6 +3,7 @@ package com.renkang.watch.service.impl;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
@@ -87,6 +88,7 @@ public class WatchBindHisServiceImpl extends ServiceImpl<WatchBindHisMapper, Wat
@Override
public IPage<WatchBindHisVo> queryPageList(IPage<WatchBindHisVo> page, WatchBindHisDTO dto) {
if (StringUtils.hasLength(dto.getBindRealName())) {
dto.setBindRealName(HtmlUtil.unescape(dto.getBindRealName()));
List<String> userIdsByDepartAndUsername = watchCloudManager.getUserIdsByDepartAndUsername("", dto.getBindRealName(), "", "");
if (CollectionUtil.isEmpty(userIdsByDepartAndUsername)) {
return new Page<>();
@@ -372,6 +374,7 @@ public class WatchBindHisServiceImpl extends ServiceImpl<WatchBindHisMapper, Wat
String orgCode = StrUtil.isNotBlank(dto.getThirdDepart())?dto.getThirdDepart() : dto.getSecondDepart();
List<String> userIds = new ArrayList<>();
if (StrUtil.isNotBlank(dto.getBindRealName())) {
dto.setBindRealName(HtmlUtil.unescape(dto.getBindRealName()));
userIds = watchCloudManager.getUserIdsByDepartAndUsername("", dto.getBindRealName(), "", "");
if (CollectionUtil.isEmpty(userIds)) {
return new Page<>();
health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchDataServiceImpl.java
+4
View File
@@ -7,6 +7,7 @@ import cn.hutool.core.date.DateUtil;
import cn.hutool.core.util.ObjUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -104,6 +105,9 @@ public class WatchDataServiceImpl extends ServiceImpl<WatchDataMapper, WatchData
}
String sql = QueryGenerator.installAuthJdbc(WatchData.class);
if(StrUtil.isNotBlank(watchData.getUsername())){
watchData.setUsername(HtmlUtil.unescape(watchData.getUsername()));
}
IPage<WatchData> pageList = watchDataMapper.pageCustom(page, watchData, sql);
if (CollectionUtil.isNotEmpty(pageList.getRecords())) {
List<LoginUserNew> loginUserNews = null;
health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchDeviceServiceImpl.java
+4
View File
@@ -7,6 +7,7 @@ import cn.hutool.core.date.DateUnit;
import cn.hutool.core.util.ObjUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.alibaba.fastjson.JSONObject;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
@@ -167,6 +168,9 @@ public class WatchDeviceServiceImpl extends ServiceImpl<WatchDeviceMapper, Watch
@Override
public IPage<WatchDeviceVo> queryPageList(IPage<WatchDeviceVo> page, WatchDeviceDTO dto) {
if (StrUtil.isNotBlank(dto.getBindRealName()) || StrUtil.isNotBlank(dto.getWorkNo())) {
if(StrUtil.isNotBlank(dto.getBindRealName())){
dto.setBindRealName(HtmlUtil.unescape(dto.getBindRealName()));
}
List<String> userIds = watchCloudManager.getUserIdsByDepartAndUsername("", dto.getBindRealName(), "", dto.getWorkNo());
if (CollectionUtil.isEmpty(userIds)) {
return new Page<>();