renkang/xj-platform
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 防止HTML注入(用户姓名中的 · )，对用户输入姓名进行转义处理

Browse Source 
- 在AccountDTO中对doctorName字段进行HTML转义处理
- 在ConDoctorDTO中对doctorName字段进行HTML转义处理
- 在ConEvaluateDTO中对userName和expertName字段进行HTML转义处理
- 在ConHealthInfoAnswerDTO中对fromName字段进行HTML转义处理
- 在ConHelperDTO中对userName字段进行HTML转义处理
- 在ConSessionDTO中对fromName和doctorName字段进行HTML转义处理
- 在CallLogDTO中对realName字段进行HTML转义处理
- 在PhoneListDTO中对realName字段进行HTML转义处理
- 在TblQimoNoticeDTO中对realName字段进行HTML转义处理
- 在EmergencyProfessionUserController中对name参数进行HTML转义处理
- 在OrderServiceImpl中对salvageUserName字段进行HTML转义处理
- 在AbnormalEventFilter中对userName字段进行HTML转义处理
- 在CalorieDataByUserDTO中对realName字段进行HTML转义处理
- 在WatchBindHisServiceImpl中对bindRealName字段进行HTML转义处理
- 在WatchDataServiceImpl中对username字段进行HTML转义处理
- 在WatchDeviceServiceImpl中对bindRealName字段进行HTML转义处理
- 在HealthUserEmployeeExController中对realname字段进行HTML转义处理
- 在SysUserController中对realname字段进行HTML转义处理
- 在SysUserDepartChangeApplyController中对userName参数进行HTML转义处理
- 在SelectWrapperDTO中对realName字段进行HTML转义处理
- 在SysBaseApiImpl中对username参数进行HTML转义处理
- 在SysUserServiceImpl中对name参数进行HTML转义处理
This commit is contained in:
hejiayang
2026-03-30 17:54:36 +08:00
parent 690f688c6a
commit a47f27967e
23 changed files with 100 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/HealthUserEmployeeExController.java
+2
View File
@@ -2,6 +2,7 @@ package org.jeecg.modules.system.controller;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.google.common.collect.Maps;
@@ -124,6 +125,7 @@ public class HealthUserEmployeeExController extends JeecgController<HealthUserEm
HttpServletRequest req) {
Page<UserEmployee> page = new Page<>(pageNo, pageSize);
userFilter.setRealname(HtmlUtil.unescape(userFilter.getRealname()));
IPage<UserEmployee> pageList = healthUserEmployeeExService.selectHealthUserEmployeeExList(page, userFilter, idStatus);
return Result.OK(pageList);
}
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java
+4
View File
@@ -2,6 +2,7 @@ package org.jeecg.modules.system.controller;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
@@ -460,6 +461,9 @@ public class SysUserController {
@RequestMapping(value = "/listAll", method = RequestMethod.GET)
public Result<IPage<SysUser>> queryAllPageList(SysUser user, @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize, HttpServletRequest req) {
if(StrUtil.isNotBlank(user.getRealname())){
user.setRealname(HtmlUtil.unescape(user.getRealname()));
}
QueryWrapper<SysUser> queryWrapper = QueryGenerator.initQueryWrapper(user, req.getParameterMap());
return sysUserService.queryPageList(req, queryWrapper, pageSize, pageNo);
}
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserDepartChangeApplyController.java
+5
View File
@@ -1,6 +1,8 @@
package org.jeecg.modules.system.controller;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -77,6 +79,9 @@ public class SysUserDepartChangeApplyController extends JeecgController<SysUserD
@RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize) {
Page<ChangeDepartVo> page = new Page<>(pageNo, pageSize);
if(StrUtil.isNotBlank(userName)){
userName = HtmlUtil.unescape(userName);
}
IPage<ChangeDepartVo> pageList = sysUserDepartChangeApplyService.pageCustom(page, userName, status,workNo, userId);
return Result.OK(pageList);
}
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/entity/SelectWrapperDTO.java
+5
View File
@@ -1,5 +1,6 @@
package org.jeecg.modules.system.entity;
import cn.hutool.http.HtmlUtil;
import lombok.Data;
/**
@@ -11,6 +12,10 @@ import lombok.Data;
public class SelectWrapperDTO {
private String orgCode;
private String realName;
public void setRealName(String realName) {
this.realName = realName != null ? HtmlUtil.unescape(realName) : null;
}
private String workNo;
private String sex;
private String code;
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysBaseApiImpl.java
+4
View File
@@ -8,6 +8,7 @@ import cn.hutool.core.date.DateUtil;
import cn.hutool.core.util.IdcardUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
@@ -262,6 +263,9 @@ public class SysBaseApiImpl implements ISysBaseAPI {
@Override
public List<String> getUserIdsByDepartAndUsername(String departCode, String username, String idCard, String workNo) {
if(StrUtil.isNotBlank(username)){
username = HtmlUtil.unescape(username);
}
if (StrUtil.isAllBlank(departCode, username, idCard, workNo)) {
return Collections.emptyList();
}
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysUserServiceImpl.java
+2
View File
@@ -6,6 +6,7 @@ import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.io.FileUtil;
import cn.hutool.core.util.*;
import cn.hutool.extra.pinyin.PinyinUtil;
import cn.hutool.http.HtmlUtil;
import com.alibaba.csp.sentinel.util.StringUtil;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
@@ -2875,6 +2876,7 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
queryWrapper.eq(SysUser::getStatus, 1);
queryWrapper.eq(SysUser::getPersonType, 1);
if (StrUtil.isNotEmpty(name)) {
name = HtmlUtil.unescape(name);
queryWrapper.like(SysUser::getRealname, name);
}
if (StrUtil.isNotEmpty(orgCode)) {