renkang/xj-platform
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 解决HTML转义安全问题

Browse Source 
- 在多个DTO类中添加HtmlUtil导入并实现自动转义功能
- 为AccountDTO、ConDoctorDTO等类的set方法增加HTML转义处理
- 修复ConDoctorServiceImpl中的重复转义代码
- 为EmergencyProfessionUserController添加请求参数转义
- 修复OrderServiceImpl中的用户名称转义处理
- 为Watch相关服务增加数据绑定和查询时的转义处理
- 修复SysUser相关控制器和服务中的转义逻辑
This commit is contained in:
hejiayang
2026-03-30 17:39:21 +08:00
parent f273609f95
commit a7cafe9d7f
23 changed files with 100 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
health-consultation/health-consultation-api/src/main/java/com/renkang/consultation/dto/AccountDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.consultation.dto;
import cn.hutool.http.HtmlUtil;
import com.renkang.consultation.entity.ConPage;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -11,6 +12,10 @@ public class AccountDTO extends ConPage {
@Schema(title = "专家姓名")
private String doctorName;
public void setDoctorName(String doctorName) {
this.doctorName = doctorName != null ? HtmlUtil.unescape(doctorName) : null;
}
@Schema(title = "医院选择")
private String hospitalName;
health-consultation/health-consultation-api/src/main/java/com/renkang/consultation/dto/ConDoctorDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.consultation.dto;
import cn.hutool.http.HtmlUtil;
import com.renkang.consultation.entity.ConPage;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -10,6 +11,10 @@ public class ConDoctorDTO extends ConPage {
@Schema(title = "专家姓名")
private String doctorName;
public void setDoctorName(String doctorName) {
this.doctorName = doctorName != null ? HtmlUtil.unescape(doctorName) : null;
}
@Schema(title = "专家编号")
private String doctorNo;
health-consultation/health-consultation-api/src/main/java/com/renkang/consultation/dto/ConEvaluateDTO.java
+8
View File
@@ -1,5 +1,6 @@
package com.renkang.consultation.dto;
import cn.hutool.http.HtmlUtil;
import com.fasterxml.jackson.annotation.JsonFormat;
import com.renkang.consultation.entity.ConPage;
import io.swagger.v3.oas.annotations.media.Schema;
@@ -17,6 +18,9 @@ public class ConEvaluateDTO extends ConPage {
@Schema(title = "咨询人")
private String userName;
public void setUserName(String userName) {
this.userName = userName != null ? HtmlUtil.unescape(userName) : null;
}
@Schema(title = "二级单位id")
private String sysOrgSecondId;
@@ -27,6 +31,10 @@ public class ConEvaluateDTO extends ConPage {
@Schema(title = "咨询专家")
private String expertName;
public void setExpertName(String expertName) {
this.expertName = expertName != null ? HtmlUtil.unescape(expertName) : null;
}
@Schema(title = "专家医院")
private String expertHospital;
health-consultation/health-consultation-api/src/main/java/com/renkang/consultation/dto/ConHealthInfoAnswerDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.consultation.dto;
import cn.hutool.http.HtmlUtil;
import com.renkang.consultation.entity.ConPage;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -10,6 +11,10 @@ public class ConHealthInfoAnswerDTO extends ConPage {
@Schema(title = "员工姓名")
private String fromName;
public void setFromName(String fromName) {
this.fromName = fromName != null ? HtmlUtil.unescape(fromName) : null;
}
@Schema(title = "手机号")
private String phone;
health-consultation/health-consultation-api/src/main/java/com/renkang/consultation/dto/ConHelperDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.consultation.dto;
import cn.hutool.http.HtmlUtil;
import com.renkang.consultation.entity.ConPage;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -11,6 +12,10 @@ public class ConHelperDTO extends ConPage {
@Schema(title = "全科医生姓名")
private String userName;
public void setUserName(String userName) {
this.userName = userName != null ? HtmlUtil.unescape(userName) : null;
}
@Schema(title = "状态")
private Integer status;
health-consultation/health-consultation-api/src/main/java/com/renkang/consultation/dto/ConSessionDTO.java
+9
View File
@@ -1,5 +1,6 @@
package com.renkang.consultation.dto;
import cn.hutool.http.HtmlUtil;
import com.fasterxml.jackson.annotation.JsonFormat;
import com.renkang.consultation.entity.ConPage;
import io.swagger.v3.oas.annotations.media.Schema;
@@ -17,6 +18,10 @@ public class ConSessionDTO extends ConPage {
@Schema(title = "员工姓名")
private String fromName;
public void setFromName(String fromName) {
this.fromName = fromName != null ? HtmlUtil.unescape(fromName) : null;
}
@Schema(title = "员工id")
private String fromAccount;
@@ -26,6 +31,10 @@ public class ConSessionDTO extends ConPage {
@Schema(title = "专家姓名")
private String doctorName;
public void setDoctorName(String doctorName) {
this.doctorName = doctorName != null ? HtmlUtil.unescape(doctorName) : null;
}
@Schema(title = "咨询状态(0待确认 1接收预约 2拒绝预约 3已过期 4已取消 5咨询中 6专家咨询结束 7员工咨询结束 8超时自动结束)")
private String contentStatus;
health-consultation/health-consultation-biz/src/main/java/com/renkang/consultation/service/impl/ConDoctorServiceImpl.java
-4
View File
@@ -3,7 +3,6 @@ package com.renkang.consultation.service.impl;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -249,9 +248,6 @@ public class ConDoctorServiceImpl extends ServiceImpl<ConDoctorMapper, ConDoctor
if (StringUtils.hasLength(dto.getHospitalName())) {
conDoctor.setResourceId(dto.getHospitalName());
}
if (StrUtil.isNotEmpty(dto.getDoctorName())){
conDoctor.setDoctorName(HtmlUtil.unescape(dto.getDoctorName()));
}
IPage<ConDoctor> conDoctorIPage = conDoctorMapper.queryPageList(page, conDoctor);
List<ConDoctor> conDoctorList = conDoctorIPage.getRecords();
if (CollectionUtils.isEmpty(conDoctorList)) {
health-emergency/health-emergency-api/src/main/java/com/renkang/emergency/entity/dto/CallLogDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.emergency.entity.dto;
import cn.hutool.http.HtmlUtil;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -7,6 +8,10 @@ import lombok.Data;
public class CallLogDTO {
@Schema(description = "姓名")
private String realName;
public void setRealName(String realName) {
this.realName = realName != null ? HtmlUtil.unescape(realName) : null;
}
@Schema(description = "呼叫中心")
private String centerId;
@Schema(description = "坐席工号")
health-emergency/health-emergency-api/src/main/java/com/renkang/emergency/entity/dto/PhoneListDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.emergency.entity.dto;
import cn.hutool.http.HtmlUtil;
import com.fasterxml.jackson.annotation.JsonFormat;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -21,6 +22,10 @@ public class PhoneListDTO {
private String phoneType;
@Schema(description = "姓名")
private String realName;
public void setRealName(String realName) {
this.realName = realName != null ? HtmlUtil.unescape(realName) : null;
}
/**
* 0:全部 1:女 2:男
*/
health-emergency/health-emergency-api/src/main/java/com/renkang/emergency/entity/dto/TblQimoNoticeDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.emergency.entity.dto;
import cn.hutool.http.HtmlUtil;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -9,6 +10,10 @@ public class TblQimoNoticeDTO {
private String seatId;
@Schema(title = "姓名")
private String realName;
public void setRealName(String realName) {
this.realName = realName != null ? HtmlUtil.unescape(realName) : null;
}
@Schema(title = "所属应急中心")
private String centerId;
@Schema(title = "orgCode")
health-emergency/health-emergency-biz/src/main/java/com/renkang/emergency/controller/EmergencyProfessionUserController.java
+2
View File
@@ -1,6 +1,7 @@
package com.renkang.emergency.controller;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.renkang.emergency.entity.EmergencyProfessionUser;
import com.renkang.emergency.service.EmergencyProfessionUserService;
@@ -40,6 +41,7 @@ public class EmergencyProfessionUserController {
@RequestParam(name = "type", defaultValue = "5") Integer type,
@RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize) {
name = HtmlUtil.unescape(name);
IPage<EmergencyProfessionUser> pageList = emergencyProfessionUserService.customPage(name, centerId, type, pageNo, pageSize);
return Result.OK(pageList);
}
health-emergency/health-emergency-biz/src/main/java/com/renkang/emergency/service/impl/OrderServiceImpl.java
+4
View File
@@ -6,6 +6,7 @@ import cn.hutool.core.date.DateUtil;
import cn.hutool.core.util.ObjUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -58,6 +59,9 @@ public class OrderServiceImpl extends ServiceImpl<OrderMapper, Order> implements
@Override
public IPage<Order> pageCustom(Page<Order> page, Order order, HttpServletRequest req) {
if(StrUtil.isNotBlank(order.getSalvageUserName())){
order.setSalvageUserName(HtmlUtil.unescape(order.getSalvageUserName()));
}
String salvageUserName = order.getSalvageUserName();
String initiatorUserName = order.getInitiatorUserName();
Order orderCopy = new Order();
health-watch/health-watch-api/src/main/java/com/renkang/watch/bean/request/AbnormalEventFilter.java
+4
View File
@@ -1,5 +1,6 @@
package com.renkang.watch.bean.request;
import cn.hutool.http.HtmlUtil;
import com.fasterxml.jackson.annotation.JsonFormat;
import lombok.Data;
import org.springframework.format.annotation.DateTimeFormat;
@@ -19,6 +20,9 @@ public class AbnormalEventFilter {
private String departOrgCode;
// 用户名称
private String userName;
public void setUserName(String userName) {
this.userName = userName != null ? HtmlUtil.unescape(userName) : null;
}
// 工具编码
private String watchNo;
//员工编号
health-watch/health-watch-api/src/main/java/com/renkang/watch/dto/CalorieDataByUserDTO.java
+5
View File
@@ -1,5 +1,6 @@
package com.renkang.watch.dto;
import cn.hutool.http.HtmlUtil;
import com.fasterxml.jackson.annotation.JsonFormat;
import io.swagger.v3.oas.annotations.media.Schema;
import lombok.Data;
@@ -18,6 +19,10 @@ public class CalorieDataByUserDTO {
private Integer pageSize = 10;
@Schema(title = "用户姓名")
private String realName;
public void setRealName(String realName) {
this.realName = realName != null ? HtmlUtil.unescape(realName) : null;
}
@Schema(title = "工号")
private String workNo;
@Schema(title = "用户id组")
health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchBindHisServiceImpl.java
+3
View File
@@ -3,6 +3,7 @@ package com.renkang.watch.service.impl;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
@@ -87,6 +88,7 @@ public class WatchBindHisServiceImpl extends ServiceImpl<WatchBindHisMapper, Wat
@Override
public IPage<WatchBindHisVo> queryPageList(IPage<WatchBindHisVo> page, WatchBindHisDTO dto) {
if (StringUtils.hasLength(dto.getBindRealName())) {
dto.setBindRealName(HtmlUtil.unescape(dto.getBindRealName()));
List<String> userIdsByDepartAndUsername = watchCloudManager.getUserIdsByDepartAndUsername("", dto.getBindRealName(), "", "");
if (CollectionUtil.isEmpty(userIdsByDepartAndUsername)) {
return new Page<>();
@@ -375,6 +377,7 @@ public class WatchBindHisServiceImpl extends ServiceImpl<WatchBindHisMapper, Wat
String orgCode = StrUtil.isNotBlank(dto.getThirdDepart())?dto.getThirdDepart() : dto.getSecondDepart();
List<String> userIds = new ArrayList<>();
if (StrUtil.isNotBlank(dto.getBindRealName())) {
dto.setBindRealName(HtmlUtil.unescape(dto.getBindRealName()));
userIds = watchCloudManager.getUserIdsByDepartAndUsername("", dto.getBindRealName(), "", "");
if (CollectionUtil.isEmpty(userIds)) {
return new Page<>();
health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchDataServiceImpl.java
+4
View File
@@ -7,6 +7,7 @@ import cn.hutool.core.date.DateUtil;
import cn.hutool.core.util.ObjUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -104,6 +105,9 @@ public class WatchDataServiceImpl extends ServiceImpl<WatchDataMapper, WatchData
}
String sql = QueryGenerator.installAuthJdbc(WatchData.class);
if(StrUtil.isNotBlank(watchData.getUsername())){
watchData.setUsername(HtmlUtil.unescape(watchData.getUsername()));
}
IPage<WatchData> pageList = watchDataMapper.pageCustom(page, watchData, sql);
if (CollectionUtil.isNotEmpty(pageList.getRecords())) {
List<LoginUserNew> loginUserNews = null;
health-watch/health-watch-biz/src/main/java/com/renkang/watch/service/impl/WatchDeviceServiceImpl.java
+4
View File
@@ -7,6 +7,7 @@ import cn.hutool.core.date.DateUnit;
import cn.hutool.core.util.ObjUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.alibaba.fastjson.JSONObject;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
@@ -166,6 +167,9 @@ public class WatchDeviceServiceImpl extends ServiceImpl<WatchDeviceMapper, Watch
@Override
public IPage<WatchDeviceVo> queryPageList(IPage<WatchDeviceVo> page, WatchDeviceDTO dto) {
if (StrUtil.isNotBlank(dto.getBindRealName()) || StrUtil.isNotBlank(dto.getWorkNo())) {
if(StrUtil.isNotBlank(dto.getBindRealName())){
dto.setBindRealName(HtmlUtil.unescape(dto.getBindRealName()));
}
List<String> userIds = watchCloudManager.getUserIdsByDepartAndUsername("", dto.getBindRealName(), "", dto.getWorkNo());
if (CollectionUtil.isEmpty(userIds)) {
return new Page<>();
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/HealthUserEmployeeExController.java
+2
View File
@@ -2,6 +2,7 @@ package org.jeecg.modules.system.controller;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.google.common.collect.Maps;
@@ -124,6 +125,7 @@ public class HealthUserEmployeeExController extends JeecgController<HealthUserEm
HttpServletRequest req) {
Page<UserEmployee> page = new Page<>(pageNo, pageSize);
userFilter.setRealname(HtmlUtil.unescape(userFilter.getRealname()));
IPage<UserEmployee> pageList = healthUserEmployeeExService.selectHealthUserEmployeeExList(page, userFilter, idStatus);
return Result.OK(pageList);
}
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserController.java
+4
View File
@@ -2,6 +2,7 @@ package org.jeecg.modules.system.controller;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
@@ -460,6 +461,9 @@ public class SysUserController {
@RequestMapping(value = "/listAll", method = RequestMethod.GET)
public Result<IPage<SysUser>> queryAllPageList(SysUser user, @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize, HttpServletRequest req) {
if(StrUtil.isNotBlank(user.getRealname())){
user.setRealname(HtmlUtil.unescape(user.getRealname()));
}
QueryWrapper<SysUser> queryWrapper = QueryGenerator.initQueryWrapper(user, req.getParameterMap());
return sysUserService.queryPageList(req, queryWrapper, pageSize, pageNo);
}
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserDepartChangeApplyController.java
+5
View File
@@ -1,6 +1,8 @@
package org.jeecg.modules.system.controller;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -77,6 +79,9 @@ public class SysUserDepartChangeApplyController extends JeecgController<SysUserD
@RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
@RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize) {
Page<ChangeDepartVo> page = new Page<>(pageNo, pageSize);
if(StrUtil.isNotBlank(userName)){
userName = HtmlUtil.unescape(userName);
}
IPage<ChangeDepartVo> pageList = sysUserDepartChangeApplyService.pageCustom(page, userName, status,workNo, userId);
return Result.OK(pageList);
}
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/entity/SelectWrapperDTO.java
+5
View File
@@ -1,5 +1,6 @@
package org.jeecg.modules.system.entity;
import cn.hutool.http.HtmlUtil;
import lombok.Data;
/**
@@ -11,6 +12,10 @@ import lombok.Data;
public class SelectWrapperDTO {
private String orgCode;
private String realName;
public void setRealName(String realName) {
this.realName = realName != null ? HtmlUtil.unescape(realName) : null;
}
private String workNo;
private String sex;
private String code;
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysBaseApiImpl.java
+4
View File
@@ -8,6 +8,7 @@ import cn.hutool.core.date.DateUtil;
import cn.hutool.core.util.IdcardUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
@@ -262,6 +263,9 @@ public class SysBaseApiImpl implements ISysBaseAPI {
@Override
public List<String> getUserIdsByDepartAndUsername(String departCode, String username, String idCard, String workNo) {
if(StrUtil.isNotBlank(username)){
username = HtmlUtil.unescape(username);
}
if (StrUtil.isAllBlank(departCode, username, idCard, workNo)) {
return Collections.emptyList();
}
jeecg-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysUserServiceImpl.java
+2
View File
@@ -6,6 +6,7 @@ import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.io.FileUtil;
import cn.hutool.core.util.*;
import cn.hutool.extra.pinyin.PinyinUtil;
import cn.hutool.http.HtmlUtil;
import com.alibaba.csp.sentinel.util.StringUtil;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
@@ -2879,6 +2880,7 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
queryWrapper.eq(SysUser::getStatus, 1);
queryWrapper.eq(SysUser::getPersonType, 1);
if (StrUtil.isNotEmpty(name)) {
name = HtmlUtil.unescape(name);
queryWrapper.like(SysUser::getRealname, name);
}
if (StrUtil.isNotEmpty(orgCode)) {