fix: 解决HTML转义安全问题

- 在多个DTO类中添加HtmlUtil导入并实现自动转义功能 - 为AccountDTO、ConDoctorDTO等类的set方法增加HTML转义处理 - 修复ConDoctorServiceImpl中的重复转义代码 - 为EmergencyProfessionUserController添加请求参数转义 - 修复OrderServiceImpl中的用户名称转义处理 - 为Watch相关服务增加数据绑定和查询时的转义处理 - 修复SysUser相关控制器和服务中的转义逻辑
2026-03-30 17:39:21 +08:00
parent f273609f95
commit a7cafe9d7f
23 changed files with 100 additions and 4 deletions
@@ -1,5 +1,6 @@
 package com.renkang.consultation.dto;

+import cn.hutool.http.HtmlUtil;
 import com.renkang.consultation.entity.ConPage;
 import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
@@ -11,6 +12,10 @@ public class AccountDTO extends ConPage {
    @Schema(title = "专家姓名")
    private String doctorName;

+    public void setDoctorName(String doctorName) {
+        this.doctorName = doctorName != null ? HtmlUtil.unescape(doctorName) : null;
+    }
+
    @Schema(title = "医院选择")
    private String hospitalName;

@@ -1,5 +1,6 @@
 package com.renkang.consultation.dto;

+import cn.hutool.http.HtmlUtil;
 import com.renkang.consultation.entity.ConPage;
 import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
@@ -10,6 +11,10 @@ public class ConDoctorDTO extends ConPage {

    @Schema(title = "专家姓名")
    private String doctorName;
+
+    public void setDoctorName(String doctorName) {
+        this.doctorName = doctorName != null ? HtmlUtil.unescape(doctorName) : null;
+    }
    @Schema(title = "专家编号")
    private String doctorNo;

@@ -1,5 +1,6 @@
 package com.renkang.consultation.dto;

+import cn.hutool.http.HtmlUtil;
 import com.fasterxml.jackson.annotation.JsonFormat;
 import com.renkang.consultation.entity.ConPage;
 import io.swagger.v3.oas.annotations.media.Schema;
@@ -17,6 +18,9 @@ public class ConEvaluateDTO extends ConPage {

    @Schema(title = "咨询人")
    private String userName;
+    public void setUserName(String userName) {
+        this.userName = userName != null ? HtmlUtil.unescape(userName) : null;
+    }

    @Schema(title = "二级单位id")
    private String sysOrgSecondId;
@@ -27,6 +31,10 @@ public class ConEvaluateDTO extends ConPage {
    @Schema(title = "咨询专家")
    private String expertName;

+    public void setExpertName(String expertName) {
+        this.expertName = expertName != null ? HtmlUtil.unescape(expertName) : null;
+    }
+
    @Schema(title = "专家医院")
    private String expertHospital;

@@ -1,5 +1,6 @@
 package com.renkang.consultation.dto;

+import cn.hutool.http.HtmlUtil;
 import com.renkang.consultation.entity.ConPage;
 import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
@@ -10,6 +11,10 @@ public class ConHealthInfoAnswerDTO extends ConPage {
    @Schema(title = "员工姓名")
    private String fromName;

+    public void setFromName(String fromName) {
+        this.fromName = fromName != null ? HtmlUtil.unescape(fromName) : null;
+    }
+
    @Schema(title = "手机号")
    private String phone;

@@ -1,5 +1,6 @@
 package com.renkang.consultation.dto;

+import cn.hutool.http.HtmlUtil;
 import com.renkang.consultation.entity.ConPage;
 import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
@@ -11,6 +12,10 @@ public class ConHelperDTO extends ConPage {
    @Schema(title = "全科医生姓名")
    private String userName;

+    public void setUserName(String userName) {
+        this.userName = userName != null ? HtmlUtil.unescape(userName) : null;
+    }
+
    @Schema(title = "状态")
    private Integer status;

@@ -1,5 +1,6 @@
 package com.renkang.consultation.dto;

+import cn.hutool.http.HtmlUtil;
 import com.fasterxml.jackson.annotation.JsonFormat;
 import com.renkang.consultation.entity.ConPage;
 import io.swagger.v3.oas.annotations.media.Schema;
@@ -17,6 +18,10 @@ public class ConSessionDTO extends ConPage {
    @Schema(title = "员工姓名")
    private String fromName;

+    public void setFromName(String fromName) {
+        this.fromName = fromName != null ? HtmlUtil.unescape(fromName) : null;
+    }
+
    @Schema(title = "员工id")
    private String fromAccount;

@@ -26,6 +31,10 @@ public class ConSessionDTO extends ConPage {
    @Schema(title = "专家姓名")
    private String doctorName;

+    public void setDoctorName(String doctorName) {
+        this.doctorName = doctorName != null ? HtmlUtil.unescape(doctorName) : null;
+    }
+
    @Schema(title = "咨询状态(0待确认 1接收预约 2拒绝预约 3已过期 4已取消 5咨询中 6专家咨询结束 7员工咨询结束 8超时自动结束)")
    private String contentStatus;

@@ -3,7 +3,6 @@ package com.renkang.consultation.service.impl;

 import cn.hutool.core.util.ObjectUtil;
 import cn.hutool.core.util.StrUtil;
-import cn.hutool.http.HtmlUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -249,9 +248,6 @@ public class ConDoctorServiceImpl extends ServiceImpl<ConDoctorMapper, ConDoctor
        if (StringUtils.hasLength(dto.getHospitalName())) {
            conDoctor.setResourceId(dto.getHospitalName());
        }
-        if (StrUtil.isNotEmpty(dto.getDoctorName())){
-            conDoctor.setDoctorName(HtmlUtil.unescape(dto.getDoctorName()));
-        }
        IPage<ConDoctor> conDoctorIPage = conDoctorMapper.queryPageList(page, conDoctor);
        List<ConDoctor> conDoctorList = conDoctorIPage.getRecords();
        if (CollectionUtils.isEmpty(conDoctorList)) {