From 68db4092ed2926564d80692e5d1ea46112bbe61c Mon Sep 17 00:00:00 2001 From: RuoYi Date: Mon, 1 Nov 2021 15:45:22 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BB=BB=E5=8A=A1=E5=B1=8F=E8=94=BD=E8=BF=9D?= =?UTF-8?q?=E8=A7=84=E5=AD=97=E7=AC=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../java/com/ruoyi/common/core/constant/Constants.java | 6 ++++++ .../java/com/ruoyi/job/controller/SysJobController.java | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java index edb90246..d97ba692 100644 --- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java +++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/Constants.java @@ -112,4 +112,10 @@ public class Constants * 资源映射路径 前缀 */ public static final String RESOURCE_PREFIX = "/profile"; + + /** + * 定时任务违规的字符 + */ + public static final String[] JOB_ERROR_STR = { "java.net.URL", "javax.naming.InitialContext", "org.yaml.snakeyaml", + "org.springframework.jndi" }; } diff --git a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java index 4fbd5eae..5cf87af7 100644 --- a/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java +++ b/ruoyi-modules/ruoyi-job/src/main/java/com/ruoyi/job/controller/SysJobController.java @@ -99,6 +99,10 @@ public class SysJobController extends BaseController { return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用"); } + else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR)) + { + return error("新增任务'" + job.getJobName() + "'失败，目标字符串存在违规"); + } job.setCreateBy(SecurityUtils.getUsername()); return toAjax(jobService.insertJob(job)); } @@ -127,6 +131,10 @@ public class SysJobController extends BaseController { return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用"); } + else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR)) + { + return error("修改任务'" + job.getJobName() + "'失败，目标字符串存在违规"); + } job.setUpdateBy(SecurityUtils.getUsername()); return toAjax(jobService.updateJob(job)); }