287 lines
15 KiB
C#
287 lines
15 KiB
C#
using Microsoft.AspNetCore.Mvc.Controllers;
|
||
using Microsoft.AspNetCore.Mvc;
|
||
using Microsoft.AspNetCore.Mvc.Filters;
|
||
using Competition.Common.Util;
|
||
using System.Text.RegularExpressions;
|
||
using System.Reflection;
|
||
using System.Linq;
|
||
using System.Collections;
|
||
using Newtonsoft.Json;
|
||
using Org.BouncyCastle.Ocsp;
|
||
using CompetitionAPI.api.unity;
|
||
using Newtonsoft.Json.Linq;
|
||
|
||
namespace CompetitionAPI
|
||
{
|
||
public class APIFilter : ActionFilterAttribute
|
||
{
|
||
/// <summary>
|
||
/// Action方法调用之前执行
|
||
/// </summary>
|
||
/// <param name="context"></param>
|
||
public override void OnActionExecuting(ActionExecutingContext context)
|
||
{
|
||
var descriptor = context.ActionDescriptor as ControllerActionDescriptor;
|
||
string param = string.Empty;
|
||
string globalParam = string.Empty;
|
||
foreach (var arg in context.ActionArguments)
|
||
{
|
||
if (arg.Key != "req")
|
||
{
|
||
string message = "";
|
||
if (arg.Value != null)
|
||
{
|
||
var result = CheckParams(arg.Key, arg.Value.ToString(), out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
}
|
||
}
|
||
else
|
||
{
|
||
if (arg.Value != null)
|
||
{
|
||
// 获取对象的类型
|
||
Type type = arg.Value.GetType();
|
||
// 获取所有的公共实例属性和字段
|
||
PropertyInfo[] properties = type.GetProperties(BindingFlags.Public | BindingFlags.Instance);
|
||
|
||
foreach (var field in properties)
|
||
{
|
||
var fieldType = field.PropertyType.FullName;
|
||
var fieldName = field.Name;
|
||
var fieldValue = field.GetValue(arg.Value);
|
||
if (fieldValue != null)
|
||
{
|
||
if (descriptor.ControllerName == "WriteUserOperationTicket" && fieldName == "data")
|
||
{
|
||
var list_user_operation_ticket = JsonConvert.DeserializeObject<List<OperationTicketData>>(fieldValue.ToString());
|
||
foreach (var item in list_user_operation_ticket)
|
||
{
|
||
if (!string.IsNullOrEmpty(item.ExamOperationTicketId))
|
||
{
|
||
string message = "";
|
||
var result = CheckParams("ExamOperationTicketId", item.ExamOperationTicketId, out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
}
|
||
|
||
if (!string.IsNullOrEmpty(item.ExamId))
|
||
{
|
||
string message = "";
|
||
var result = CheckParams("ExamId", item.ExamId, out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
}
|
||
|
||
if (!string.IsNullOrEmpty(item.OperationTicketId))
|
||
{
|
||
string message = "";
|
||
var result = CheckParams("OperationTicketId", item.OperationTicketId, out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
}
|
||
|
||
if (!string.IsNullOrEmpty(item.Type))
|
||
{
|
||
string message = "";
|
||
var result = CheckParams("Type", item.Type, out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
}
|
||
|
||
if (!string.IsNullOrEmpty(item.SerialNumber))
|
||
{
|
||
string message = "";
|
||
var result = CheckParams("SerialNumber", item.SerialNumber, out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
}
|
||
|
||
if (!string.IsNullOrEmpty(item.Content))
|
||
{
|
||
string message = "";
|
||
var result = CheckParams("Content", item.Content, out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
}
|
||
}
|
||
}
|
||
else
|
||
{
|
||
if (fieldType.Contains("System.Collections.Generic.List"))
|
||
{
|
||
JArray jsonArray = JArray.Parse(JsonConvert.SerializeObject(fieldValue));
|
||
foreach (JObject item in jsonArray.Children<JObject>())
|
||
{
|
||
foreach (var prop in item.Properties())
|
||
{
|
||
string message = "";
|
||
var result = CheckParams(prop.Name, (string)prop.Value, out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
//if (prop.Value.Type == JTokenType.String)
|
||
//{
|
||
// string filteredValue = FilterString((string)prop.Value);
|
||
// prop.Value = filteredValue;
|
||
//}
|
||
}
|
||
}
|
||
//Type type2 = fieldValue.GetType();
|
||
//PropertyInfo[] properties2 = type2.GetProperties(BindingFlags.Public | BindingFlags.Instance);
|
||
//foreach (var field2 in properties2)
|
||
//{
|
||
// var fieldType2 = field2.PropertyType.FullName;
|
||
// var fieldName2 = field2.Name;
|
||
// var fieldValue2 = field2.GetValue(fieldValue);
|
||
// if (fieldValue2 != null)
|
||
// {
|
||
// string message = "";
|
||
// var result = CheckParams(fieldName2, fieldValue2.ToString(), out message);
|
||
// if (!result)
|
||
// {
|
||
// context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
// }
|
||
// }
|
||
//}
|
||
}
|
||
else
|
||
{
|
||
var is_vaild = true;
|
||
if (descriptor.ControllerName == "AddUser" && fieldName == "PassWord")
|
||
{
|
||
is_vaild = false;
|
||
}
|
||
else if (descriptor.ControllerName == "EditUserMim" && fieldName == "NewPassWord")
|
||
{
|
||
is_vaild = false;
|
||
}
|
||
else if (descriptor.ControllerName == "ChangePassword" && fieldName == "OldPassword")
|
||
{
|
||
is_vaild = false;
|
||
}
|
||
else if (descriptor.ControllerName == "ChangePassword" && fieldName == "NewPassword")
|
||
{
|
||
is_vaild = false;
|
||
}
|
||
if (is_vaild)
|
||
{
|
||
string message = "";
|
||
var result = CheckParams(fieldName, fieldValue.ToString(), out message);
|
||
if (!result)
|
||
{
|
||
context.Result = new ObjectResult(Tool.GetJsonWithCode(APICode.Fail, message)) { };
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
//Console.WriteLine($"webapi方法名称:【{descriptor.ActionName}】接收到参数为：{param}");
|
||
}
|
||
/// <summary>
|
||
/// Action 方法调用后，Result 方法调用前执行
|
||
/// </summary>
|
||
/// <param name="context"></param>
|
||
public override void OnActionExecuted(ActionExecutedContext context) { }
|
||
/// <summary>
|
||
/// Result 方法调用前执行
|
||
/// </summary>
|
||
/// <param name="context"></param>
|
||
public override void OnResultExecuting(ResultExecutingContext context) { }
|
||
/// <summary>
|
||
/// Result 方法调用后执行
|
||
/// </summary>
|
||
/// <param name="context"></param>
|
||
public override void OnResultExecuted(ResultExecutedContext context)
|
||
{
|
||
//var descriptor = context.ActionDescriptor as ControllerActionDescriptor;
|
||
|
||
//string result = string.Empty;
|
||
////ObjectResult
|
||
//if (context.Result is JsonResult)
|
||
//{
|
||
// result = Newtonsoft.Json.JsonConvert.SerializeObject(((JsonResult)context.Result).Value);
|
||
//}
|
||
//Console.WriteLine($"webapi方法名称【{descriptor.ActionName}】执行的返回值 : {result}");
|
||
}
|
||
|
||
/// <summary>
|
||
/// 非法sql注入字符串
|
||
/// </summary>
|
||
public List<string> list_sql_filter = new List<string>()
|
||
{
|
||
"ascii(","ord(","hex(","bin("
|
||
," if(","+if(" ," char(","+char("
|
||
,"substr(","substring(" ,"mid("," replace(","+replace("
|
||
,"sleep(","benchmark("
|
||
,"concat(","concat_ws"
|
||
," floor(" ," rand(","+floor(" ,"+rand("
|
||
," limit"," offset " ," regexp "
|
||
,"user(","database(" ,"desc(","version(","datadir","version_compile_os" ,"table(","columns("
|
||
,"and+" ,"+and"
|
||
," between "," in "," and "," or "," xor "," not "," like "," rlike "," begin "," join "
|
||
," > ","> "," >" ," < ","< "," <"," = ","= "," ="
|
||
,"<>","!="," + ","+ "," +"
|
||
,"greatest(","least(","strcmp(","left(","right("
|
||
," select "," from "," where ","order by"," union "," group "
|
||
," insert "," update "," delete ","table_schema","information_schema.columns","truncate","execute","table","drop","into","exec"
|
||
};
|
||
|
||
|
||
/// <summary>
|
||
/// 检查参数值是否非法
|
||
/// </summary>
|
||
/// <param name="context"></param>
|
||
/// <param name="message"></param>
|
||
/// <returns></returns>
|
||
public bool CheckParams(string key, string value, out string message)
|
||
{
|
||
//string ragular = @"^[a-zA-Z0-9_\u4e00-\u9fa5\s-、()（）]+$";
|
||
//string ragular = @"^[\.:"",\{ \}\[\]a-zA-Z0-9_\u4e00-\u9fa5\s-、\(\)（）\\//，。；\?“”;：？!！\n\r\t]+$";
|
||
string ragular = @"^[\.:"",\{ \}\[\]a-zA-Z0-9_\u4e00-\u9fa5\s-、\(\)（）\\//，。;；\?“”;：？!！\n\r\t*#Φ~|\u2103×]+$";
|
||
message = "";
|
||
string paraName = key;
|
||
string paraValue = value;
|
||
if (!string.IsNullOrWhiteSpace(paraValue))
|
||
{
|
||
var IsMatch = Regex.IsMatch(paraValue, ragular);
|
||
if (!IsMatch)
|
||
{
|
||
message = string.Format("异常值:{0} 请检查!", paraValue);
|
||
return false;
|
||
}
|
||
|
||
var low = paraValue.ToLower();
|
||
foreach (var item in list_sql_filter)
|
||
{
|
||
if (low.Contains(item))
|
||
{
|
||
message = string.Format("异常值:{0} 请检查!", item);
|
||
return false;
|
||
}
|
||
}
|
||
}
|
||
return true;
|
||
}
|
||
}
|
||
}
|