diff --git a/power-grid/.idea/libraries/Maven__org_owasp_encoder_encoder_1_2_3.xml b/power-grid/.idea/libraries/Maven__org_owasp_encoder_encoder_1_2_3.xml
new file mode 100644
index 0000000..ccd3a8b
--- /dev/null
+++ b/power-grid/.idea/libraries/Maven__org_owasp_encoder_encoder_1_2_3.xml
@@ -0,0 +1,13 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/power-grid/.idea/power-grid-20230214new.iml b/power-grid/.idea/power-grid-20230214new.iml
index f3926d8..6c43c83 100644
--- a/power-grid/.idea/power-grid-20230214new.iml
+++ b/power-grid/.idea/power-grid-20230214new.iml
@@ -218,5 +218,6 @@
+
\ No newline at end of file
diff --git a/power-grid/.idea/workspace.xml b/power-grid/.idea/workspace.xml
index cf3eac6..6a8708f 100644
--- a/power-grid/.idea/workspace.xml
+++ b/power-grid/.idea/workspace.xml
@@ -5,907 +5,15 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -1240,7 +348,8 @@
-
+
+
@@ -1340,6 +449,7 @@
+
diff --git a/power-grid/pom.xml b/power-grid/pom.xml
index 3f7c85d..6a1db87 100644
--- a/power-grid/pom.xml
+++ b/power-grid/pom.xml
@@ -311,6 +311,11 @@
jasypt-spring-boot-starter
3.0.3
+
+ org.owasp.encoder
+ encoder
+ 1.2.3
+
@@ -336,6 +341,7 @@
true
+
diff --git a/power-grid/src/main/java/com/ruoyi/common/utils/http/HttpUtils.java b/power-grid/src/main/java/com/ruoyi/common/utils/http/HttpUtils.java
index bcd10c2..a05d9df 100644
--- a/power-grid/src/main/java/com/ruoyi/common/utils/http/HttpUtils.java
+++ b/power-grid/src/main/java/com/ruoyi/common/utils/http/HttpUtils.java
@@ -17,6 +17,8 @@ import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
+
+import org.owasp.encoder.Encode;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.ruoyi.common.constant.Constants;
@@ -70,7 +72,7 @@ public class HttpUtils
try
{
String urlNameString = StringUtils.isNotBlank(param) ? url + "?" + param : url;
- log.info("sendGet - {}", urlNameString);
+ log.info("sendGet - {}", Encode.forJava(urlNameString));
URL realUrl = new URL(urlNameString);
URLConnection connection = realUrl.openConnection();
connection.setRequestProperty("accept", "*/*");
@@ -120,7 +122,7 @@ public class HttpUtils
}
catch (Exception ex)
{
- log.error("调用in.close Exception, url=" + url + ",param=" + param, ex);
+ log.error("调用in.close Exception, url=" + url + ",param=" + Encode.forJava(param), Encode.forJava(ex.toString()));
}
}
return result.toString();
diff --git a/power-grid/src/main/java/com/ruoyi/common/utils/ip/AddressUtils.java b/power-grid/src/main/java/com/ruoyi/common/utils/ip/AddressUtils.java
index f7832a6..551f33b 100644
--- a/power-grid/src/main/java/com/ruoyi/common/utils/ip/AddressUtils.java
+++ b/power-grid/src/main/java/com/ruoyi/common/utils/ip/AddressUtils.java
@@ -1,5 +1,6 @@
package com.ruoyi.common.utils.ip;
+import org.owasp.encoder.Encode;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.alibaba.fastjson.JSONObject;
@@ -37,7 +38,7 @@ public class AddressUtils
String rspStr = HttpUtils.sendGet(IP_URL, "ip=" + ip + "&json=true", Constants.GBK);
if (StringUtils.isEmpty(rspStr))
{
- log.error("获取地理位置异常 {}", ip);
+ log.error("获取地理位置异常 {}", Encode.forJava(ip));
return UNKNOWN;
}
JSONObject obj = JSONObject.parseObject(rspStr);
diff --git a/power-grid/src/main/java/com/ruoyi/framework/config/SecurityConfig.java b/power-grid/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
index f39cc62..3572383 100644
--- a/power-grid/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
+++ b/power-grid/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
@@ -96,7 +96,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
// 过滤请求
.authorizeRequests()
- // 对于登录login 注册register 验证码captchaImage 允许匿名访问
+ // 对于登录login 注册register 验证码captchaImage 允许匿名访问2
.antMatchers("/login", "/register", "/captchaImage").anonymous()
.antMatchers(
HttpMethod.GET,
diff --git a/power-grid/src/main/java/com/ruoyi/framework/manager/factory/AsyncFactory.java b/power-grid/src/main/java/com/ruoyi/framework/manager/factory/AsyncFactory.java
index c4804b4..7cd2b8a 100644
--- a/power-grid/src/main/java/com/ruoyi/framework/manager/factory/AsyncFactory.java
+++ b/power-grid/src/main/java/com/ruoyi/framework/manager/factory/AsyncFactory.java
@@ -15,7 +15,7 @@ import com.ruoyi.project.monitor.domain.SysOperLog;
import com.ruoyi.project.monitor.service.ISysLogininforService;
import com.ruoyi.project.monitor.service.ISysOperLogService;
import eu.bitwalker.useragentutils.UserAgent;
-
+import org.owasp.encoder.Encode;
/**
* 异步工厂（产生任务用）
*
@@ -51,8 +51,10 @@ public class AsyncFactory
s.append(LogUtils.getBlock(username));
s.append(LogUtils.getBlock(status));
s.append(LogUtils.getBlock(message));
+ String sencode = Encode.forJava(s.toString());
+ String argsencode = Encode.forJava(args.toString());
// 打印信息到日志
- sys_user_logger.info(s.toString(), args);
+ sys_user_logger.info(sencode, argsencode);
// 获取客户端操作系统
String os = userAgent.getOperatingSystem().getName();
// 获取客户端浏览器
diff --git a/power-grid/src/main/java/com/ruoyi/project/pro/apicontroller/ApiController.java b/power-grid/src/main/java/com/ruoyi/project/pro/apicontroller/ApiController.java
index 1d50bdb..5317dea 100644
--- a/power-grid/src/main/java/com/ruoyi/project/pro/apicontroller/ApiController.java
+++ b/power-grid/src/main/java/com/ruoyi/project/pro/apicontroller/ApiController.java
@@ -11,6 +11,7 @@ import com.ruoyi.project.pro.domain.*;
import com.ruoyi.project.pro.domain.vo.ExamFinish;
import com.ruoyi.project.pro.domain.vo.StatisticsQueryVO;
import com.ruoyi.project.pro.service.*;
+import org.owasp.encoder.Encode;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;
@@ -139,18 +140,17 @@ public class ApiController extends BaseController {
return getDataTable(list);
}
-
/**
* 学习任务菜单--唤醒3D模型
*/
@PostMapping("courseModel")
public AjaxResult courseModel(@RequestBody OpeTaskInfo opeTaskInfo, HttpServletRequest request){
- logger.info("输入参数===="+opeTaskInfo.toString());
- logger.info("ip地址为=="+ IpUtils.getIpAddr(request));
- logger.info("X-Real-IP地址为=="+ request.getHeader("X-Real-IP"));
- logger.info("WL-Proxy-Client-IP地址为=="+ request.getHeader("WL-Proxy-Client-IP"));
- logger.info("Proxy-Client-IP地址为=="+ request.getHeader("Proxy-Client-IP"));
- logger.info("x-forwarded-for地址为=="+ request.getHeader("x-forwarded-for"));
+ logger.info("输入参数===="+Encode.forJava(opeTaskInfo.toString()));
+ logger.info("ip地址为=="+ Encode.forJava(IpUtils.getIpAddr(request)));
+ logger.info("X-Real-IP地址为=="+ Encode.forJava(request.getHeader("X-Real-IP")));
+ logger.info("WL-Proxy-Client-IP地址为=="+ Encode.forJava(request.getHeader("WL-Proxy-Client-IP")));
+ logger.info("Proxy-Client-IP地址为=="+ Encode.forJava(request.getHeader("Proxy-Client-IP")));
+ logger.info("x-forwarded-for地址为=="+ Encode.forJava(request.getHeader("x-forwarded-for")));
opeTaskInfo.setIp(IpUtils.getIpAddr(request));
iProOperateTaskService.insertOperateTaskInfo(opeTaskInfo);
return AjaxResult.success("");
@@ -161,7 +161,7 @@ public class ApiController extends BaseController {
*/
@PostMapping("queryCourseModel")
public OpeTaskInfo courseCModel(@RequestParam String ip){
- logger.info("输入参数===="+ip);
+ logger.info("输入参数===="+ Encode.forJava(ip));
return iProOperateTaskService.selectOperateTask(ip);
}
@@ -170,8 +170,8 @@ public class ApiController extends BaseController {
*/
@PostMapping("deleteOperateTaskInfo")
public AjaxResult courseDelModel(@RequestParam String ip){
- logger.info("输入参数===="+ip);
- iProOperateTaskService.deleteOperateTaskInfo(ip);
+ logger.info("输入参数===="+Encode.forJava(ip));
+ iProOperateTaskService.deleteOperateTaskInfo(Encode.forJava(ip));
return AjaxResult.success("删除成功");
}
diff --git a/power-grid/src/main/java/com/ruoyi/project/pro/util/ExcelUtilNew.java b/power-grid/src/main/java/com/ruoyi/project/pro/util/ExcelUtilNew.java
index 3c9c96d..8e2b9b8 100644
--- a/power-grid/src/main/java/com/ruoyi/project/pro/util/ExcelUtilNew.java
+++ b/power-grid/src/main/java/com/ruoyi/project/pro/util/ExcelUtilNew.java
@@ -10,6 +10,7 @@ import com.ruoyi.common.utils.StringUtils;
import com.ruoyi.project.pro.domain.ProScore;
import com.ruoyi.project.pro.domain.ProTheoryQuestion;
import com.ruoyi.project.pro.service.IProTheoryQuestionService;
+import org.owasp.encoder.Encode;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
@@ -145,7 +146,7 @@ public class ExcelUtilNew {
map.put("isRight", (boolean) map.get("isRight") ? "正确" : "错误");
qList.add(map);
}
- logger.info("qList:" + qList);
+ logger.info("qList:" + Encode.forJava(qList.toString()));
writer.setOnlyAlias(true);
writer.addHeaderAlias("question", "题干");
writer.addHeaderAlias("optionA", "选项A");
diff --git a/power-grid/src/main/java/com/ruoyi/project/tool/gen/service/GenTableServiceImpl.java b/power-grid/src/main/java/com/ruoyi/project/tool/gen/service/GenTableServiceImpl.java
index 8e0595d..311301b 100644
--- a/power-grid/src/main/java/com/ruoyi/project/tool/gen/service/GenTableServiceImpl.java
+++ b/power-grid/src/main/java/com/ruoyi/project/tool/gen/service/GenTableServiceImpl.java
@@ -16,6 +16,7 @@ import org.apache.commons.io.IOUtils;
import org.apache.velocity.Template;
import org.apache.velocity.VelocityContext;
import org.apache.velocity.app.Velocity;
+import org.owasp.encoder.Encode;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
@@ -385,7 +386,7 @@ public class GenTableServiceImpl implements IGenTableService
}
catch (IOException e)
{
- log.error("渲染模板失败，表名：" + table.getTableName(), e);
+ log.error("渲染模板失败，表名：" + Encode.forJava(table.getTableName()), Encode.forJava(e.toString()));
}
}
}