mirrors/pig
1
0
Fork 0
mirror of https://gitee.com/log4j/pig.git synced 2024-12-23 13:03:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

✨ Introducing new features. close #I50CGN Spring Core RCE

Browse Source
This commit is contained in:
qraddx 2022-03-30 15:08:39 +08:00
parent e1dd46d0b6
commit 203368f719
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pig-common/pig-common-feign/src/main/java/com/pig4cloud/pig/common/feign/sentinel/handle/GlobalBizExceptionHandler.java
View File

@ -20,6 +20,7 @@ import com.alibaba.csp.sentinel.Tracer;
import com.pig4cloud.pig.common.core.util.R;
import lombok.extern.slf4j.Slf4j;
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpStatus;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.core.SpringSecurityMessageSource;
@ -27,7 +28,9 @@ import org.springframework.util.Assert;
import org.springframework.validation.BindException;
import org.springframework.validation.FieldError;
import org.springframework.web.bind.MethodArgumentNotValidException;
import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.InitBinder;
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestControllerAdvice;
@ -42,6 +45,7 @@ import java.util.List;
* @date 2020-06-29
*/
@Slf4j
@Order(10000)
@RestControllerAdvice
@ConditionalOnExpression("!'${security.oauth2.client.clientId}'.isEmpty()")
public class GlobalBizExceptionHandler {
@ -118,4 +122,16 @@ public class GlobalBizExceptionHandler {
return R.failed(fieldErrors.get(0).getDefaultMessage());
}
/**
* fix Spring RCE 0day 入参不能包含如下字段
*
* TODO 有待考证
* @param dataBinder
*/
@InitBinder
public void setAllowedFields(WebDataBinder dataBinder) {
String[] abd = new String[] { "class.*", "Class.*", "*.class.*", "*.Class.*" };
dataBinder.setDisallowedFields(abd);
}
}