From 32ee3891a9c1df2c2cc13f7421ae669c25ccc0b1 Mon Sep 17 00:00:00 2001 From: zren25 Date: Wed, 4 Jun 2025 16:41:43 +0800 Subject: [PATCH] =?UTF-8?q?=E7=94=BB=E5=83=8F=E4=BA=8B=E4=BB=B6=E9=AA=8C?= =?UTF-8?q?=E8=AF=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../ai/analytic/center/constant/XssClean.java | 17 + .../center/constant/XssValidator.java | 44 ++ .../event/ListSubscriptionsRequestDto.java | 58 +++ .../center/dto/event/SendEventDto.java | 36 ++ .../center/dto/event/SourceChannelDto.java | 19 + .../analytic/center/dto/event/SourceDto.java | 12 + .../dto/event/SubscriptionCreateReqDto.java | 52 ++ .../dto/event/SubscriptionOperateReqDto.java | 17 + .../analytic/center/dto/resp/ResultDTO.java | 49 ++ .../center/config/HuaWeiEGConfig.java | 59 +++ .../EGEventSubscriptionController.java | 168 ++++++ .../analytic/center/service/CloudService.java | 285 ++++++++++ .../center/service/HuaWeiEGService.java | 493 ++++++++++++++++++ .../ai/analytic/center/utils/Signer.java | 147 ++++++ pom.xml | 27 + 15 files changed, 1483 insertions(+) create mode 100644 ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssClean.java create mode 100644 ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssValidator.java create mode 100644 ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/dto/event/ListSubscriptionsRequestDto.java create mode 100644 ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/dto/event/SendEventDto.java create mode 100644 ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/dto/event/SourceChannelDto.java create mode 100644 ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/dto/event/SourceDto.java create mode 100644 ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/dto/event/SubscriptionCreateReqDto.java create mode 100644 ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/dto/event/SubscriptionOperateReqDto.java create mode 100644 ai-analytic-center-biz/src/main/java/com/volvo/ai/analytic/center/config/HuaWeiEGConfig.java create mode 100644 ai-analytic-center-biz/src/main/java/com/volvo/ai/analytic/center/controller/EGEventSubscriptionController.java create mode 100644 ai-analytic-center-biz/src/main/java/com/volvo/ai/analytic/center/service/CloudService.java create mode 100644 ai-analytic-center-biz/src/main/java/com/volvo/ai/analytic/center/service/HuaWeiEGService.java create mode 100644 ai-analytic-center-biz/src/main/java/com/volvo/ai/analytic/center/utils/Signer.java diff --git a/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssClean.java b/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssClean.java new file mode 100644 index 0000000..4ada4a7 --- /dev/null +++ b/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssClean.java @@ -0,0 +1,17 @@ +package com.volvo.ai.analytic.center.constant; + +import javax.validation.Constraint; +import javax.validation.Payload; +import java.lang.annotation.*; + +@Target({ElementType.FIELD, ElementType.PARAMETER, ElementType.TYPE}) +@Retention(RetentionPolicy.RUNTIME) +@Documented +@Constraint(validatedBy = XssValidator.class) +public @interface XssClean { + String message() default "当前字符串存在xss注入"; + + Class[] groups() default {}; + + Class[] payload() default {}; +} diff --git a/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssValidator.java b/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssValidator.java new file mode 100644 index 0000000..67b6330 --- /dev/null +++ b/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssValidator.java @@ -0,0 +1,44 @@ +package com.volvo.ai.analytic.center.constant; + +import com.alibaba.cloud.commons.lang.StringUtils; +import lombok.extern.slf4j.Slf4j; + +import javax.validation.ConstraintValidator; +import javax.validation.ConstraintValidatorContext; +import java.util.regex.Pattern; + + +@Slf4j +public class XssValidator implements ConstraintValidator { + + private static final Pattern SCRIPT_PATTERN = Pattern.compile("", Pattern.CASE_INSENSITIVE); + private static final Pattern TAG_PATTERN = Pattern.compile("<[^>]*>", Pattern.CASE_INSENSITIVE); + private static final Pattern SRC_PATTERN = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern SRC_CASE_PATTERN = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern SCRIPT_END_PATTERN = Pattern.compile("", Pattern.CASE_INSENSITIVE); + private static final Pattern SCRIPT_START_PATTERN = Pattern.compile("", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern EVAL_PATTERN = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern EXPRESSION_PATTERN = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern JAVA_SCRIPT_PATTERN = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE); + private static final Pattern VB_SCRIPT_PATTERN = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE); + private static final Pattern ONLOAD_PATTERN = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern IMG_PATTERN = Pattern.compile("<(.*?)img(.*?)src=(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + @Override + public boolean isValid(String s, ConstraintValidatorContext constraintValidatorContext) { + if (StringUtils.isBlank(s)) { + return true; + } + return !containXss(s); + } + + + private static boolean containXss(String s) { + return SCRIPT_PATTERN.matcher(s).find() || SRC_PATTERN.matcher(s).find() || SRC_CASE_PATTERN.matcher(s).find() || + // Remove any lonesome tag Remove any lonesome