package net.mingsoft.cms.config;

import jakarta.servlet.ReadListener;
import jakarta.servlet.ServletInputStream;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletRequestWrapper;
import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.nio.charset.StandardCharsets;

public class CachedBodyHttpServletRequest extends HttpServletRequestWrapper {

    private final byte[] cachedBody;

    public CachedBodyHttpServletRequest(HttpServletRequest request) throws IOException {
        super(request);
        this.cachedBody = request.getInputStream().readAllBytes();
    }

    @Override
    public ServletInputStream getInputStream() {
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(cachedBody);
        return new ServletInputStream() {
            @Override
            public int read() {
                return byteArrayInputStream.read();
            }

            @Override
            public boolean isFinished() {
                return byteArrayInputStream.available() == 0;
            }

            @Override
            public boolean isReady() {
                return true;
            }

            // 补全Servlet 3.1强制要求的抽象方法
            @Override
            public void setReadListener(ReadListener readListener) {
                // 同步读取场景，无需实现异步监听逻辑
            }
        };
    }

    @Override
    public BufferedReader getReader() {
        return new BufferedReader(new InputStreamReader(getInputStream(), StandardCharsets.UTF_8));
    }

    /**
     * 获取请求体字符串用于SQL注入校验
     */
    public String getBodyString() {
        return new String(cachedBody, StandardCharsets.UTF_8);
    }
}

package net.mingsoft.cms.config;

import jakarta.servlet.*;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import net.mingsoft.cms.config.CachedBodyHttpServletRequest;
import org.springframework.http.MediaType;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;
import java.util.Map;

public class MdiySqlInjectFilter implements Filter {

    // SQL注入危险关键字（大小写不敏感）
    private static final List<String> DANGER_KEYWORDS = Arrays.asList(
            "union", "select", "insert", "delete", "drop", "alter",
            "updatexml", "extractvalue", "sleep", "benchmark",
            "information_schema", "floor", "rand(", "or 1=", "and 1="
    );

    // 危险特殊字符
    private static final List<String> DANGER_CHARS = Arrays.asList(
            "'", "\"", ";", "--", "/*", "*/", "%00", "\\"
    );

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse resp = (HttpServletResponse) response;
        String uri = req.getRequestURI();

        // 非mdiy路径直接放行
        if (!uri.startsWith("/mdiy/")) {
            chain.doFilter(request, response);
            return;
        }

        // ========== 1. 校验 GET + POST 表单参数 ==========
        Map<String, String[]> parameterMap = req.getParameterMap();
        for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
            Object valueObj = entry.getValue();
            String[] values;
            // 兼容单值String和数组String[]两种情况，避免ClassCastException
            if (valueObj instanceof String[]) {
                values = (String[]) valueObj;
            } else if (valueObj instanceof String) {
                values = new String[]{(String) valueObj};
            } else {
                continue;
            }

            for (String value : values) {
                if (value == null) continue;
                if (isDanger(value.toLowerCase())) {
                    reject(resp);
                    return;
                }
            }
        }

        // ========== 2. 校验 POST JSON 请求体 ==========
        String contentType = req.getContentType();
        if (contentType != null && contentType.contains(MediaType.APPLICATION_JSON_VALUE)) {
            CachedBodyHttpServletRequest wrappedRequest = new CachedBodyHttpServletRequest(req);
            String body = wrappedRequest.getBodyString().toLowerCase();
            if (isDanger(body)) {
                reject(resp);
                return;
            }
            // 校验通过，用包装后的请求继续向后传递
            chain.doFilter(wrappedRequest, response);
            return;
        }

        // 非JSON请求，直接向后传递
        chain.doFilter(request, response);
    }

    /**
     * 判断是否包含危险内容
     */
    private boolean isDanger(String content) {
        for (String danger : DANGER_CHARS) {
            if (content.contains(danger)) {
                return true;
            }
        }
        for (String keyword : DANGER_KEYWORDS) {
            if (content.contains(keyword)) {
                return true;
            }
        }
        return false;
    }

    /**
     * 拦截返回
     */
    private void reject(HttpServletResponse resp) throws IOException {
        resp.setStatus(HttpServletResponse.SC_BAD_REQUEST);
        resp.setContentType("text/plain;charset=UTF-8");
        resp.getWriter().write("Parameter invalid");
    }
}

package net.mingsoft.cms.config;

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class MdiyFilterConfig {

    /**
     * SQL注入参数拦截过滤器，优先级10，最先执行
     */
    @Bean
    public FilterRegistrationBean<MdiySqlInjectFilter> mdiySqlInjectFilter() {
        FilterRegistrationBean<MdiySqlInjectFilter> bean = new FilterRegistrationBean<>();
        bean.setFilter(new MdiySqlInjectFilter());
        bean.addUrlPatterns("/*");
        bean.setOrder(10);
        return bean;
    }
}

package net.mingsoft.cms.config;

import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Pointcut;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Component;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import java.io.IOException;

@Aspect
@Component
public class MdiyAuthAspect {
    // 精准拦截web包下所有Action（带@Controller注解）
    @Pointcut("execution(* net.mingsoft.mdiy.action..*.*(..))")
    public void mdiyWebActionPointCut() {}

    @Around("mdiyWebActionPointCut()")
    public Object checkLogin(ProceedingJoinPoint joinPoint) throws Throwable {
        Subject subject = SecurityUtils.getSubject();
        // principal非空 = 已登录（兼容密码登录、rememberMe记住我）
        if (subject.getPrincipal() == null) {
            ServletRequestAttributes attr = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
            if (attr != null) {
                HttpServletResponse resp = attr.getResponse();
                resp.setStatus(HttpServletResponse.SC_FORBIDDEN);
                resp.setContentType("text/plain;charset=UTF-8");
                try {
                    resp.getWriter().write("Access Denied：需管理员登录");
                } catch (IOException ignored) {}
            }
            return null;
        }
        return joinPoint.proceed();
    }
}