github/dataease
github/dataease
3
0
Fork 1
mirror of https://github.com/dataease/dataease.git synced 2025-02-25 20:42:55 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

fix(数据源): Mysql jdbc反序列化漏洞

Browse Source
This commit is contained in:
taojinlong 2022-10-11 16:01:06 +08:00
parent 61d8194a5a
commit bf485add69
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
backend/src/main/java/io/dataease/dto/datasource/MysqlConfiguration.java
View File

@ -5,12 +5,16 @@ import lombok.Getter;
import lombok.Setter; import lombok.Setter;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import java.util.Arrays;
import java.util.List;
@Getter @Getter
@Setter @Setter
public class MysqlConfiguration extends JdbcConfiguration { public class MysqlConfiguration extends JdbcConfiguration {
private String driver = "com.mysql.jdbc.Driver"; private String driver = "com.mysql.jdbc.Driver";
private String extraParams = "characterEncoding=UTF-8&connectTimeout=5000&useSSL=false&allowPublicKeyRetrieval=true&zeroDateTimeBehavior=convertToNull"; private String extraParams = "characterEncoding=UTF-8&connectTimeout=5000&useSSL=false&allowPublicKeyRetrieval=true&zeroDateTimeBehavior=convertToNull";
private List<String> illegalParameters = Arrays.asList("autoDeserialize", "queryInterceptors", "statementInterceptors", "detectCustomCollations");
public String getJdbc() { public String getJdbc() {
if (StringUtils.isEmpty(extraParams.trim())) { if (StringUtils.isEmpty(extraParams.trim())) {
@ -19,6 +23,12 @@ public class MysqlConfiguration extends JdbcConfiguration {
.replace("PORT", getPort().toString().trim()) .replace("PORT", getPort().toString().trim())
.replace("DATABASE", getDataBase().trim()); .replace("DATABASE", getDataBase().trim());
} else { } else {
for (String illegalParameter : illegalParameters) {
if (getExtraParams().contains(illegalParameter)) {
throw new RuntimeException("Illegal parameter: " + illegalParameter);
}
}
return "jdbc:mysql://HOSTNAME:PORT/DATABASE?EXTRA_PARAMS" return "jdbc:mysql://HOSTNAME:PORT/DATABASE?EXTRA_PARAMS"
.replace("HOSTNAME", getHost().trim()) .replace("HOSTNAME", getHost().trim())
.replace("PORT", getPort().toString().trim()) .replace("PORT", getPort().toString().trim())