forked from fanruan/design
Browse Source
* commit 'a58c0754d76b91e4454aedb213a49d63da8b6b77': (25 commits) REPORT-55377 升级tomcat到8.5.69 REPORT-56220 数据连接越权漏洞修复 REPORT-56220 数据连接越权漏洞修复 REPORT-56220 数据连接越权漏洞修复 REPORT-56220 数据连接越权漏洞修复 REPORT-55377 更新Tomcat版本到8.5.69 add executeJavaScriptAndReturnValue function CHART-20662 fix:数据集字段拖入单元格 白色文字 CHART-19792 大屏模板屏蔽全局参数菜单项 v7打开调试窗口失败的问题 还原范围 CHART-20642 图表预定义配色避免重名和空字符串名 新接口 新接口 CHART-20402 增加几个接口 CHART-20402 增加几个接口 CHART-20402 增加几个接口 ignore 根据最新视觉调整单元格边框颜色 POM-2302 cpt组件默认样式 ...research/11.0
superman
3 years ago
29 changed files with 544 additions and 55 deletions
@ -0,0 +1,20 @@
|
||||
package com.fr.design.mainframe.authority; |
||||
|
||||
import com.fr.report.cell.cellattr.core.group.DSColumn; |
||||
import org.jetbrains.annotations.Nullable; |
||||
|
||||
import java.util.Arrays; |
||||
import java.util.HashSet; |
||||
import java.util.Set; |
||||
|
||||
public class DSColumnAuthorityChecker extends ElementAuthorityChecker<DSColumn> { |
||||
|
||||
@Override |
||||
@Nullable |
||||
Set<String> getNoAuthDatasetNames(DSColumn dsColumn, Set<String> authDatasetNames) { |
||||
if (!authDatasetNames.contains(dsColumn.getDSName())) { |
||||
return new HashSet<>(Arrays.asList(dsColumn.getDSName())); |
||||
} |
||||
return null; |
||||
} |
||||
} |
||||
@ -0,0 +1,45 @@
|
||||
package com.fr.design.mainframe.authority; |
||||
|
||||
import org.jetbrains.annotations.Nullable; |
||||
import sun.reflect.generics.reflectiveObjects.ParameterizedTypeImpl; |
||||
|
||||
import java.lang.reflect.Type; |
||||
import java.util.Set; |
||||
|
||||
|
||||
public abstract class ElementAuthorityChecker<T> { |
||||
|
||||
|
||||
/** |
||||
* @Description 获取越权的数据连接 |
||||
* @param: t 待检查的对象 |
||||
* @param: authConnectionNames 有权限的数据连接名 |
||||
* @return 如果有返回名称，没有返回null |
||||
*/ |
||||
@Nullable |
||||
Set<String> getNoAuthConnectionNames(T t, Set<String> authConnectionNames) { |
||||
return null; |
||||
} |
||||
|
||||
|
||||
/** |
||||
* @Description 获取越权的服务器数据集 |
||||
* @param: t 待检查的对象 |
||||
* @param: authDatasetNames 有权限的服务器数据集名 |
||||
* @return 如果有返回名称，没有返回null |
||||
*/ |
||||
@Nullable |
||||
Set<String> getNoAuthDatasetNames(T t, Set<String> authDatasetNames) { |
||||
return null; |
||||
} |
||||
|
||||
/** |
||||
* @Description 要检查对象的className |
||||
* @return className |
||||
*/ |
||||
String getCheckClassName() { |
||||
ParameterizedTypeImpl parameterizedType = (ParameterizedTypeImpl) this.getClass().getGenericSuperclass(); |
||||
Type type = parameterizedType.getActualTypeArguments()[0]; |
||||
return type.getTypeName(); |
||||
} |
||||
} |
||||
@ -0,0 +1,27 @@
|
||||
package com.fr.design.mainframe.authority; |
||||
|
||||
import com.fr.base.Formula; |
||||
import org.jetbrains.annotations.Nullable; |
||||
|
||||
import java.util.Arrays; |
||||
import java.util.HashSet; |
||||
import java.util.Set; |
||||
import java.util.regex.Matcher; |
||||
import java.util.regex.Pattern; |
||||
|
||||
public class FormulaAuthorityChecker extends ElementAuthorityChecker<Formula> { |
||||
private static final Pattern FORMULA_PATTERN = Pattern.compile("^=SQL\\(\"(.+?)\","); |
||||
|
||||
@Override |
||||
@Nullable |
||||
public Set<String> getNoAuthConnectionNames(Formula formula, Set<String> authConnectionNames) { |
||||
String content = formula.getContent(); |
||||
Matcher matcher = FORMULA_PATTERN.matcher(content); |
||||
if (matcher.find()) { |
||||
if (!authConnectionNames.contains(matcher.group(1))) { |
||||
return new HashSet<>(Arrays.asList(matcher.group(1))); |
||||
} |
||||
} |
||||
return null; |
||||
} |
||||
} |
||||
@ -0,0 +1,184 @@
|
||||
package com.fr.design.mainframe.authority; |
||||
|
||||
|
||||
import com.fr.design.dialog.FineJOptionPane; |
||||
|
||||
import com.fr.design.i18n.Toolkit; |
||||
import com.fr.design.mainframe.DesignerContext; |
||||
import com.fr.design.mainframe.JTemplate; |
||||
import com.fr.design.mod.ModClassFilter; |
||||
import com.fr.invoke.ClassHelper; |
||||
|
||||
import com.fr.log.FineLoggerFactory; |
||||
import com.fr.rpc.ExceptionHandler; |
||||
import com.fr.rpc.RPCInvokerExceptionInfo; |
||||
import com.fr.stable.Filter; |
||||
import com.fr.workspace.WorkContext; |
||||
import com.fr.workspace.server.authority.user.UserAuthority; |
||||
|
||||
import java.util.Collection; |
||||
import java.util.HashMap; |
||||
import java.util.HashSet; |
||||
import java.util.Iterator; |
||||
import java.util.Map; |
||||
import java.util.Set; |
||||
|
||||
|
||||
import static javax.swing.JOptionPane.WARNING_MESSAGE; |
||||
|
||||
|
||||
public class JTemplateAuthorityChecker { |
||||
JTemplate<?, ?> jTemplate; |
||||
Set<String> authConnectionNames; |
||||
Set<String> authDatasetNames; |
||||
Map<String, ElementAuthorityChecker> checkerMap = new HashMap<>(); |
||||
Set<String> authFailConnectionNames = new HashSet<>(); |
||||
Set<String> authFailDatasetNames = new HashSet<>(); |
||||
|
||||
|
||||
public JTemplateAuthorityChecker(JTemplate<?, ?> jTemplate) { |
||||
long s = System.currentTimeMillis(); |
||||
this.jTemplate = jTemplate; |
||||
this.initAuthNames(); |
||||
this.initChecker(); |
||||
FineLoggerFactory.getLogger().info("JTemplateAuthorityChecker init time consume:" + (System.currentTimeMillis() - s)); |
||||
} |
||||
|
||||
private void initAuthNames() { |
||||
UserAuthority templateAuthority = WorkContext.getCurrent().get(UserAuthority.class); |
||||
Map<String, Set<String>> authNamesMap = templateAuthority.getAuthServerDataSetAndConnectionNames(); |
||||
if (authNamesMap != null) { |
||||
//有权限的数据连接名称
|
||||
authConnectionNames = authNamesMap.get(UserAuthority.AUTH_CONNECTION_NAMES); |
||||
//有权限的数据集名称(模板数据集和服务器数据集)
|
||||
authDatasetNames = authNamesMap.get(UserAuthority.AUTH_SERVER_DATASET_NAMES); |
||||
Iterator<String> iterator = jTemplate.getTarget().getTableDataNameIterator(); |
||||
while (iterator.hasNext()) { |
||||
String datasetName = iterator.next(); |
||||
authDatasetNames.add(datasetName); |
||||
} |
||||
} |
||||
} |
||||
|
||||
private void initChecker() { |
||||
registerChecker(new NameDatabaseConnectionAuthorityChecker()); |
||||
registerChecker(new DSColumnAuthorityChecker()); |
||||
registerChecker(new FormulaAuthorityChecker()); |
||||
registerChecker(new NameTableDataAuthorityChecker()); |
||||
} |
||||
|
||||
private void registerChecker(ElementAuthorityChecker checker) { |
||||
checkerMap.put(checker.getCheckClassName(), checker); |
||||
} |
||||
|
||||
|
||||
public boolean isAuthority() { |
||||
long s = System.currentTimeMillis(); |
||||
//遍历模板对象，根据checkerMap.keySet()把感兴趣的对象找出来
|
||||
Map<String, Collection<Object>> targetObjects = ClassHelper.searchObject(jTemplate.getTarget(), checkerMap.keySet(), ClassFilter.getInstance()); |
||||
|
||||
//找到对应的checker，对对象进行检查
|
||||
for (String name : targetObjects.keySet()) { |
||||
ElementAuthorityChecker checker = checkerMap.get(name); |
||||
for (Object object : targetObjects.get(name)) { |
||||
if (authConnectionNames != null) { |
||||
Set<String> noAuthName = checker.getNoAuthConnectionNames(object, authConnectionNames); |
||||
if (noAuthName != null) { |
||||
authFailConnectionNames.addAll(noAuthName); |
||||
} |
||||
} |
||||
if (authDatasetNames != null) { |
||||
Set<String> noAuthName = checker.getNoAuthDatasetNames(object, authDatasetNames); |
||||
if (noAuthName != null) { |
||||
authFailDatasetNames.addAll(noAuthName); |
||||
} |
||||
} |
||||
} |
||||
} |
||||
|
||||
FineLoggerFactory.getLogger().info("JTemplateAuthorityChecker check time consume:" + (System.currentTimeMillis() - s)); |
||||
return authFailConnectionNames.size() == 0 && authFailDatasetNames.size() == 0; |
||||
} |
||||
|
||||
public void showAuthorityFailPromptDialog() { |
||||
StringBuffer stringBuffer = new StringBuffer(); |
||||
stringBuffer.append(Toolkit.i18nText("Fine-Design-Basic_Save_Failure")); |
||||
stringBuffer.append("\n"); |
||||
stringBuffer.append(getPromptInfo(authFailDatasetNames, |
||||
Toolkit.i18nText("Fine-Design_Template_Authority_Check_Server_Dataset_Authority"))); |
||||
stringBuffer.append(getPromptInfo(authFailConnectionNames, |
||||
Toolkit.i18nText("Fine-Design_Template_Authority_Check_Data_Connection_Authority"))); |
||||
FineJOptionPane.showMessageDialog( |
||||
DesignerContext.getDesignerFrame(), |
||||
stringBuffer.toString(), |
||||
Toolkit.i18nText("Fine-Design_Basic_Alert"), |
||||
WARNING_MESSAGE); |
||||
} |
||||
|
||||
private String getPromptInfo(Set<String> authFailNames, String message) { |
||||
StringBuffer stringBuffer = new StringBuffer(); |
||||
if (authFailNames.size() > 0) { |
||||
stringBuffer.append(Toolkit.i18nText("Fine-Design_Template_Authority_Check_Current_Operator_Miss")); |
||||
stringBuffer.append(authFailNames.size()); |
||||
stringBuffer.append(Toolkit.i18nText("Fine-Design_Report_Ge")); |
||||
stringBuffer.append(message); |
||||
stringBuffer.append("\n"); |
||||
stringBuffer.append(getNoAuthNameSequence(authFailNames)); |
||||
} |
||||
return stringBuffer.toString(); |
||||
} |
||||
|
||||
private String getNoAuthNameSequence(Set<String> names) { |
||||
StringBuffer stringBuffer = new StringBuffer(); |
||||
int showMaxCount = 3; |
||||
int count = 0; |
||||
for (String name : names) { |
||||
if (count == showMaxCount) { |
||||
stringBuffer.append(Toolkit.i18nText("Fine-Design_Template_Authority_Check_Etc")); |
||||
break; |
||||
} |
||||
stringBuffer.append(name); |
||||
if (count != names.size() - 1 && count != showMaxCount - 1) { |
||||
stringBuffer.append(";"); |
||||
} |
||||
count++; |
||||
} |
||||
stringBuffer.append("\n"); |
||||
return stringBuffer.toString(); |
||||
} |
||||
|
||||
static class ClassFilter implements Filter<String> { |
||||
|
||||
private static final Set<String> FILTER_SET = new HashSet<>(); |
||||
private static final Set<String> START_WITH_SET = new HashSet<>(); |
||||
private static final Filter<String> INSTANCE = new ModClassFilter(); |
||||
|
||||
public static Filter<String> getInstance() { |
||||
return INSTANCE; |
||||
} |
||||
|
||||
static { |
||||
FILTER_SET.add("java.awt.image.BufferedImage"); |
||||
FILTER_SET.add("sun.awt.AppContext"); |
||||
FILTER_SET.add("com.fr.poly.creator.ECBlockCreator"); |
||||
FILTER_SET.add("io.netty.channel.nio.SelectedSelectionKeySet"); |
||||
FILTER_SET.add("com.fr.form.ui.ElementCaseImage"); |
||||
FILTER_SET.add("this$0"); |
||||
START_WITH_SET.add("com.fr.design"); |
||||
} |
||||
|
||||
@Override |
||||
public boolean accept(String s) { |
||||
if (FILTER_SET.contains(s)) { |
||||
return true; |
||||
} |
||||
for (String start : START_WITH_SET) { |
||||
if (s.startsWith(start)) { |
||||
return true; |
||||
} |
||||
} |
||||
return false; |
||||
} |
||||
} |
||||
} |
||||
|
||||
@ -0,0 +1,22 @@
|
||||
package com.fr.design.mainframe.authority; |
||||
|
||||
import com.fr.data.impl.NameDatabaseConnection; |
||||
import org.jetbrains.annotations.Nullable; |
||||
|
||||
import java.util.Arrays; |
||||
import java.util.HashSet; |
||||
import java.util.Set; |
||||
import java.util.stream.Collectors; |
||||
|
||||
public class NameDatabaseConnectionAuthorityChecker extends ElementAuthorityChecker<NameDatabaseConnection> { |
||||
@Override |
||||
@Nullable |
||||
Set<String> getNoAuthConnectionNames(NameDatabaseConnection nameDatabaseConnection, Set<String> authConnectionNames) { |
||||
String name = nameDatabaseConnection.getName(); |
||||
if (!authConnectionNames.contains(name)) { |
||||
return new HashSet<>(Arrays.asList(name)); |
||||
} |
||||
return null; |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,19 @@
|
||||
package com.fr.design.mainframe.authority; |
||||
|
||||
import com.fr.data.impl.NameTableData; |
||||
import org.jetbrains.annotations.Nullable; |
||||
|
||||
import java.util.Arrays; |
||||
import java.util.HashSet; |
||||
import java.util.Set; |
||||
|
||||
public class NameTableDataAuthorityChecker extends ElementAuthorityChecker<NameTableData> { |
||||
@Override |
||||
@Nullable |
||||
Set<String> getNoAuthDatasetNames(NameTableData nameTableData, Set<String> authDatasetNames) { |
||||
if (!authDatasetNames.contains(nameTableData.getName())) { |
||||
return new HashSet<>(Arrays.asList(nameTableData.getName())); |
||||
} |
||||
return null; |
||||
} |
||||
} |
||||
@ -0,0 +1,46 @@
|
||||
package com.fr.design.utils.gui; |
||||
|
||||
import com.fr.base.Style; |
||||
import com.fr.base.background.ColorBackground; |
||||
import com.fr.design.base.mode.DesignModeContext; |
||||
import com.fr.report.cell.CellElement; |
||||
import com.fr.report.cell.FloatElement; |
||||
|
||||
import java.awt.Color; |
||||
|
||||
/** |
||||
* @author shine |
||||
* @version 10.0 |
||||
* Created by shine on 2021/9/6 |
||||
*/ |
||||
public class AdjustWorkBookDefaultStyleUtils { |
||||
|
||||
private static final Color TEMPLATE_BACKGROUND = new Color(16, 11, 43); |
||||
private static final Color CELL_ELEMENT_BORDER = new Color(110, 110, 110); |
||||
|
||||
public static void adjustCellElement(CellElement cellElement) { |
||||
if (DesignModeContext.isDuchampMode()) { |
||||
Style style = cellElement.getStyle(); |
||||
style = style.deriveFRFont(style.getFRFont().applyForeground(Color.WHITE)); |
||||
style = style.deriveBorder(0, CELL_ELEMENT_BORDER, |
||||
0, CELL_ELEMENT_BORDER, |
||||
0, CELL_ELEMENT_BORDER, |
||||
0, CELL_ELEMENT_BORDER); |
||||
cellElement.setStyle(style); |
||||
} |
||||
} |
||||
|
||||
public static void adjustFloatElement(FloatElement floatElement) { |
||||
if (DesignModeContext.isDuchampMode()) { |
||||
Style style = floatElement.getStyle(); |
||||
style = style.deriveBackground(ColorBackground.getInstance(TEMPLATE_BACKGROUND)); |
||||
style = style.deriveFRFont(style.getFRFont().applyForeground(Color.WHITE)); |
||||
floatElement.setStyle(style); |
||||
} |
||||
} |
||||
|
||||
public static Color adjustBack(Color color) { |
||||
return DesignModeContext.isDuchampMode() ? TEMPLATE_BACKGROUND : color; |
||||
} |
||||
|
||||
} |
||||
Loading…
Reference in new issue