chore(v0.11): 全路径纳入版本库与走查整改

- .gitignore：显式放行全部 maven-*、scripts、dev-support、frontend、反1、artifacts、历史导出目录 - 新增跟踪：device-manager/device-sdk/legacy-public、davinci-manager、cwos-*、cwos-resource 等源码与附属资源 - davinci FileStorageManagerImpl：Feign Response 关闭、绝对 URL 拉流 SSRF 校验（协议/主机/解析地址） - davinci OuterCallFeignClient：补充契约说明 - cwos-common-aks AksConstant：final 类 + 私有构造防误实例化 - device-manager DeviceConstant：沿用 DEFAULT_APPLICATIONID 拼写修正 Made-with: Cursor
2026-06-10 00:40:30 +08:00 · 2026-04-24 23:54:05 +08:00
parent de6245a492
commit 0a34c76a82
3193 changed files with 227337 additions and 1 deletions
@@ -0,0 +1,86 @@
+package cn.cloudwalk.web.filter;
+
+import cn.cloudwalk.cloud.context.CloudwalkSessionContextHolder;
+import cn.cloudwalk.cloud.context.CloudwalkSessionObject;
+import java.io.IOException;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+
+
+
+
+
+
+
+
+
+
+
+
+@Component
+@Order(2147483547)
+public class CloudwalkContextParameterFilter
+extends OncePerRequestFilter
+{
+private final Logger logger = LoggerFactory.getLogger(getClass());
+
+
+
+
+
+
+@Autowired
+private CloudwalkSessionContextHolder cloudwalkSessionContextHolder;
+
+
+
+
+
+
+protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
+String businessId = request.getHeader("businessId");
+
+String userId = request.getHeader("platformUserId");
+if (StringUtils.isEmpty(userId)) {
+userId = "platformUserId";
+}
+
+
+String username = request.getHeader("username");
+if (StringUtils.isEmpty(username)) {
+username = "username";
+}
+
+
+String serviceCode = request.getHeader("serviceCode");
+
+String corpCode = request.getHeader("corpCode");
+
+
+CloudwalkSessionObject sessionObject = new CloudwalkSessionObject(userId, serviceCode, businessId, corpCode, username);
+
+this.cloudwalkSessionContextHolder.putSession(sessionObject);
+
+try {
+chain.doFilter((ServletRequest)request, (ServletResponse)response);
+} catch (Exception e) {
+this.logger.error("参数注册过滤器失败,原因:", e);
+} finally {
+this.cloudwalkSessionContextHolder.clearSession();
+} 
+}
+}
+
+
@@ -0,0 +1,19 @@
+package cn.cloudwalk.web.filter;
+
+public interface GeneralParameterConst {
+  public static final String BUSINESS_ID = "businessId";
+  
+  public static final String CORP_CODE = "corpCode";
+  
+  public static final String SERVICE_CODE = "serviceCode";
+  
+  public static final String USER_ID = "platformUserId";
+  
+  public static final String USER_NAME = "username";
+  
+  public static final String DEFAULT_USER_ID = "0";
+  
+  public static final String DEFAULT_USER_NAME = "默认用户";
+}
+
+
@@ -0,0 +1,52 @@
+package cn.cloudwalk.web.start.config;
+
+import cn.cloudwalk.cloud.context.CloudwalkSessionContextHolder;
+import java.util.Locale;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.HandlerInterceptor;
+import org.springframework.web.servlet.LocaleResolver;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+import org.springframework.web.servlet.i18n.LocaleChangeInterceptor;
+import org.springframework.web.servlet.i18n.SessionLocaleResolver;
+
+
+
+
+
+
+
+
+
+
+@Configuration
+public class LocaleConfiguration
+extends WebMvcConfigurerAdapter
+{
+@Bean
+public LocaleResolver localeResolver() {
+SessionLocaleResolver slr = new SessionLocaleResolver();
+slr.setDefaultLocale(Locale.SIMPLIFIED_CHINESE);
+return (LocaleResolver)slr;
+}
+
+@Bean
+public LocaleChangeInterceptor localeChangeInterceptor() {
+LocaleChangeInterceptor interceptor = new LocaleChangeInterceptor();
+interceptor.setParamName("lang");
+return interceptor;
+}
+
+
+public void addInterceptors(InterceptorRegistry registry) {
+registry.addInterceptor((HandlerInterceptor)localeChangeInterceptor());
+}
+
+@Bean
+public CloudwalkSessionContextHolder cloudwalkSessionContextHolder() {
+return new CloudwalkSessionContextHolder();
+}
+}
+
+
@@ -0,0 +1,40 @@
+package cn.cloudwalk.web.xss.filter;
+
+import cn.cloudwalk.web.xss.wrapper.XssHttpServletRequestWrapper;
+import java.io.IOException;
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+public class XssFilter
+implements Filter
+{
+public void init(FilterConfig filterConfig) throws ServletException {}
+
+public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+chain.doFilter((ServletRequest)new XssHttpServletRequestWrapper((HttpServletRequest)request), response);
+}
+
+public void destroy() {}
+}
+
+
@@ -0,0 +1,142 @@
+package cn.cloudwalk.web.xss.util;
+
+import java.util.regex.Pattern;
+import org.apache.commons.lang3.StringUtils;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+public class CustomXssUtil
+{
+/*  21 */   private static final Pattern SCRIPT_PATTERN = Pattern.compile("<script>(.*?)</script>", 2);
+
+
+
+
+/*  26 */   private static final Pattern SRC_PATTERN1 = Pattern.compile("src[\r\n]*=[\r\n]*\\'(.*?)\\'", 42);
+
+/*  28 */   private static final Pattern SRC_PATTERN2 = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", 42);
+
+
+
+
+
+/*  34 */   private static final Pattern SINGLE_SCRIPT_PATTERN1 = Pattern.compile("</script>", 2);
+/*  35 */   private static final Pattern SINGLE_SCRIPT_PATTERN2 = Pattern.compile("<script(.*?)>", 42);
+
+
+
+
+
+/*  41 */   private static final Pattern IMG_SCRIPT_PATTERN = Pattern.compile("<img.*?on.*?=.*?>", 2);
+
+
+
+
+/*  46 */   private static final Pattern EVAL_PATTERN = Pattern.compile("eval\\((.*?)\\)", 42);
+
+
+
+
+
+/*  52 */   private static final Pattern EXPRESSION_PATTERN = Pattern.compile("expression\\((.*?)\\)", 42);
+
+
+
+
+
+/*  58 */   private static final Pattern JS_PATTERN = Pattern.compile("javascript:", 2);
+
+
+
+
+/*  63 */   private static final Pattern VBS_PATTERN = Pattern.compile("vbscript:", 2);
+
+
+
+
+/*  68 */   private static final Pattern ONLOAD_PATTERN = Pattern.compile("onload(.*?)=", 42);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+public static String stripXSS(String value) {
+/*  96 */     if (StringUtils.isBlank(value)) {
+/*  97 */       return value;
+}
+
+
+
+
+
+value = SCRIPT_PATTERN.matcher(value).replaceAll("");
+
+
+value = SRC_PATTERN1.matcher(value).replaceAll("");
+value = SRC_PATTERN2.matcher(value).replaceAll("");
+
+
+value = SINGLE_SCRIPT_PATTERN1.matcher(value).replaceAll("");
+
+
+value = SINGLE_SCRIPT_PATTERN2.matcher(value).replaceAll("");
+
+
+value = IMG_SCRIPT_PATTERN.matcher(value).replaceAll("");
+
+
+value = EVAL_PATTERN.matcher(value).replaceAll("");
+
+
+value = EXPRESSION_PATTERN.matcher(value).replaceAll("");
+
+
+value = JS_PATTERN.matcher(value).replaceAll("");
+
+
+value = VBS_PATTERN.matcher(value).replaceAll("");
+
+
+value = ONLOAD_PATTERN.matcher(value).replaceAll("");
+
+return value;
+}
+
+public static void main(String[] args) {
+System.out.println(stripXSS("\\\"><img src=x onerror=alert(1)>"));
+}
+}
+
+
@@ -0,0 +1,151 @@
+package cn.cloudwalk.web.xss.wrapper;
+
+import cn.cloudwalk.web.xss.util.CustomXssUtil;
+import java.io.BufferedReader;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import javax.servlet.ReadListener;
+import javax.servlet.ServletInputStream;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+public class XssHttpServletRequestWrapper
+extends HttpServletRequestWrapper
+{
+private final String body;
+
+public XssHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
+/*  35 */     super(request);
+
+
+/*  38 */     if (request instanceof org.springframework.web.multipart.MultipartHttpServletRequest) {
+/*  39 */       this.body = null;
+
+return;
+} 
+/*  43 */     StringBuilder stringBuilder = new StringBuilder();
+/*  44 */     BufferedReader bufferedReader = null;
+try {
+/*  46 */       ServletInputStream servletInputStream = request.getInputStream();
+/*  47 */       if (servletInputStream != null) {
+/*  48 */         bufferedReader = new BufferedReader(new InputStreamReader((InputStream)servletInputStream));
+/*  49 */         char[] charBuffer = new char[1024];
+/*  50 */         int bytesRead = -1;
+/*  51 */         while ((bytesRead = bufferedReader.read(charBuffer)) > 0) {
+/*  52 */           stringBuilder.append(charBuffer, 0, bytesRead);
+}
+} 
+/*  55 */     } catch (IOException ex) {
+/*  56 */       throw ex;
+} finally {
+/*  58 */       if (bufferedReader != null) {
+try {
+/*  60 */           bufferedReader.close();
+/*  61 */         } catch (IOException ex) {
+/*  62 */           throw ex;
+} 
+}
+} 
+
+
+/*  68 */     this.body = CustomXssUtil.stripXSS(stringBuilder.toString());
+}
+
+
+
+
+
+
+public String getHeader(String name) {
+/*  77 */     String value = super.getHeader(name);
+/*  78 */     return CustomXssUtil.stripXSS(value);
+}
+
+
+
+
+
+
+public String getParameter(String name) {
+/*  87 */     String value = super.getParameter(name);
+/*  88 */     return CustomXssUtil.stripXSS(value);
+}
+
+
+
+
+
+
+public String[] getParameterValues(String name) {
+/*  97 */     String[] values = super.getParameterValues(name);
+/*  98 */     if (values == null) {
+/*  99 */       return null;
+}
+int count = values.length;
+String[] encodedValues = new String[count];
+for (int i = 0; i < count; i++) {
+encodedValues[i] = CustomXssUtil.stripXSS(values[i]);
+}
+return encodedValues;
+}
+
+
+
+
+public ServletInputStream getInputStream() throws IOException {
+HttpServletRequest request = (HttpServletRequest)getRequest();
+if (request instanceof org.springframework.web.multipart.MultipartHttpServletRequest) {
+return super.getInputStream();
+}
+
+final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(this.body.getBytes());
+ServletInputStream servletInputStream = new ServletInputStream() {
+public int read() throws IOException {
+return byteArrayInputStream.read();
+}
+
+
+public boolean isFinished() {
+return false;
+}
+
+
+public boolean isReady() {
+return false;
+}
+
+
+
+public void setReadListener(ReadListener readListener) {}
+};
+return servletInputStream;
+}
+
+
+public BufferedReader getReader() throws IOException {
+return new BufferedReader(new InputStreamReader((InputStream)getInputStream()));
+}
+
+public String getBody() {
+return this.body;
+}
+}
+
+