New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

1.12.11 #243

Merged

erupts merged 34 commits into master from develop

Apr 14, 2024

Owner

erupts commented Apr 14, 2024

🐞 修复 mongodb 场景在字段上添加注解不生效的 bug (感谢iszhangsc 的贡献#231)
🐞 Erupt-BI 解决存在必填项时自定义模板404的 bug
🧩 Erupt-BI 兼容 JDK17
🧩 筛选场景下支持清除 choice 组件已输入值
🌟 无障碍能力支持灰色模式
🌟 Erupt-BI 查询维度支持参照表格组件，表格内部支持虚拟滚动，列筛选，列排序等能力
🌟 自定义按钮增加调用时提示文本配置能力（callHint�），为空则表示不提示
🌟 增加 Linq.J 依赖，基于内存的对象查询语言，用于内存级对象查询与 Lambda 映射
🌟 userinfo 接口增加返回组织编码、岗位编码、角色编码
🌟 将 erupt-magic-api 资源重载配置能力配置到菜单权限中
手动删除erupt-magic-api.loaded文件按钮重载权限会自动添加到菜单中
🌟 ViewType增加SAFE_TEXT类型，文本中带有脚本或标签信息不会被前端渲染
🌟 提高渲染性能，所有树组件都增加虚拟滚动能力，如果节点条数大于 50 则会开启
🌟 自定义按钮支持代码弹出能力，配置语言与内容即可
🌟 EruptDao支持 LambdaQuery 语法查询能力

List<EruptUser> eruptUsers = eruptDao.lambdaQuery(EruptUser.class)
                .like(EruptUser::getName, "erupt")
                .isNull(EruptUser::getWhiteIp).list();

🌟 破坏性更新：因在跨国工作等场景很容易出现本地时间和服务器事件不一致的情况导致无法登录，所以调整登录时密码加密规则 https://www.yuque.com/erupts/erupt/vr4md2#jgeb，自定义登录规则的用户需要对此进行调整

陈浩然 and others added 30 commits

November 1, 2023 18:00


          flow自动添加菜单 地址不正确

08556db


          fix(erupt-mongodb): 修复mongodb @field注解字段映射

1479f64


          update developer name

21cc69e


          优化 xss攻击的检测过程

c5cf043


          调整初始菜单名称

6dbd0c5


          ViewType增加SAFE_TEXT类型，文本中带有脚本或标签信息不会被前端渲染

8705b7a


          Merge pull request #209 from chenhan-max/master

a38adf4

flow自动添加菜单 地址不正确 访问404


          flow自动添加菜单 地址不正确 访问404

aa21076


          修复类型为 number 时自动推断结果不准确的 bug

376eb2b


          将magic-api资源重载配置能力配置到权限中

9a2284b


          超管用户权限不包含禁用的菜单

1dd6baa


          超管用户权限不包含禁用的菜单 rollback

deee003


          引入 lambda 获取 method 的语法，重构所有 proxy 的代理注解

3e77ed0


          eruptDao增加 lambda 语法查询能力

2e07e35


          增加SQL 查询 lambda 语法支持 ：eruptDao.lambdaQuery(EruptUser.class).lik(Erupt…

17cc220

…User::getName, "e").isNul(EruptUser::getWhiteIp).addCondition("whiteIp is null").list()


          调整查询语法至 lambda

2e4006c


          use lambdaQuery and LambdaField

3070d2a


          add linq.j dependency

ed803c4


          调整 lambda 能力的提供方：linq.j

9bde38c


          update erupt-web

e18aac9


          update erupt-web

3e2f1ad


          userinfo接口增加返回组织编码、岗位编码、角色编码

a62c49a


          upgrade to 1.12.11

e5d599c


          upgrade Linq.J version

d11124e


          因为在跨国工作等场景很容易出现本地事件和服务器事件不一致的情况导致无法登录，所以调整登录时密码加密规则，md5(md5(pwd) + Ca…

ce589f9

…lendar.DAY_OF_MONTH + account) → md5(md5(pwd) + account) 移除通过当前天作为加密依据


          自定义按钮增加自定义调用提示词，为空则表示不提示

ec89e46


          自定义按钮增加自定义调用提示词，为空则表示不提示

76df65c


          Merge pull request #231 from iszhangsc/fix-mongodb

7e69dce

Fix mongodb


          update erupt-web

d9c3b35


          Merge remote-tracking branch 'origin/develop' into develop

c9b2756

erupts added 4 commits

April 14, 2024 00:03


          解决 mongodb 新 pr带来的 bug

5bb68d2


          update erupt-web

2308a09


          update erupt-web

f23f72e


          update erupt-web

db7deb4

erupts merged commit 867c065 into master

2 checks passed

github-advanced-security bot found potential problems

View reviewed changes

erupt-core/src/main/java/xyz/erupt/core/util/SecurityUtil.java

@@ @@ -23,69 +23,61 @@ @@
                       if (StringUtils.isNotBlank(value)) {
                           // 避免script 标签
                           Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);
-                          if (scriptPattern.matcher(value).matches()) {
+                          if (scriptPattern.matcher(value).find()) {

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script>' and with many repetitions of '<script>a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script>' and with many repetitions of '<script>a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script>' and with many repetitions of '<script>a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script>' and with many repetitions of '<script>a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script>' and with many repetitions of '<script>a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script>' and with many repetitions of '<script>a'.

erupt-core/src/main/java/xyz/erupt/core/util/SecurityUtil.java

                               return true;
                           }
                           // 删除单个的<script ...> 标签
                           scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
-                          if (scriptPattern.matcher(value).matches()) {
+                          if (scriptPattern.matcher(value).find()) {

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script' and with many repetitions of '<scripta'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script' and with many repetitions of '<scripta'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script' and with many repetitions of '<scripta'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script' and with many repetitions of '<scripta'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script' and with many repetitions of '<scripta'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with '<script' and with many repetitions of '<scripta'.

erupt-core/src/main/java/xyz/erupt/core/util/SecurityUtil.java

                               return true;
                           }
                           // 避免 eval(...) 形式表达式
                           scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
-                          if (scriptPattern.matcher(value).matches()) {
+                          if (scriptPattern.matcher(value).find()) {

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'eval(' and with many repetitions of 'eval(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'eval(' and with many repetitions of 'eval(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'eval(' and with many repetitions of 'eval(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'eval(' and with many repetitions of 'eval(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'eval(' and with many repetitions of 'eval(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'eval(' and with many repetitions of 'eval(a'.

erupt-core/src/main/java/xyz/erupt/core/util/SecurityUtil.java

    
                          if (scriptPattern.matcher(value).matches()) {

                          // 避免 expression(...) 表达式

                          scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

                          if (scriptPattern.matcher(value).find()) {

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'expression(' and with many repetitions of 'expression(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'expression(' and with many repetitions of 'expression(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'expression(' and with many repetitions of 'expression(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'expression(' and with many repetitions of 'expression(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'expression(' and with many repetitions of 'expression(a'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'expression(' and with many repetitions of 'expression(a'.

erupt-core/src/main/java/xyz/erupt/core/util/SecurityUtil.java

                               return true;
                           }
                           // 避免 onload= 表达式
                           scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
-                          if (scriptPattern.matcher(value).matches()) {
+                          if (scriptPattern.matcher(value).find()) {

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onload' and with many repetitions of 'onloada'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onload' and with many repetitions of 'onloada'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onload' and with many repetitions of 'onloada'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onload' and with many repetitions of 'onloada'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onload' and with many repetitions of 'onloada'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onload' and with many repetitions of 'onloada'.

erupt-core/src/main/java/xyz/erupt/core/util/SecurityUtil.java

                               return true;
                           }
                           // 避免 onmouseover= 表达式
                           scriptPattern = Pattern.compile("onmouseover(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
-                          if (scriptPattern.matcher(value).matches()) {
+                          if (scriptPattern.matcher(value).find()) {

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onmouseover' and with many repetitions of 'onmouseovera'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onmouseover' and with many repetitions of 'onmouseovera'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onmouseover' and with many repetitions of 'onmouseovera'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onmouseover' and with many repetitions of 'onmouseovera'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onmouseover' and with many repetitions of 'onmouseovera'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onmouseover' and with many repetitions of 'onmouseovera'.

erupt-core/src/main/java/xyz/erupt/core/util/SecurityUtil.java

                               return true;
                           }
                           // 避免 onfocus= 表达式
                           scriptPattern = Pattern.compile("onfocus(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
-                          if (scriptPattern.matcher(value).matches()) {
+                          if (scriptPattern.matcher(value).find()) {

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onfocus' and with many repetitions of 'onfocusa'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onfocus' and with many repetitions of 'onfocusa'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onfocus' and with many repetitions of 'onfocusa'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onfocus' and with many repetitions of 'onfocusa'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onfocus' and with many repetitions of 'onfocusa'.
This

regular expression

that depends on a

user-provided value

may run slow on strings starting with 'onfocus' and with many repetitions of 'onfocusa'.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet