Glm5

blog-api/src/main/java/com/shimh/config/WebMvcConfig.java

@@ -46,7 +46,7 @@ public void configureMessageConverters(List<HttpMessageConverter<?>> converters)
         );
 
 
-        List<MediaType> fastMediaTypes = new ArrayList<>();
+        List<MediaType> fastMediaTypes = new ArrayList();
         fastMediaTypes.add(MediaType.APPLICATION_JSON_UTF8);
 
         fastConverter.setFastJsonConfig(fastJsonConfig);

blog-api/src/main/java/com/shimh/controller/ArticleController.java

@@ -173,11 +173,15 @@ public Result updateArticle(@RequestBody Article article) {
         Result r = new Result();
 
         if (null == article.getId()) {
-            r.setResultCode(ResultCode.USER_NOT_EXIST);
+            r.setResultCode(ResultCode.PARAM_IS_BLANK);
             return r;
         }
 
         Integer articleId = articleService.updateArticle(article);
+        if (null == articleId) {
+            r.setResultCode(ResultCode.RESULE_DATA_NONE);
+            return r;
+        }
 
         r.setResultCode(ResultCode.SUCCESS);
         r.simple().put("articleId", articleId);

blog-api/src/main/java/com/shimh/controller/CategoryController.java

@@ -107,11 +107,15 @@ public Result updateCategory(@RequestBody Category category) {
         Result r = new Result();
 
         if (null == category.getId()) {
-            r.setResultCode(ResultCode.USER_NOT_EXIST);
+            r.setResultCode(ResultCode.PARAM_IS_BLANK);
             return r;
         }
 
         Integer categoryId = categoryService.updateCategory(category);
+        if (null == categoryId) {
+            r.setResultCode(ResultCode.RESULE_DATA_NONE);
+            return r;
+        }
 
         r.setResultCode(ResultCode.SUCCESS);
         r.simple().put("categoryId", categoryId);

blog-api/src/main/java/com/shimh/controller/CommentController.java

@@ -131,6 +131,9 @@ public Result deleteCommentById(@PathVariable("id") Integer id) {
     public Result saveCommentAndChangeCounts(@RequestBody Comment comment) {
 
         Comment savedComment = commentService.saveCommentAndChangeCounts(comment);
+        if (null == savedComment) {
+            return Result.error(ResultCode.PARAM_IS_INVALID);
+        }
 
         Result r = Result.success(savedComment);
         return r;

blog-api/src/main/java/com/shimh/controller/TagController.java

@@ -46,10 +46,10 @@ public Result listTags() {
 
     @GetMapping("detail")
     @LogAnnotation(module = "标签", operation = "获取所有标签，详细")
-    public Result listCategorysDetail() {
-        List<TagVO> categorys = tagService.findAllDetail();
+    public Result listTagsDetail() {
+        List<TagVO> tags = tagService.findAllDetail();
 
-        return Result.success(categorys);
+        return Result.success(tags);
     }
 
     @GetMapping("/hot")
@@ -116,11 +116,15 @@ public Result updateTag(@RequestBody Tag tag) {
         Result r = new Result();
 
         if (null == tag.getId()) {
-            r.setResultCode(ResultCode.USER_NOT_EXIST);
+            r.setResultCode(ResultCode.PARAM_IS_BLANK);
             return r;
         }
 
         Integer tagId = tagService.updateTag(tag);
+        if (null == tagId) {
+            r.setResultCode(ResultCode.RESULE_DATA_NONE);
+            return r;
+        }
 
         r.setResultCode(ResultCode.SUCCESS);
         r.simple().put("tagId", tagId);

blog-api/src/main/java/com/shimh/controller/UploadController.java

@@ -14,6 +14,7 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -25,17 +26,53 @@ public class UploadController {
 
     private static final Logger logger = LoggerFactory.getLogger(UploadController.class);
 
+    private static final java.util.Set<String> ALLOWED_EXTENSIONS = new java.util.HashSet<>(java.util.Arrays.asList(
+            "jpg", "jpeg", "png", "gif", "bmp", "webp"
+    ));
 
     @Value("${me.upload.path}")
     private String baseFolderPath;
 
+    private String getFileExtension(String filename) {
+        if (filename == null || filename.lastIndexOf(".") == -1) {
+            return "";
+        }
+        return filename.substring(filename.lastIndexOf(".") + 1).toLowerCase();
+    }
+
+    private boolean isAllowedExtension(String extension) {
+        return extension != null && ALLOWED_EXTENSIONS.contains(extension);
+    }
+
+    private String sanitizeFilename(String filename) {
+        return filename.replaceAll("[^a-zA-Z0-9.\\-_]", "_");
+    }
+
     @PostMapping("/upload")
     @RequiresAuthentication
     @LogAnnotation(module = "文件上传", operation = "文件上传")
-    public Result upload(HttpServletRequest request, MultipartFile image) {
+    public Result upload(HttpServletRequest request, @RequestParam("image") MultipartFile image) {
 
         Result r = new Result();
 
+        if (image == null || image.isEmpty()) {
+            r.setResultCode(ResultCode.PARAM_IS_BLANK);
+            return r;
+        }
+
+        String originalFilename = image.getOriginalFilename();
+        if (originalFilename == null || originalFilename.isEmpty()) {
+            r.setResultCode(ResultCode.PARAM_IS_INVALID);
+            return r;
+        }
+
+        String extension = getFileExtension(originalFilename);
+        if (!isAllowedExtension(extension)) {
+            r.setResultCode(ResultCode.PARAM_IS_INVALID);
+            r.simple().put("errdetail", "不支持的文件类型");
+            return r;
+        }
+
         SimpleDateFormat sdf = new SimpleDateFormat("yyyyMMdd");
 
         StringBuffer url = new StringBuffer();
@@ -55,11 +92,19 @@ public Result upload(HttpServletRequest request, MultipartFile image) {
                 .append("/")
                 .append(filePath);
 
-        String imgName = UUID.randomUUID() + "_" + image.getOriginalFilename().replaceAll(" ", "");
+        String safeFilename = sanitizeFilename(originalFilename);
+        String imgName = UUID.randomUUID().toString() + "_" + safeFilename;
 
         try {
 
             File dest = new File(baseFolder, imgName);
+            String canonicalPath = dest.getCanonicalPath();
+            if (!canonicalPath.startsWith(baseFolder.getCanonicalPath())) {
+                r.setResultCode(ResultCode.PARAM_IS_INVALID);
+                r.simple().put("errdetail", "非法文件路径");
+                return r;
+            }
+
             image.transferTo(dest);
 
             url.append("/").append(imgName);

blog-api/src/main/java/com/shimh/controller/UserController.java

@@ -106,11 +106,15 @@ public Result updateUser(@RequestBody User user) {
         Result r = new Result();
 
         if (null == user.getId()) {
-            r.setResultCode(ResultCode.USER_NOT_EXIST);
+            r.setResultCode(ResultCode.PARAM_IS_BLANK);
             return r;
         }
 
         Long userId = userService.updateUser(user);
+        if (null == userId) {
+            r.setResultCode(ResultCode.RESULE_DATA_NONE);
+            return r;
+        }
 
         r.setResultCode(ResultCode.SUCCESS);
         r.simple().put("userId", userId);

blog-api/src/main/java/com/shimh/oauth/OAuthSessionManager.java

@@ -34,10 +34,13 @@ protected Serializable getSessionId(ServletRequest request, ServletResponse resp
         HttpServletRequest httpRequest = (HttpServletRequest) request;
         String id = httpRequest.getHeader(OAUTH_TOKEN);
 
-        request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE);
-        request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
-        request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
-        return id;
+        if (!StringUtils.isEmpty(id)) {
+            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE);
+            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
+            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
+            return id;
+        }
+        return super.getSessionId(request, response);
     }
 }
 

blog-api/src/main/java/com/shimh/repository/impl/ArticleRepositoryImpl.java

@@ -17,26 +17,44 @@
 
 import javax.persistence.EntityManager;
 import javax.persistence.PersistenceContext;
+import java.util.Arrays;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 public class ArticleRepositoryImpl implements ArticleWrapper {
 
     @PersistenceContext
     private EntityManager em;
 
+    private static final Set<String> ALLOWED_SORT_FIELDS = new HashSet<>(Arrays.asList(
+            "id", "title", "createDate", "viewCounts", "commentCounts", "weight"
+    ));
+
+    private static final Set<String> ALLOWED_SORT_ORDERS = new HashSet<>(Arrays.asList(
+            "asc", "desc", "ASC", "DESC"
+    ));
+
+    private boolean isValidSortField(String field) {
+        return field != null && ALLOWED_SORT_FIELDS.contains(field);
+    }
+
+    private boolean isValidSortOrder(String order) {
+        return order != null && ALLOWED_SORT_ORDERS.contains(order);
+    }
+
     @Override
     public List<Article> listArticles(PageVo page) {
 
         StringBuilder hql = new StringBuilder("from Article");
 
-        if (null != page.getName() && !"".equals(page.getName())) {
+        if (isValidSortField(page.getName())) {
             hql.append(" order by ");
             hql.append(page.getName());
-        }
-
-        if (null != page.getSort() && !"".equals(page.getSort())) {
-            hql.append(" ");
-            hql.append(page.getSort());
+            if (isValidSortOrder(page.getSort())) {
+                hql.append(" ");
+                hql.append(page.getSort());
+            }
         }
 
         Query query = getSession().createQuery(hql.toString());
@@ -81,14 +99,13 @@ public List<Article> listArticles(ArticleVo article, PageVo page) {
             hql.append(" and MONTH(a.createDate) = :month");
         }
 
-        if (null != page.getName() && !"".equals(page.getName())) {
+        if (isValidSortField(page.getName())) {
             hql.append(" order by ");
             hql.append(page.getName());
-        }
-
-        if (null != page.getSort() && !"".equals(page.getSort())) {
-            hql.append(" ");
-            hql.append(page.getSort());
+            if (isValidSortOrder(page.getSort())) {
+                hql.append(" ");
+                hql.append(page.getSort());
+            }
         }
 
 

blog-api/src/main/java/com/shimh/service/impl/ArticleServiceImpl.java

@@ -52,7 +52,7 @@ public List<Article> findAll() {
 
     @Override
     public Article getArticleById(Integer id) {
-        return articleRepository.getOne(id);
+        return articleRepository.findOne(id);
     }
 
     @Override
@@ -86,8 +86,10 @@ public Integer saveArticle(Article article) {
     @Override
     @Transactional
     public Integer updateArticle(Article article) {
-        Article oldArticle = articleRepository.getOne(article.getId());
-
+        Article oldArticle = articleRepository.findOne(article.getId());
+        if (oldArticle == null) {
+            return null;
+        }
         oldArticle.setTitle(article.getTitle());
         oldArticle.setSummary(article.getSummary());
         oldArticle.setBody(article.getBody());
@@ -122,7 +124,10 @@ public List<Article> listArticlesByCategory(Integer id) {
     @Transactional
     public Article getArticleAndAddViews(Integer id) {
         int count = 1;
-        Article article = articleRepository.getOne(id);
+        Article article = articleRepository.findOne(id);
+        if (article == null) {
+            return null;
+        }
         article.setViewCounts(article.getViewCounts() + count);
         return article;
     }

blog-api/src/main/java/com/shimh/service/impl/CategoryServiceImpl.java

@@ -30,7 +30,7 @@ public List<Category> findAll() {
 
     @Override
     public Category getCategoryById(Integer id) {
-        return categoryRepository.getOne(id);
+        return categoryRepository.findOne(id);
     }
 
     @Override
@@ -43,8 +43,10 @@ public Integer saveCategory(Category category) {
     @Override
     @Transactional
     public Integer updateCategory(Category category) {
-        Category oldCategory = categoryRepository.getOne(category.getId());
-
+        Category oldCategory = categoryRepository.findOne(category.getId());
+        if (oldCategory == null) {
+            return null;
+        }
         oldCategory.setCategoryname(category.getCategoryname());
         oldCategory.setAvatar(category.getAvatar());
         oldCategory.setDescription(category.getDescription());

blog-api/src/main/java/com/shimh/service/impl/CommentServiceImpl.java

@@ -42,7 +42,7 @@ public List<Comment> findAll() {
 
     @Override
     public Comment getCommentById(Integer id) {
-        return commentRepository.getOne(id);
+        return commentRepository.findOne(id);
     }
 
     @Override
@@ -72,12 +72,14 @@ public Comment saveCommentAndChangeCounts(Comment comment) {
 
         int count = 1;
         Article a = articleRepository.findOne(comment.getArticle().getId());
+        if (a == null) {
+            return null;
+        }
         a.setCommentCounts(a.getCommentCounts() + count);
 
         comment.setAuthor(UserUtils.getCurrentUser());
         comment.setCreateDate(new Date());
 
-        //设置level
         if(null == comment.getParent()){
             comment.setLevel("0");
         }else{
@@ -97,9 +99,13 @@ public Comment saveCommentAndChangeCounts(Comment comment) {
     public void deleteCommentByIdAndChangeCounts(Integer id) {
         int count = 1;
         Comment c = commentRepository.findOne(id);
+        if (c == null) {
+            return;
+        }
         Article a = c.getArticle();
-
-        a.setCommentCounts(a.getCommentCounts() - count);
+        if (a != null) {
+            a.setCommentCounts(a.getCommentCounts() - count);
+        }
 
         commentRepository.delete(c);
     }

blog-api/src/main/java/com/shimh/service/impl/TagServiceImpl.java

@@ -30,7 +30,7 @@ public List<Tag> findAll() {
 
     @Override
     public Tag getTagById(Integer id) {
-        return tagRepository.getOne(id);
+        return tagRepository.findOne(id);
     }
 
     @Override
@@ -43,8 +43,10 @@ public Integer saveTag(Tag tag) {
     @Override
     @Transactional
     public Integer updateTag(Tag tag) {
-        Tag oldTag = tagRepository.getOne(tag.getId());
-
+        Tag oldTag = tagRepository.findOne(tag.getId());
+        if (oldTag == null) {
+            return null;
+        }
         oldTag.setTagname(tag.getTagname());
         oldTag.setAvatar(tag.getAvatar());