lsm/hutool
1
0
Fork 0
mirror of https://gitee.com/dromara/hutool.git synced 2025-04-05 17:20:07 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

修复CVE-2023-24163漏洞

Browse Source
This commit is contained in:
Looly 2023-07-29 13:56:02 +08:00
parent 9f777b3554
commit 0eee7eadc7
10 changed files with 44 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -35,6 +35,7 @@
* 【core 】 修复VersionComparator对1.0.3及1.0.2a比较有误的问题（pr#1043@Gitee）
* 【core 】 修复IOS系统下，chrome 浏览器的解析规则有误（pr#1044@Gitee）
* 【extra 】 修复多线程下Sftp中Channel关闭的问题（issue#I7OHIB@Gitee）
* 【extra 】 修复CVE-2023-24163漏洞（issue#I6AJWJ@Gitee）
-------------------------------------------------------------------------------------------------------------
# 5.8.20(2023-06-16)

11
hutool-extra/src/main/java/cn/hutool/extra/expression/ExpressionEngine.java
View File

@ -1,20 +1,23 @@
package cn.hutool.extra.expression;
import java.util.Collection;
import java.util.Map;
/**
* 表达式引擎API接口，通过实现此接口，完成表达式的解析和执行
*
* @author looll,independenter
* @author looll, independenter
* @since 5.5.0
*/
public interface ExpressionEngine {
/**
* 执行表达式
* @param expression 表达式
* @param context 表达式上下文，用于存储表达式中所需的变量值等
*
* @param expression 表达式
* @param context 表达式上下文，用于存储表达式中所需的变量值等
* @param allowClassSet 允许的Class白名单
* @return 执行结果
*/
Object eval(String expression, Map<String, Object> context);
Object eval(String expression, Map<String, Object> context, Collection<Class<?>> allowClassSet);
}

17
hutool-extra/src/main/java/cn/hutool/extra/expression/ExpressionUtil.java
View File

@ -1,7 +1,9 @@
package cn.hutool.extra.expression;
import cn.hutool.core.collection.ListUtil;
import cn.hutool.extra.expression.engine.ExpressionFactory;
import java.util.Collection;
import java.util.Map;
/**
@ -29,6 +31,19 @@ public class ExpressionUtil {
* @return 执行结果
*/
public static Object eval(String expression, Map<String, Object> context) {
return getEngine().eval(expression, context);
return eval(expression, context, ListUtil.empty());
}
/**
* 执行表达式
*
* @param expression 表达式
* @param context 表达式上下文，用于存储表达式中所需的变量值等
* @param allowClassSet 允许的Class白名单
* @return 执行结果
* @since 5.8.21
*/
public static Object eval(String expression, Map<String, Object> context, Collection<Class<?>> allowClassSet) {
return getEngine().eval(expression, context, allowClassSet);
}
}

9
hutool-extra/src/main/java/cn/hutool/extra/expression/engine/aviator/AviatorEngine.java
View File

@ -1,9 +1,13 @@
package cn.hutool.extra.expression.engine.aviator;
import cn.hutool.core.collection.CollUtil;
import cn.hutool.extra.expression.ExpressionEngine;
import com.googlecode.aviator.AviatorEvaluator;
import com.googlecode.aviator.AviatorEvaluatorInstance;
import com.googlecode.aviator.Options;
import java.util.Collection;
import java.util.Collections;
import java.util.Map;
/**
@ -25,7 +29,10 @@ public class AviatorEngine implements ExpressionEngine {
}
@Override
public Object eval(String expression, Map<String, Object> context) {
public Object eval(String expression, Map<String, Object> context, Collection<Class<?>> allowClassSet) {
// issue#I6AJWJ
engine.setOption(Options.ALLOWED_CLASS_SET,
CollUtil.isEmpty(allowClassSet) ? Collections.emptySet() : CollUtil.newHashSet(allowClassSet));
return engine.execute(expression, context);
}

3
hutool-extra/src/main/java/cn/hutool/extra/expression/engine/jexl/JexlEngine.java
View File

@ -4,6 +4,7 @@ import cn.hutool.extra.expression.ExpressionEngine;
import org.apache.commons.jexl3.JexlBuilder;
import org.apache.commons.jexl3.MapContext;
import java.util.Collection;
import java.util.Map;
/**
@ -22,7 +23,7 @@ public class JexlEngine implements ExpressionEngine {
}
@Override
public Object eval(String expression, Map<String, Object> context) {
public Object eval(String expression, Map<String, Object> context, Collection<Class<?>> allowClassSet) {
final MapContext mapContext = new MapContext(context);
try{

3
hutool-extra/src/main/java/cn/hutool/extra/expression/engine/jfireel/JfireELEngine.java
View File

@ -3,6 +3,7 @@ package cn.hutool.extra.expression.engine.jfireel;
import cn.hutool.extra.expression.ExpressionEngine;
import com.jfirer.jfireel.expression.Expression;
import java.util.Collection;
import java.util.Map;
/**
@ -25,7 +26,7 @@ public class JfireELEngine implements ExpressionEngine {
}
@Override
public Object eval(String expression, Map<String, Object> context) {
public Object eval(String expression, Map<String, Object> context, Collection<Class<?>> allowClassSet) {
return Expression.parse(expression).calculate(context);
}

3
hutool-extra/src/main/java/cn/hutool/extra/expression/engine/mvel/MvelEngine.java
View File

@ -3,6 +3,7 @@ package cn.hutool.extra.expression.engine.mvel;
import cn.hutool.extra.expression.ExpressionEngine;
import org.mvel2.MVEL;
import java.util.Collection;
import java.util.Map;
/**
@ -25,7 +26,7 @@ public class MvelEngine implements ExpressionEngine {
}
@Override
public Object eval(String expression, Map<String, Object> context) {
public Object eval(String expression, Map<String, Object> context, Collection<Class<?>> allowClassSet) {
return MVEL.eval(expression, context);
}

3
hutool-extra/src/main/java/cn/hutool/extra/expression/engine/qlexpress/QLExpressEngine.java
View File

@ -5,6 +5,7 @@ import cn.hutool.extra.expression.ExpressionException;
import com.ql.util.express.DefaultContext;
import com.ql.util.express.ExpressRunner;
import java.util.Collection;
import java.util.Map;
/**
@ -26,7 +27,7 @@ public class QLExpressEngine implements ExpressionEngine {
}
@Override
public Object eval(final String expression, final Map<String, Object> context) {
public Object eval(final String expression, final Map<String, Object> context, Collection<Class<?>> allowClassSet) {
final DefaultContext<String, Object> defaultContext = new DefaultContext<>();
defaultContext.putAll(context);
try {

3
hutool-extra/src/main/java/cn/hutool/extra/expression/engine/rhino/RhinoEngine.java
View File

@ -6,6 +6,7 @@ import org.mozilla.javascript.Context;
import org.mozilla.javascript.Scriptable;
import org.mozilla.javascript.ScriptableObject;
import java.util.Collection;
import java.util.Map;
/**
@ -22,7 +23,7 @@ public class RhinoEngine implements ExpressionEngine {
}
@Override
public Object eval(String expression, Map<String, Object> context) {
public Object eval(String expression, Map<String, Object> context, Collection<Class<?>> allowClassSet) {
final Context ctx = Context.enter();
final Scriptable scope = ctx.initStandardObjects();
if (MapUtil.isNotEmpty(context)) {

3
hutool-extra/src/main/java/cn/hutool/extra/expression/engine/spel/SpELEngine.java
View File

@ -6,6 +6,7 @@ import org.springframework.expression.ExpressionParser;
import org.springframework.expression.spel.standard.SpelExpressionParser;
import org.springframework.expression.spel.support.StandardEvaluationContext;
import java.util.Collection;
import java.util.Map;
/**
@ -27,7 +28,7 @@ public class SpELEngine implements ExpressionEngine {
}
@Override
public Object eval(String expression, Map<String, Object> context) {
public Object eval(String expression, Map<String, Object> context, Collection<Class<?>> allowClassSet) {
final EvaluationContext evaluationContext = new StandardEvaluationContext();
context.forEach(evaluationContext::setVariable);
return parser.parseExpression(expression).getValue(evaluationContext);