From 775d77ee6d19da66e08efdbc4bed1ea4e0d3dc1a Mon Sep 17 00:00:00 2001 From: RuoYi Date: Sat, 30 Oct 2021 10:27:07 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BB=BB=E5=8A=A1=E5=B1=8F=E8=94=BD=E8=BF=9D?= =?UTF-8?q?=E8=A7=84=E5=AD=97=E7=AC=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../main/java/com/ruoyi/common/constant/Constants.java | 8 +++++++- .../com/ruoyi/quartz/controller/SysJobController.java | 9 +++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/constant/Constants.java b/ruoyi-common/src/main/java/com/ruoyi/common/constant/Constants.java index 54e10499c..0103d8e4f 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/constant/Constants.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/constant/Constants.java @@ -116,4 +116,10 @@ public class Constants * LDAP 远程方法调用 */ public static final String LOOKUP_LDAP = "ldap://"; -} + + /** + * 定时任务违规的字符 + */ + public static final String[] JOB_ERROR_STR = { "java.net.URL", "javax.naming.InitialContext", "org.yaml.snakeyaml", + "org.springframework.jndi" }; +} \ No newline at end of file diff --git a/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java b/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java index c1d875f63..7ed80c68f 100644 --- a/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java +++ b/ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/SysJobController.java @@ -148,6 +148,11 @@ public class SysJobController extends BaseController { return error("新增任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用"); } + else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR)) + { + return error("新增任务'" + job.getJobName() + "'失败，目标字符串存在违规"); + } + job.setCreateBy(getLoginName()); return toAjax(jobService.insertJob(job)); } @@ -186,6 +191,10 @@ public class SysJobController extends BaseController { return error("修改任务'" + job.getJobName() + "'失败，目标字符串不允许'http(s)//'调用"); } + else if (StringUtils.containsAnyIgnoreCase(job.getInvokeTarget(), Constants.JOB_ERROR_STR)) + { + return error("修改任务'" + job.getJobName() + "'失败，目标字符串存在违规"); + } return toAjax(jobService.updateJob(job)); }