中大七院漏洞扫描

ibps-basic-root/modules/basic-response/src/main/java/com/lc/ibps/cloud/config/AuthorizationConfig.java

@@ -137,8 +137,7 @@ public class AuthorizationConfig {
 
 		ignoreUrls.add("/**/csrf");
 		ignoreUrls.add("/**/health");
-		ignoreUrls.add("/**/env");
-		ignoreUrls.add("/**/prometheus");
+		// 【安全修复LD-06】env、prometheus 等 Actuator 端点禁止加入白名单，仅保留 health
 
 		//客户端地址
 		ignoreUrls.add("/**/mobile/**");
@@ -178,7 +177,6 @@ public class AuthorizationConfig {
 		ignoreUrls.add("/ibps/business/v3//wx/adduser");//1
 		ignoreUrls.add("/wx/adduser");//2
 		ignoreUrls.add("/**/wx/adduser");
-		ignoreUrls.add("/employee/query");//1
 		ignoreUrls.add("/ibps/business/v3//wx/query");
 		ignoreUrls.add("/wx/query");
 		ignoreUrls.add("/**/wx/query");
@@ -188,10 +186,8 @@ public class AuthorizationConfig {
 		ignoreUrls.add("/wx/openids");//2
 		ignoreUrls.add("/**/wx/openids");
 
-
-		ignoreUrls.add("/ibps/platform/v3//file/download");//1
-		ignoreUrls.add("/ibps/platform/v3/file/download");//1
-		ignoreUrls.add("/file/download");//2
+		// 【安全修复LD-06】/employee/query、/file/download 曾在此白名单中，
+		// 导致员工信息与附件可被未授权访问，禁止再加回；如需匿名场景须改用一次性授权凭证
 
 		ignoreUrls.add("/employee/signInformation/query");
 		ignoreUrls.add("/employee/signInformation/save");
@@ -212,8 +208,6 @@ public class AuthorizationConfig {
 		ignoreUrls.add("/webjars/**");
 		ignoreUrls.add("/csrf");
 		ignoreUrls.add("/health");
-		ignoreUrls.add("/env");
-		ignoreUrls.add("/prometheus");
 		ignoreUrls.add("/favicon.ico");
 		ignoreUrls.add("/cat/s/router");
 

ibps-oauth-root/modules/oauth-client2/src/main/java/com/lc/ibps/cloud/oauth/client/filter/AccessTokenValidatorFilter.java

@@ -142,13 +142,32 @@ public class AccessTokenValidatorFilter extends AbstractFilter implements Ordere
     	    				// 校验通过，设置上下文
     	    				tokenVerify.setContextOne(httpRequest, accessToken, clientId, username);
     	    			}
-    	    			else if(GrantType.CLIENT_CREDENTIALS.equalsIgnoreCase(grantType)) {
-    	    				Map<String, String> outContextMap = new HashMap<>();
-    	    				outContextMap.put("uid", "client."+StringFormater.desensitizMobile(clientId));
-    	    				LogUtil.setMDC(outContextMap);
-    	    				tokenVerify.setContextClientId(clientId);
-    	    				tokenVerify.setContextAccessToken(accessToken);
-    	    			}
+	    			else if(GrantType.CLIENT_CREDENTIALS.equalsIgnoreCase(grantType)) {
+	    				// 【安全修复LD-06】client_credentials 令牌仅限内部服务调用；
+	    				// 经网关转发进来的外部请求禁止使用服务令牌访问业务接口
+	    				String fromGateway = httpRequest.getHeader(ParameterKey.HEADER_GATEWAY);
+	    				if(StringUtil.isNotBlank(fromGateway) && SecrectUtil.getGatewaySecretValue().equals(fromGateway)) {
+	    					String clientIp = RequestUtil.getIpAddr(httpRequest);
+	    					logApiInvoke(uri, clientId, clientId, clientIp, StringPool.N, "client_credentials token is not allowed from gateway");
+	    					logger.error("client_credentials token is not allowed from gateway:{}", uri);
+
+	    					APIResult<Void> result = new APIResult<>();
+	    					result.setState(StateEnum.NO_PERMISSION.getCode());
+	    					result.setCause(StateEnum.NO_PERMISSION.getText());
+
+	    					httpResponse.setStatus(403);
+	    					httpResponse.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
+	    					httpResponse.getWriter().print(result.toString());
+	    					httpResponse.getWriter().flush();
+	    					return;
+	    				}
+
+	    				Map<String, String> outContextMap = new HashMap<>();
+	    				outContextMap.put("uid", "client."+StringFormater.desensitizMobile(clientId));
+	    				LogUtil.setMDC(outContextMap);
+	    				tokenVerify.setContextClientId(clientId);
+	    				tokenVerify.setContextAccessToken(accessToken);
+	    			}
     	    			else {
     	    				logger.warn("This grant type {} has not user info.");
     	    			}

ibps-oauth-root/modules/oauth-server2/src/main/resources/conf/dataSource-dev.xml

@@ -7,33 +7,9 @@
  	<!-- dev下使用该链接 -->
  	<dbType>mysql</dbType>
   	<driver>com.mysql.jdbc.Driver</driver>
-<!--    <driverUrl>jdbc:mysql://39.108.0.125:3306/klims-ibps?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-<!--    <user>root</user>-->
-<!--    <password>!$%^QWER</password>-->
     <driverUrl>jdbc:mysql://192.168.2.161:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>
     <user>root</user>
     <password>test001</password>
-	<!-- 	
-	<dbType>oracle</dbType>
-    <driver>oracle.jdbc.OracleDriver</driver>
-    <driverUrl>jdbc:oracle:thin:@192.168.3.203:1521:ORCL</driverUrl>
-    <user>lc</user>
-    <password>lc</password> 
-    -->
-    <!-- 	
-    <dbType>postgres</dbType>
-  	<driver>org.postgresql.Driver</driver>
-	<driverUrl>jdbc:postgresql://192.168.3.206:5432/platform</driverUrl>
-    <user>root</user>
-    <password>root</password>
-    -->
-    <!--  
-    <dbType>mssql</dbType>
-    <driver>com.microsoft.sqlserver.jdbc.SQLServerDriver</driver>
-    <driverUrl>jdbc:sqlserver://192.168.3.206:1433;DatabaseName=ibps_platform;integratedSecurity=false</driverUrl>
-    <user>ibps_platform</user>
-    <password>uij987eE90hgD</password>
-    -->
     
     <status>actived</status>
     <isDefault>true</isDefault>

ibps-provider-root/modules/provider-business/src/main/resources/conf/dataSource-dev.xml

@@ -11,54 +11,7 @@
     <user>root</user>
     <password>test001</password>
 
-    <!-- 本机VM 192.168.22.3 -->
-    <!--    <driverUrl>jdbc:mysql://192.168.22.3:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>szjyt168</password>-->
 
-    <!-- 吴懿 -->
-    <!--    <driverUrl>jdbc:mysql://192.168.2.134:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password/>-->
-
-    <!-- localhost -->
-    <!--    <driverUrl>jdbc:mysql://127.0.0.1:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>123456</password>-->
-
-    <!--    检测管理系统-->
-    <!--    <dbType>mysql</dbType>-->
-    <!--    <driver>com.mysql.jdbc.Driver</driver>-->
-    <!--    <driverUrl>jdbc:mysql://119.23.210.103:3306/klts-ibps?useUnicode=true&amp;characterEncoding=utf-8&amp;allowMultiQueries=true</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>!$%^QWER</password>-->
-    <!--    质量管理系统-->
-    <!--    <dbType>mysql</dbType>-->
-    <!--    <driver>com.mysql.jdbc.Driver</driver>-->
-    <!--    <driverUrl>jdbc:mysql://119.23.210.103:3306/klcams-ibps?useUnicode=true&amp;characterEncoding=utf-8&amp;allowMultiQueries=true</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>!$%^QWER</password>-->
-    <!--
-	<dbType>oracle</dbType>
-    <driver>oracle.jdbc.OracleDriver</driver>
-    <driverUrl>jdbc:oracle:thin:@192.168.3.203:1521:ORCL</driverUrl>
-    <user>lc</user>
-    <password>lc</password>
-    -->
-    <!--
-    <dbType>postgres</dbType>
-  	<driver>org.postgresql.Driver</driver>
-	<driverUrl>jdbc:postgresql://192.168.3.206:5432/platform</driverUrl>
-    <user>root</user>
-    <password>root</password>
-    -->
-    <!--
-    <dbType>mssql</dbType>
-    <driver>com.microsoft.sqlserver.jdbc.SQLServerDriver</driver>
-    <driverUrl>jdbc:sqlserver://192.168.3.206:1433;DatabaseName=ibps_platform;integratedSecurity=false</driverUrl>
-    <user>ibps_platform</user>
-    <password>uij987eE90hgD</password>
-    -->
 
     <status>actived</status>
     <isDefault>true</isDefault>

ibps-provider-root/modules/provider-form/src/main/java/com/lc/ibps/form/provider/BoDefProvider.java

@@ -661,6 +661,18 @@ public class BoDefProvider extends GenericProvider implements IBoDefService, IBo
 		return result;
 	}
 	
+	/**
+	 * 【安全修复LD-06】数据源口令脱敏，接口返回前统一调用
+	 */
+	private void maskDataSourcePassword(List<DataSourceVo> dataSourceList) {
+		if (BeanUtils.isEmpty(dataSourceList)) {
+			return;
+		}
+		for (DataSourceVo vo : dataSourceList) {
+			vo.setPassword("******");
+		}
+	}
+
 	@ApiOperation(value = "获取已存在的表信息", notes = "获取已存在的表信息")
 	@Override
 	public APIResult<List<DataSourceVo>> findDatasource(
@@ -673,6 +685,8 @@ public class BoDefProvider extends GenericProvider implements IBoDefService, IBo
 			QueryFilter queryFilter = getQueryFilter(request);
 			queryFilter.addParamsFilter("STATUS", "actived");
 			List<DataSourceVo> dataSourceList = iDataSource.findDataSources(queryFilter);
+			// 【安全修复LD-06】数据源口令禁止明文返回
+			maskDataSourcePassword(dataSourceList);
 			result.setData(dataSourceList);
 		} catch (Exception e) {
 			setExceptionResult(result, StateEnum.ERROR_FORM_BO.getCode(), I18nUtil.getMessage(StateEnum.ERROR_FORM_BO.getCode()+""), e);

ibps-provider-root/modules/provider-form/src/main/java/com/lc/ibps/form/provider/DatasetProvider.java

@@ -95,12 +95,25 @@ public class DatasetProvider extends GenericProvider implements IDatasetService,
 	@Resource
 	private DataTemplateRepository dataTemplateRepository;
 
+	/**
+	 * 【安全修复LD-06】数据源口令脱敏，接口返回前统一调用
+	 */
+	private void maskDataSourcePassword(List<DataSourceVo> dataSourceList) {
+		if (BeanUtils.isEmpty(dataSourceList)) {
+			return;
+		}
+		for (DataSourceVo vo : dataSourceList) {
+			vo.setPassword("******");
+		}
+	}
+
 	@ApiOperation(value = "数据源查询", notes = "数据源查询")
 	@Override
 	public APIResult<APIPageList<DataSourceVo>> queryDataSource() {
 		APIResult<APIPageList<DataSourceVo>> result = new APIResult<>();
 		try {
 			List<DataSourceVo> dataSourceList = DataSourceHelper.findAllDataSource();
+			maskDataSourcePassword(dataSourceList);
 			APIPageList<DataSourceVo> pageList = getAPIPageList(dataSourceList);
 			result.setData(pageList);
 		} catch (Exception e) {
@@ -202,6 +215,7 @@ public class DatasetProvider extends GenericProvider implements IDatasetService,
 			
 			// 获取全部数据源
 			List<DataSourceVo> dataSourceList = DataSourceHelper.findAllDataSource();
+			maskDataSourcePassword(dataSourceList);
 			result.setData(dataSourceList);
 		} catch (Exception e) {
 			setExceptionResult(result, StateEnum.ERROR_FORM_DATASET.getCode(), I18nUtil.getMessage(StateEnum.ERROR_FORM_DATASET.getCode()+""), e);

ibps-provider-root/modules/provider-platform/src/main/resources/conf/dataSource-dev.xml

@@ -7,37 +7,11 @@
     <!-- dev下使用该链接 -->
     <dbType>mysql</dbType>
     <driver>com.mysql.jdbc.Driver</driver>
-    <driverUrl>jdbc:mysql://192.168.2.161:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>
+    <driverUrl>jdbc:mysql://192.168.2.218:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>
     <user>root</user>
     <password>test001</password>
 
 
-    <!-- 金源   172.18.157.44      119.23.210.103  -->
-    <!--    <driverUrl>jdbc:mysql://119.23.210.103:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>!$%^QWER</password>-->
-
-    <!-- 罗湖生产 -->
-    <!--    <driverUrl>jdbc:mysql://172.16.40.182:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>Lh789456123</password>-->
-
-    <!-- 明鉴 -->
-    <!--    <driverUrl>jdbc:mysql://139.159.225.4:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>Jyxt%$*1466.</password>-->
-
-    <!-- 罗湖120       172.18.157.47        120.78.154.31      -->
-    <!--    <driverUrl>jdbc:mysql://120.78.154.31:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>Jyxt168.</password>-->
-
-    <!-- 本机VM 192.168.22.3 -->
-    <!--    <driverUrl>jdbc:mysql://192.168.22.3:3306/klims-ibps3?useUnicode=true&amp;characterEncoding=utf-8</driverUrl>-->
-    <!--    <user>root</user>-->
-    <!--    <password>szjyt168</password>-->
-
-
     <status>actived</status>
     <isDefault>true</isDefault>
     <variables>