From 34191cdee6de48e946d02da6cb4288dd1118db70 Mon Sep 17 00:00:00 2001 From: zhangdaiscott Date: Fri, 11 Sep 2026 15:59:11 +0800 Subject: [PATCH] =?UTF-8?q?=E3=80=90=E5=AE=89=E5=85=A8=E4=BF=AE=E5=A4=8D?= =?UTF-8?q?=20GHSA-7wcq-939v-pcrg=E3=80=91=E5=AD=97=E5=85=B8=E7=BF=BB?= =?UTF-8?q?=E8=AF=91=E5=88=87=E9=9D=A2=E7=BB=95=E8=BF=87=E5=BA=8F=E5=88=97?= =?UTF-8?q?=E5=8C=96=E6=B3=A8=E8=A7=A3=E5=AF=BC=E8=87=B4=E6=95=B0=E6=8D=AE?= =?UTF-8?q?=E6=BA=90=E5=AF=86=E7=A0=81=E6=B3=84=E9=9C=B2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DictAspect 反射重建响应体时，跳过标注 @JsonProperty(WRITE_ONLY) 的敏感字段，避免 dbPassword 等泄露到接口响应（/sys/dataSource/list） Co-Authored-By: Claude --- .../src/main/java/org/jeecg/common/aspect/DictAspect.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/aspect/DictAspect.java b/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/aspect/DictAspect.java index dddc64b2e..8b636e311 100644 --- a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/aspect/DictAspect.java +++ b/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/aspect/DictAspect.java @@ -4,6 +4,7 @@ import com.alibaba.fastjson.JSON; import com.alibaba.fastjson.JSONObject; import com.baomidou.mybatisplus.core.metadata.IPage; import com.fasterxml.jackson.annotation.JsonFormat; +import com.fasterxml.jackson.annotation.JsonProperty; import lombok.extern.slf4j.Slf4j; import org.aspectj.lang.ProceedingJoinPoint; import org.aspectj.lang.annotation.Around; @@ -119,6 +120,12 @@ public class DictAspect { continue; } //update-begin---author:scott ---date:2026-04-16 for：【issues/9543】优先通过 getter 方法读取字段值（兼容实体重写 getter 的场景），getter 不存在时 fallback 到直接读字段----------- + //update-begin---author:scott ---date:20260911 for：【安全修复 GHSA-7wcq-939v-pcrg】字典翻译切面用反射重建响应体会绕过序列化注解，此处尊重 @JsonProperty(WRITE_ONLY) 语义，跳过敏感字段（如 SysDataSource.dbPassword）防止泄露----------- + JsonProperty jsonProperty = field.getAnnotation(JsonProperty.class); + if (jsonProperty != null && JsonProperty.Access.WRITE_ONLY == jsonProperty.access()) { + continue; + } + //update-end---author:scott ---date:20260911 for：【安全修复 GHSA-7wcq-939v-pcrg】字典翻译切面用反射重建响应体会绕过序列化注解，此处尊重 @JsonProperty(WRITE_ONLY) 语义，跳过敏感字段（如 SysDataSource.dbPassword）防止泄露----------- Object fieldValue = getFieldValue(record, field); //update-end---author:scott ---date:2026-04-16 for：【issues/9543】优先通过 getter 方法读取字段值（兼容实体重写 getter 的场景），getter 不存在时 fallback 到直接读字段----------- // 解决@JsonFormat注解解析不了的问题详见SysAnnouncement类的@JsonFormat