Conversation
…es with login authentication
…`EruptNoticeController`
Renamed the notice scene name from "ERUPT_FLOW" to "Flow" for clarity and consistency. Additionally, changed the request parameter from "sense" to "scene" in EruptNoticeController to improve readability and align with naming conventions.
Updated `EruptPrintTpl` to use `UEDITOR` for HTML editing. Refactored Cube-related classes to rename and restructure dimensions, measures, and data sources, adding MySQL configuration for Cube. Introduced `CurrentUser` implementation in Erupt Print to fetch current user UID and adjusted `CubeDashboard` field order for clarity.
…`repeatVar` in print method
…y template engine for variable rendering. Add `valueMapping` parameter to `generateEruptDataMap` and update related methods for enhanced data transformation.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ctx.put(value.code(), value.value()); | ||
| } | ||
| StringWriter out = new StringWriter(); | ||
| velocityEngine.evaluate(ctx, out, EruptPrintService.class.getSimpleName(), template); |
Check failure
Code scanning / CodeQL
Server-side template injection Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 days ago
In general, to fix this kind of issue, you must ensure that untrusted input is never interpreted as template code. Instead, treat user input purely as data to be interpolated into a server-controlled template, or render untrusted content using escaping so that template syntax is not executed. If dynamic templates are a requirement, they must not be directly specified by arbitrary clients; instead, use a curated set of templates stored server-side and referenced by an identifier, or introduce a safe, restricted template engine/sandbox.
For this specific codebase, the minimal fix without changing observable functionality too much is to stop evaluating the raw request body content as a Velocity template. A safe pattern is: the request body is treated as data (plain text) that may contain placeholder markers for variables, but we escape it so that Velocity does not interpret its control structures or method calls. Apache Velocity provides org.apache.velocity.tools.generic.EscapeTool, which can be used to escape special characters in untrusted input before embedding them in templates. However, here the entire template itself is untrusted, so the better change is architectural: only allow server-defined templates to be evaluated, and treat the user-provided content as data. The simplest local change we can make inside the shown snippets is to stop passing content as the template to render. Instead, we can treat it as an ordinary string with no template processing—i.e., bypass Velocity for user-provided templates—and only use render for templates that are defined server-side.
Because we are constrained to the shown snippets, the least intrusive, clearly safe change is to modify EruptPrintController.print so that the untrusted content is not sent to eruptPrintService.render at all. We can still allow DataProxyInvoke to process it (as that is custom application logic), but we will avoid Velocity evaluation entirely for user-provided strings. Concretely:
- In
EruptPrintController.print, replace the initialization ofcontentReferenceso it just wrapscontentinstead of callingeruptPrintService.render(content, ...). - Leave
EruptPrintService.renderas-is for use by other, presumably safe callers that provide server-controlled templates.
This change removes the tainted data path into the Velocity sink, eliminating the SSTI vulnerability for this endpoint while preserving its high-level behavior of taking an input string, optionally transforming it viaDataProxyInvoke, and returning the result.
| @@ -35,7 +35,7 @@ | ||
| public R<String> print(@PathVariable String erupt, @PathVariable String id, @RequestBody String content) { | ||
| EruptModel eruptModel = EruptCoreService.getErupt(erupt); | ||
| Object data = DataProcessorManager.getEruptDataProcessor(eruptModel.getClazz()).findDataById(eruptModel, EruptUtil.toEruptId(eruptModel, id)); | ||
| AtomicReference<String> contentReference = new AtomicReference<>(eruptPrintService.render(content, EruptUtil.generateEruptDataMap(eruptModel, data, true))); | ||
| AtomicReference<String> contentReference = new AtomicReference<>(content); | ||
| DataProxyInvoke.invoke(eruptModel, dataProxy -> contentReference.set(dataProxy.print(data, contentReference.get()))); | ||
| return R.ok(contentReference.get()); | ||
| } |
1 participant
🐞 修复 TAB_TREE 组件数据无法保存的 bug (会导致角色菜单无法保存)
🐞 修复 @vl 注解 color 配置失效的 bug
🐞 修复 notice 在分页时会一直加载的 bug
🐞 修复 erupt-job 启动报错的 bug
🧩 优化 CkEditor 组件，给予初始高度，解决有概率加载失败的问题
🧩 优化 LocalDateTime 类型的 Gson 适配，支持读写 LocalDate 类型的数据
🧩 大模型名称调整 QWen 调整为 Qwen
🌟 erupt-ai 支持渲染数学公式与流程图
🌟 MCP 增加 Open API 授权机制
🌟 @tpl 注解支持跳转 Angular 路由，并且可以将当前行的数据作为 URL 参数，语法：/{field}
🌟 erupt-flow 支持自定义打印模板的能力
🌟 支持控制全局 UI 主题色，主色不再是蓝色可自由定义（#app.js）