导出Excel时屏蔽公式，防止CSV注入风险

RuoYi

2022-01-27 fef0630608f7ca85dc2afd050221b16abdb062de

 src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java

@@ -86,6 +86,8 @@
{

    private static final Logger log = LoggerFactory.getLogger(ExcelUtil.class);



    public static final String[] FORMULA_STR = { "=", "-", "+", "@" };



    /**

     * Excel sheet最大行数，默认65536

     */

@@ -268,22 +270,15 @@
                }

            }

            // 有数据时才处理 得到类的所有field.

            Field[] allFields = clazz.getDeclaredFields();

            // 定义一个map用于存放列的序号和field.

            Map<Integer, Field> fieldsMap = new HashMap<Integer, Field>();

            for (int col = 0; col < allFields.length; col++)

            List<Object[]> fields = this.getFields();

            Map<Integer, Object[]> fieldsMap = new HashMap<Integer, Object[]>();

            for (Object[] objects : fields)

            {

                Field field = allFields[col];

                Excel attr = field.getAnnotation(Excel.class);

                if (attr != null && (attr.type() == Type.ALL || attr.type() == type))

                Excel attr = (Excel) objects[1];

                Integer column = cellMap.get(attr.name());

                if (column != null)

                {

                    // 设置类的私有字段属性可访问.

                    field.setAccessible(true);

                    Integer column = cellMap.get(attr.name());

                    if (column != null)

                    {

                        fieldsMap.put(column, field);

                    }

                    fieldsMap.put(column, objects);

                }

            }

            for (int i = titleNum + 1; i <= rows; i++)

@@ -296,14 +291,15 @@
                    continue;

                }

                T entity = null;

                for (Map.Entry<Integer, Field> entry : fieldsMap.entrySet())

                for (Map.Entry<Integer, Object[]> entry : fieldsMap.entrySet())

                {

                    Object val = this.getCellValue(row, entry.getKey());



                    // 如果不存在实例则新建.

                    entity = (entity == null ? clazz.newInstance() : entity);

                    // 从map中得到对应列的field.

                    Field field = fieldsMap.get(entry.getKey());

                    Field field = (Field) entry.getValue()[0];

                    Excel attr = (Excel) entry.getValue()[1];

                    // 取得类型,并根据对象类型设置值.

                    Class<?> fieldType = field.getType();

                    if (String.class == fieldType)

@@ -363,7 +359,6 @@
                    }

                    if (StringUtils.isNotNull(fieldType))

                    {

                        Excel attr = field.getAnnotation(Excel.class);

                        String propertyName = field.getName();

                        if (StringUtils.isNotEmpty(attr.targetAttr()))

                        {

@@ -438,7 +433,7 @@
     * @return 结果

     * @throws IOException

     */

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)throws IOException

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)

    {

        exportExcel(response, list, sheetName, StringUtils.EMPTY);

    }

@@ -453,12 +448,12 @@
     * @return 结果

     * @throws IOException

     */

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title) throws IOException

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title)

    {

        response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");

        response.setCharacterEncoding("utf-8");

        this.init(list, sheetName, title, Type.EXPORT);

        exportExcel(response.getOutputStream());

        exportExcel(response);

    }



    /**

@@ -491,9 +486,9 @@
     * @param sheetName 工作表的名称

     * @return 结果

     */

    public void importTemplateExcel(HttpServletResponse response, String sheetName) throws IOException

    public void importTemplateExcel(HttpServletResponse response, String sheetName)

    {

        importTemplateExcel(response, sheetName);

        importTemplateExcel(response, sheetName, StringUtils.EMPTY);

    }



    /**

@@ -503,12 +498,12 @@
     * @param title 标题

     * @return 结果

     */

    public void importTemplateExcel(HttpServletResponse response, String sheetName, String title) throws IOException

    public void importTemplateExcel(HttpServletResponse response, String sheetName, String title)

    {

        response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");

        response.setCharacterEncoding("utf-8");

        this.init(null, sheetName, title, Type.IMPORT);

        exportExcel(response.getOutputStream());

        exportExcel(response);

    }



    /**

@@ -516,12 +511,12 @@
     * 

     * @return 结果

     */

    public void exportExcel(OutputStream out)

    public void exportExcel(HttpServletResponse response)

    {

        try

        {

            writeSheet();

            wb.write(out);

            wb.write(response.getOutputStream());

        }

        catch (Exception e)

        {

@@ -530,7 +525,6 @@
        finally

        {

            IOUtils.closeQuietly(wb);

            IOUtils.closeQuietly(out);

        }

    }



@@ -610,8 +604,6 @@
            {

                Field field = (Field) os[0];

                Excel excel = (Excel) os[1];

                // 设置实体类私有属性可访问

                field.setAccessible(true);

                this.addCell(excel, row, vo, field, column++);

            }

        }

@@ -720,7 +712,13 @@
    {

        if (ColumnType.STRING == attr.cellType())

        {

            cell.setCellValue(StringUtils.isNull(value) ? attr.defaultValue() : value + attr.suffix());

            String cellValue = Convert.toStr(value);

            // 对于任何以表达式触发字符 =-+@开头的单元格，直接使用tab字符作为前缀，防止CSV注入。

            if (StringUtils.containsAny(cellValue, FORMULA_STR))

            {

                cellValue = StringUtils.replaceEach(cellValue, FORMULA_STR, new String[] { "\t=", "\t-", "\t+", "\t@" });

            }

            cell.setCellValue(StringUtils.isNull(cellValue) ? attr.defaultValue() : cellValue + attr.suffix());

        }

        else if (ColumnType.NUMERIC == attr.cellType())

        {

@@ -1164,7 +1162,17 @@
     */

    private void createExcelField()

    {

        this.fields = new ArrayList<Object[]>();

        this.fields = getFields();

        this.fields = this.fields.stream().sorted(Comparator.comparing(objects -> ((Excel) objects[1]).sort())).collect(Collectors.toList());

        this.maxHeight = getRowHeight();

    }



    /**

     * 获取字段注解信息

     */

    public List<Object[]> getFields()

    {

        List<Object[]> fields = new ArrayList<Object[]>();

        List<Field> tempFields = new ArrayList<>();

        tempFields.addAll(Arrays.asList(clazz.getSuperclass().getDeclaredFields()));

        tempFields.addAll(Arrays.asList(clazz.getDeclaredFields()));

@@ -1173,7 +1181,12 @@
            // 单注解

            if (field.isAnnotationPresent(Excel.class))

            {

                putToField(field, field.getAnnotation(Excel.class));

                Excel attr = field.getAnnotation(Excel.class);

                if (attr != null && (attr.type() == Type.ALL || attr.type() == type))

                {

                    field.setAccessible(true);

                    fields.add(new Object[] { field, attr });

                }

            }



            // 多注解

@@ -1181,14 +1194,17 @@
            {

                Excels attrs = field.getAnnotation(Excels.class);

                Excel[] excels = attrs.value();

                for (Excel excel : excels)

                for (Excel attr : excels)

                {

                    putToField(field, excel);

                    if (attr != null && (attr.type() == Type.ALL || attr.type() == type))

                    {

                        field.setAccessible(true);

                        fields.add(new Object[] { field, attr });

                    }

                }

            }

        }

        this.fields = this.fields.stream().sorted(Comparator.comparing(objects -> ((Excel) objects[1]).sort())).collect(Collectors.toList());

        this.maxHeight = getRowHeight();

        return fields;

    }



    /**

@@ -1203,17 +1219,6 @@
            maxHeight = maxHeight > excel.height() ? maxHeight : excel.height();

        }

        return (short) (maxHeight * 20);

    }



    /**

     * 放到字段集合中

     */

    private void putToField(Field field, Excel attr)

    {

        if (attr != null && (attr.type() == Type.ALL || attr.type() == type))

        {

            this.fields.add(new Object[] { field, attr });

        }

    }



    /**