导出Excel时屏蔽公式，防止CSV注入风险

RuoYi

2022-01-27 fef0630608f7ca85dc2afd050221b16abdb062de

 src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java

@@ -86,6 +86,8 @@
{

    private static final Logger log = LoggerFactory.getLogger(ExcelUtil.class);



    public static final String[] FORMULA_STR = { "=", "-", "+", "@" };



    /**

     * Excel sheet最大行数，默认65536

     */

@@ -431,7 +433,7 @@
     * @return 结果

     * @throws IOException

     */

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)throws IOException

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)

    {

        exportExcel(response, list, sheetName, StringUtils.EMPTY);

    }

@@ -446,12 +448,12 @@
     * @return 结果

     * @throws IOException

     */

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title) throws IOException

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title)

    {

        response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");

        response.setCharacterEncoding("utf-8");

        this.init(list, sheetName, title, Type.EXPORT);

        exportExcel(response.getOutputStream());

        exportExcel(response);

    }



    /**

@@ -484,7 +486,7 @@
     * @param sheetName 工作表的名称

     * @return 结果

     */

    public void importTemplateExcel(HttpServletResponse response, String sheetName) throws IOException

    public void importTemplateExcel(HttpServletResponse response, String sheetName)

    {

        importTemplateExcel(response, sheetName, StringUtils.EMPTY);

    }

@@ -496,12 +498,12 @@
     * @param title 标题

     * @return 结果

     */

    public void importTemplateExcel(HttpServletResponse response, String sheetName, String title) throws IOException

    public void importTemplateExcel(HttpServletResponse response, String sheetName, String title)

    {

        response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");

        response.setCharacterEncoding("utf-8");

        this.init(null, sheetName, title, Type.IMPORT);

        exportExcel(response.getOutputStream());

        exportExcel(response);

    }



    /**

@@ -509,12 +511,12 @@
     * 

     * @return 结果

     */

    public void exportExcel(OutputStream out)

    public void exportExcel(HttpServletResponse response)

    {

        try

        {

            writeSheet();

            wb.write(out);

            wb.write(response.getOutputStream());

        }

        catch (Exception e)

        {

@@ -523,7 +525,6 @@
        finally

        {

            IOUtils.closeQuietly(wb);

            IOUtils.closeQuietly(out);

        }

    }



@@ -711,7 +712,13 @@
    {

        if (ColumnType.STRING == attr.cellType())

        {

            cell.setCellValue(StringUtils.isNull(value) ? attr.defaultValue() : value + attr.suffix());

            String cellValue = Convert.toStr(value);

            // 对于任何以表达式触发字符 =-+@开头的单元格，直接使用tab字符作为前缀，防止CSV注入。

            if (StringUtils.containsAny(cellValue, FORMULA_STR))

            {

                cellValue = StringUtils.replaceEach(cellValue, FORMULA_STR, new String[] { "\t=", "\t-", "\t+", "\t@" });

            }

            cell.setCellValue(StringUtils.isNull(cellValue) ? attr.defaultValue() : cellValue + attr.suffix());

        }

        else if (ColumnType.NUMERIC == attr.cellType())

        {