导出Excel时屏蔽公式，防止CSV注入风险

RuoYi

2022-01-27 fef0630608f7ca85dc2afd050221b16abdb062de

 src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java

@@ -6,6 +6,7 @@
import java.io.InputStream;

import java.io.OutputStream;

import java.lang.reflect.Field;

import java.lang.reflect.Method;

import java.math.BigDecimal;

import java.text.DecimalFormat;

import java.util.ArrayList;

@@ -46,6 +47,7 @@
import org.apache.poi.ss.usermodel.VerticalAlignment;

import org.apache.poi.ss.usermodel.Workbook;

import org.apache.poi.ss.usermodel.WorkbookFactory;

import org.apache.poi.ss.util.CellRangeAddress;

import org.apache.poi.ss.util.CellRangeAddressList;

import org.apache.poi.util.IOUtils;

import org.apache.poi.xssf.streaming.SXSSFWorkbook;

@@ -60,7 +62,7 @@
import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import com.ruoyi.common.core.text.Convert;

import com.ruoyi.common.exception.CustomException;

import com.ruoyi.common.exception.UtilException;

import com.ruoyi.common.utils.DateUtils;

import com.ruoyi.common.utils.DictUtils;

import com.ruoyi.common.utils.StringUtils;

@@ -83,6 +85,8 @@
public class ExcelUtil<T>

{

    private static final Logger log = LoggerFactory.getLogger(ExcelUtil.class);



    public static final String[] FORMULA_STR = { "=", "-", "+", "@" };



    /**

     * Excel sheet最大行数，默认65536

@@ -125,6 +129,16 @@
    private List<Object[]> fields;



    /**

     * 当前行号

     */

    private int rownum;

    
    /**

     * 标题

     */

    private String title;



    /**

     * 最大高度

     */

    private short maxHeight;

@@ -149,7 +163,7 @@
        this.clazz = clazz;

    }



    public void init(List<T> list, String sheetName, Type type)

    public void init(List<T> list, String sheetName, String title, Type type)

    {

        if (list == null)

        {

@@ -158,8 +172,27 @@
        this.list = list;

        this.sheetName = sheetName;

        this.type = type;

        this.title = title;

        createExcelField();

        createWorkbook();

        createTitle();

    }



    /**

     * 创建excel第一行标题

     */

    public void createTitle()

    {

        if (StringUtils.isNotEmpty(title))

        {

            Row titleRow = sheet.createRow(rownum == 0 ? rownum++ : 0);

            titleRow.setHeightInPoints(30);

            Cell titleCell = titleRow.createCell(0);

            titleCell.setCellStyle(styles.get("title"));

            titleCell.setCellValue(title);

            sheet.addMergedRegion(new CellRangeAddress(titleRow.getRowNum(), titleRow.getRowNum(), titleRow.getRowNum(),

                    this.fields.size() - 1));

        }

    }



    /**

@@ -170,17 +203,30 @@
     */

    public List<T> importExcel(InputStream is) throws Exception

    {

        return importExcel(StringUtils.EMPTY, is);

        return importExcel(is, 0);

    }



    /**

     * 对excel表单默认第一个索引名转换成list

     * 
     * @param is 输入流

     * @param titleNum 标题占用行数

     * @return 转换后集合

     */

    public List<T> importExcel(InputStream is, int titleNum) throws Exception

    {

        return importExcel(StringUtils.EMPTY, is, titleNum);

    }



    /**

     * 对excel表单指定表格索引名转换成list

     * 

     * @param sheetName 表格索引名

     * @param titleNum 标题占用行数

     * @param is 输入流

     * @return 转换后集合

     */

    public List<T> importExcel(String sheetName, InputStream is) throws Exception

    public List<T> importExcel(String sheetName, InputStream is, int titleNum) throws Exception

    {

        this.type = Type.IMPORT;

        this.wb = WorkbookFactory.create(is);

@@ -195,11 +241,11 @@
        Map<String, PictureData> pictures;

        if (isXSSFWorkbook)

        {

            pictures = getSheetPictrues07((XSSFSheet) sheet, (XSSFWorkbook) wb);

            pictures = getSheetPictures07((XSSFSheet) sheet, (XSSFWorkbook) wb);

        }

        else

        {

            pictures = getSheetPictrues03((HSSFSheet) sheet, (HSSFWorkbook) wb);

            pictures = getSheetPictures03((HSSFSheet) sheet, (HSSFWorkbook) wb);

        }

        // 获取最后一个非空行的行下标，比如总行数为n，则返回的为n-1

        int rows = sheet.getLastRowNum();

@@ -209,7 +255,7 @@
            // 定义一个map用于存放excel列的序号和field.

            Map<String, Integer> cellMap = new HashMap<String, Integer>();

            // 获取表头

            Row heard = sheet.getRow(0);

            Row heard = sheet.getRow(titleNum);

            for (int i = 0; i < heard.getPhysicalNumberOfCells(); i++)

            {

                Cell cell = heard.getCell(i);

@@ -224,25 +270,18 @@
                }

            }

            // 有数据时才处理 得到类的所有field.

            Field[] allFields = clazz.getDeclaredFields();

            // 定义一个map用于存放列的序号和field.

            Map<Integer, Field> fieldsMap = new HashMap<Integer, Field>();

            for (int col = 0; col < allFields.length; col++)

            List<Object[]> fields = this.getFields();

            Map<Integer, Object[]> fieldsMap = new HashMap<Integer, Object[]>();

            for (Object[] objects : fields)

            {

                Field field = allFields[col];

                Excel attr = field.getAnnotation(Excel.class);

                if (attr != null && (attr.type() == Type.ALL || attr.type() == type))

                Excel attr = (Excel) objects[1];

                Integer column = cellMap.get(attr.name());

                if (column != null)

                {

                    // 设置类的私有字段属性可访问.

                    field.setAccessible(true);

                    Integer column = cellMap.get(attr.name());

                    if (column != null)

                    {

                        fieldsMap.put(column, field);

                    }

                    fieldsMap.put(column, objects);

                }

            }

            for (int i = 1; i <= rows; i++)

            for (int i = titleNum + 1; i <= rows; i++)

            {

                // 从第2行开始取数据,默认第一行是表头.

                Row row = sheet.getRow(i);

@@ -252,14 +291,15 @@
                    continue;

                }

                T entity = null;

                for (Map.Entry<Integer, Field> entry : fieldsMap.entrySet())

                for (Map.Entry<Integer, Object[]> entry : fieldsMap.entrySet())

                {

                    Object val = this.getCellValue(row, entry.getKey());



                    // 如果不存在实例则新建.

                    entity = (entity == null ? clazz.newInstance() : entity);

                    // 从map中得到对应列的field.

                    Field field = fieldsMap.get(entry.getKey());

                    Field field = (Field) entry.getValue()[0];

                    Excel attr = (Excel) entry.getValue()[1];

                    // 取得类型,并根据对象类型设置值.

                    Class<?> fieldType = field.getType();

                    if (String.class == fieldType)

@@ -319,7 +359,6 @@
                    }

                    if (StringUtils.isNotNull(fieldType))

                    {

                        Excel attr = field.getAnnotation(Excel.class);

                        String propertyName = field.getName();

                        if (StringUtils.isNotEmpty(attr.targetAttr()))

                        {

@@ -333,6 +372,10 @@
                        {

                            val = reverseDictByExp(Convert.toStr(val), attr.dictType(), attr.separator());

                        }

                        else if (!attr.handler().equals(ExcelHandlerAdapter.class))

                        {

                            val = dataFormatHandlerAdapter(val, attr);

                        }

                        else if (ColumnType.IMAGE == attr.cellType() && StringUtils.isNotEmpty(pictures))

                        {

                            PictureData image = pictures.get(row.getRowNum() + "_" + entry.getKey());

@@ -340,8 +383,11 @@
                            {

                                val = "";

                            }

                            byte[] data = image.getData();

                            val = FileUtils.writeImportBytes(data);

                            else

                            {

                                byte[] data = image.getData();

                                val = FileUtils.writeImportBytes(data);

                            }

                        }

                        ReflectUtils.invokeSetter(entity, propertyName, val);

                    }

@@ -361,7 +407,20 @@
     */

    public AjaxResult exportExcel(List<T> list, String sheetName)

    {

        this.init(list, sheetName, Type.EXPORT);

        return exportExcel(list, sheetName, StringUtils.EMPTY);

    }

    
    /**

     * 对list数据源将其里面的数据导入到excel表单

     * 
     * @param list 导出数据集合

     * @param sheetName 工作表的名称

     * @param title 标题

     * @return 结果

     */

    public AjaxResult exportExcel(List<T> list, String sheetName, String title)

    {

        this.init(list, sheetName, title, Type.EXPORT);

        return exportExcel();

    }



@@ -374,12 +433,27 @@
     * @return 结果

     * @throws IOException

     */

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName) throws IOException

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)

    {

        exportExcel(response, list, sheetName, StringUtils.EMPTY);

    }



    /**

     * 对list数据源将其里面的数据导入到excel表单

     * 
     * @param response 返回数据

     * @param list 导出数据集合

     * @param sheetName 工作表的名称

     * @param title 标题

     * @return 结果

     * @throws IOException

     */

    public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title)

    {

        response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");

        response.setCharacterEncoding("utf-8");

        this.init(list, sheetName, Type.EXPORT);

        exportExcel(response.getOutputStream());

        this.init(list, sheetName, title, Type.EXPORT);

        exportExcel(response);

    }



    /**

@@ -390,7 +464,19 @@
     */

    public AjaxResult importTemplateExcel(String sheetName)

    {

        this.init(null, sheetName, Type.IMPORT);

        return importTemplateExcel(sheetName, StringUtils.EMPTY);

    }



    /**

     * 对list数据源将其里面的数据导入到excel表单

     * 
     * @param sheetName 工作表的名称

     * @param title 标题

     * @return 结果

     */

    public AjaxResult importTemplateExcel(String sheetName, String title)

    {

        this.init(null, sheetName, title, Type.IMPORT);

        return exportExcel();

    }



@@ -400,12 +486,24 @@
     * @param sheetName 工作表的名称

     * @return 结果

     */

    public void importTemplateExcel(HttpServletResponse response, String sheetName) throws IOException

    public void importTemplateExcel(HttpServletResponse response, String sheetName)

    {

        importTemplateExcel(response, sheetName, StringUtils.EMPTY);

    }



    /**

     * 对list数据源将其里面的数据导入到excel表单

     * 
     * @param sheetName 工作表的名称

     * @param title 标题

     * @return 结果

     */

    public void importTemplateExcel(HttpServletResponse response, String sheetName, String title)

    {

        response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");

        response.setCharacterEncoding("utf-8");

        this.init(null, sheetName, Type.IMPORT);

        exportExcel(response.getOutputStream());

        this.init(null, sheetName, title, Type.IMPORT);

        exportExcel(response);

    }



    /**

@@ -413,12 +511,12 @@
     * 

     * @return 结果

     */

    public void exportExcel(OutputStream out)

    public void exportExcel(HttpServletResponse response)

    {

        try

        {

            writeSheet();

            wb.write(out);

            wb.write(response.getOutputStream());

        }

        catch (Exception e)

        {

@@ -427,7 +525,6 @@
        finally

        {

            IOUtils.closeQuietly(wb);

            IOUtils.closeQuietly(out);

        }

    }



@@ -450,7 +547,7 @@
        catch (Exception e)

        {

            log.error("导出Excel异常{}", e.getMessage());

            throw new CustomException("导出Excel失败，请联系网站管理员！");

            throw new UtilException("导出Excel失败，请联系网站管理员！");

        }

        finally

        {

@@ -465,13 +562,13 @@
    public void writeSheet()

    {

        // 取出一共有多少个sheet.

        double sheetNo = Math.ceil(list.size() / sheetSize);

        for (int index = 0; index <= sheetNo; index++)

        int sheetNo = Math.max(1, (int) Math.ceil(list.size() * 1.0 / sheetSize));

        for (int index = 0; index < sheetNo; index++)

        {

            createSheet(sheetNo, index);



            // 产生一行

            Row row = sheet.createRow(0);

            Row row = sheet.createRow(rownum);

            int column = 0;

            // 写入各个字段的列头名称

            for (Object[] os : fields)

@@ -499,7 +596,7 @@
        int endNo = Math.min(startNo + sheetSize, list.size());

        for (int i = startNo; i < endNo; i++)

        {

            row = sheet.createRow(i + 1 - startNo);

            row = sheet.createRow(i + 1 + rownum - startNo);

            // 得到导出对象.

            T vo = (T) list.get(i);

            int column = 0;

@@ -507,8 +604,6 @@
            {

                Field field = (Field) os[0];

                Excel excel = (Excel) os[1];

                // 设置实体类私有属性可访问

                field.setAccessible(true);

                this.addCell(excel, row, vo, field, column++);

            }

        }

@@ -525,6 +620,16 @@
        // 写入各条记录,每条记录对应excel表中的一行

        Map<String, CellStyle> styles = new HashMap<String, CellStyle>();

        CellStyle style = wb.createCellStyle();

        style.setAlignment(HorizontalAlignment.CENTER);

        style.setVerticalAlignment(VerticalAlignment.CENTER);

        Font titleFont = wb.createFont();

        titleFont.setFontName("Arial");

        titleFont.setFontHeightInPoints((short) 16);

        titleFont.setBold(true);

        style.setFont(titleFont);

        styles.put("title", style);



        style = wb.createCellStyle();

        style.setAlignment(HorizontalAlignment.CENTER);

        style.setVerticalAlignment(VerticalAlignment.CENTER);

        style.setBorderRight(BorderStyle.THIN);

@@ -607,7 +712,13 @@
    {

        if (ColumnType.STRING == attr.cellType())

        {

            cell.setCellValue(StringUtils.isNull(value) ? attr.defaultValue() : value + attr.suffix());

            String cellValue = Convert.toStr(value);

            // 对于任何以表达式触发字符 =-+@开头的单元格，直接使用tab字符作为前缀，防止CSV注入。

            if (StringUtils.containsAny(cellValue, FORMULA_STR))

            {

                cellValue = StringUtils.replaceEach(cellValue, FORMULA_STR, new String[] { "\t=", "\t-", "\t+", "\t@" });

            }

            cell.setCellValue(StringUtils.isNull(cellValue) ? attr.defaultValue() : cellValue + attr.suffix());

        }

        else if (ColumnType.NUMERIC == attr.cellType())

        {

@@ -725,6 +836,10 @@
                else if (value instanceof BigDecimal && -1 != attr.scale())

                {

                    cell.setCellValue((((BigDecimal) value).setScale(attr.scale(), attr.roundingMode())).toString());

                }

                else if (!attr.handler().equals(ExcelHandlerAdapter.class))

                {

                    cell.setCellValue(dataFormatHandlerAdapter(value, attr));

                }

                else

                {

@@ -899,6 +1014,28 @@
    }



    /**

     * 数据处理器

     * 
     * @param value 数据值

     * @param excel 数据注解

     * @return

     */

    public String dataFormatHandlerAdapter(Object value, Excel excel)

    {

        try

        {

            Object instance = excel.handler().newInstance();

            Method formatMethod = excel.handler().getMethod("format", new Class[] { Object.class, String[].class });

            value = formatMethod.invoke(instance, value, excel.args());

        }

        catch (Exception e)

        {

            log.error("不能格式化数据 " + excel.handler(), e.getMessage());

        }

        return Convert.toStr(value);

    }



    /**

     * 合计统计信息

     */

    private void addStatisticsData(Integer index, String text, Excel entity)

@@ -1025,7 +1162,17 @@
     */

    private void createExcelField()

    {

        this.fields = new ArrayList<Object[]>();

        this.fields = getFields();

        this.fields = this.fields.stream().sorted(Comparator.comparing(objects -> ((Excel) objects[1]).sort())).collect(Collectors.toList());

        this.maxHeight = getRowHeight();

    }



    /**

     * 获取字段注解信息

     */

    public List<Object[]> getFields()

    {

        List<Object[]> fields = new ArrayList<Object[]>();

        List<Field> tempFields = new ArrayList<>();

        tempFields.addAll(Arrays.asList(clazz.getSuperclass().getDeclaredFields()));

        tempFields.addAll(Arrays.asList(clazz.getDeclaredFields()));

@@ -1034,7 +1181,12 @@
            // 单注解

            if (field.isAnnotationPresent(Excel.class))

            {

                putToField(field, field.getAnnotation(Excel.class));

                Excel attr = field.getAnnotation(Excel.class);

                if (attr != null && (attr.type() == Type.ALL || attr.type() == type))

                {

                    field.setAccessible(true);

                    fields.add(new Object[] { field, attr });

                }

            }



            // 多注解

@@ -1042,14 +1194,17 @@
            {

                Excels attrs = field.getAnnotation(Excels.class);

                Excel[] excels = attrs.value();

                for (Excel excel : excels)

                for (Excel attr : excels)

                {

                    putToField(field, excel);

                    if (attr != null && (attr.type() == Type.ALL || attr.type() == type))

                    {

                        field.setAccessible(true);

                        fields.add(new Object[] { field, attr });

                    }

                }

            }

        }

        this.fields = this.fields.stream().sorted(Comparator.comparing(objects -> ((Excel) objects[1]).sort())).collect(Collectors.toList());

        this.maxHeight = getRowHeight();

        return fields;

    }



    /**

@@ -1067,22 +1222,14 @@
    }



    /**

     * 放到字段集合中

     */

    private void putToField(Field field, Excel attr)

    {

        if (attr != null && (attr.type() == Type.ALL || attr.type() == type))

        {

            this.fields.add(new Object[] { field, attr });

        }

    }



    /**

     * 创建一个工作簿

     */

    public void createWorkbook()

    {

        this.wb = new SXSSFWorkbook(500);

        this.sheet = wb.createSheet();

        wb.setSheetName(0, sheetName);

        this.styles = createStyles(wb);

    }



    /**

@@ -1091,17 +1238,13 @@
     * @param sheetNo sheet数量

     * @param index 序号

     */

    public void createSheet(double sheetNo, int index)

    public void createSheet(int sheetNo, int index)

    {

        this.sheet = wb.createSheet();

        this.styles = createStyles(wb);

        // 设置工作表的名称.

        if (sheetNo == 0)

        if (sheetNo > 1 && index > 0)

        {

            wb.setSheetName(index, sheetName);

        }

        else

        {

            this.sheet = wb.createSheet();

            this.createTitle();

            wb.setSheetName(index, sheetName + index);

        }

    }

@@ -1196,7 +1339,7 @@
     * @param workbook 工作簿对象

     * @return Map key:图片单元格索引（1_1）String，value:图片流PictureData

     */

    public static Map<String, PictureData> getSheetPictrues03(HSSFSheet sheet, HSSFWorkbook workbook)

    public static Map<String, PictureData> getSheetPictures03(HSSFSheet sheet, HSSFWorkbook workbook)

    {

        Map<String, PictureData> sheetIndexPicMap = new HashMap<String, PictureData>();

        List<HSSFPictureData> pictures = workbook.getAllPictures();

@@ -1229,7 +1372,7 @@
     * @param workbook 工作簿对象

     * @return Map key:图片单元格索引（1_1）String，value:图片流PictureData

     */

    public static Map<String, PictureData> getSheetPictrues07(XSSFSheet sheet, XSSFWorkbook workbook)

    public static Map<String, PictureData> getSheetPictures07(XSSFSheet sheet, XSSFWorkbook workbook)

    {

        Map<String, PictureData> sheetIndexPicMap = new HashMap<String, PictureData>();

        for (POIXMLDocumentPart dr : sheet.getRelations())