From fef0630608f7ca85dc2afd050221b16abdb062de Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: 星期四, 27 一月 2022 12:12:08 +0800
Subject: [PATCH] 导出Excel时屏蔽公式，防止CSV注入风险
---
src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java | 27 +++++++++++++++++----------
1 files changed, 17 insertions(+), 10 deletions(-)
diff --git a/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java b/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java
index 52854bf..a350ef2 100644
--- a/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java
+++ b/src/main/java/com/ruoyi/common/utils/poi/ExcelUtil.java
@@ -86,6 +86,8 @@
{
private static final Logger log = LoggerFactory.getLogger(ExcelUtil.class);
+ public static final String[] FORMULA_STR = { "=", "-", "+", "@" };
+
/**
* Excel sheet鏈�澶ц鏁帮紝榛樿65536
*/
@@ -431,7 +433,7 @@
* @return 缁撴灉
* @throws IOException
*/
- public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)throws IOException
+ public void exportExcel(HttpServletResponse response, List<T> list, String sheetName)
{
exportExcel(response, list, sheetName, StringUtils.EMPTY);
}
@@ -446,12 +448,12 @@
* @return 缁撴灉
* @throws IOException
*/
- public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title) throws IOException
+ public void exportExcel(HttpServletResponse response, List<T> list, String sheetName, String title)
{
response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
response.setCharacterEncoding("utf-8");
this.init(list, sheetName, title, Type.EXPORT);
- exportExcel(response.getOutputStream());
+ exportExcel(response);
}
/**
@@ -484,7 +486,7 @@
* @param sheetName 宸ヤ綔琛ㄧ殑鍚嶇О
* @return 缁撴灉
*/
- public void importTemplateExcel(HttpServletResponse response, String sheetName) throws IOException
+ public void importTemplateExcel(HttpServletResponse response, String sheetName)
{
importTemplateExcel(response, sheetName, StringUtils.EMPTY);
}
@@ -496,12 +498,12 @@
* @param title 鏍囬
* @return 缁撴灉
*/
- public void importTemplateExcel(HttpServletResponse response, String sheetName, String title) throws IOException
+ public void importTemplateExcel(HttpServletResponse response, String sheetName, String title)
{
response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
response.setCharacterEncoding("utf-8");
this.init(null, sheetName, title, Type.IMPORT);
- exportExcel(response.getOutputStream());
+ exportExcel(response);
}
/**
@@ -509,12 +511,12 @@
*
* @return 缁撴灉
*/
- public void exportExcel(OutputStream out)
+ public void exportExcel(HttpServletResponse response)
{
try
{
writeSheet();
- wb.write(out);
+ wb.write(response.getOutputStream());
}
catch (Exception e)
{
@@ -523,7 +525,6 @@
finally
{
IOUtils.closeQuietly(wb);
- IOUtils.closeQuietly(out);
}
}
@@ -711,7 +712,13 @@
{
if (ColumnType.STRING == attr.cellType())
{
- cell.setCellValue(StringUtils.isNull(value) ? attr.defaultValue() : value + attr.suffix());
+ String cellValue = Convert.toStr(value);
+ // 瀵逛簬浠讳綍浠ヨ〃杈惧紡瑙﹀彂瀛楃 =-+@寮�澶寸殑鍗曞厓鏍硷紝鐩存帴浣跨敤tab瀛楃浣滀负鍓嶇紑锛岄槻姝SV娉ㄥ叆銆�
+ if (StringUtils.containsAny(cellValue, FORMULA_STR))
+ {
+ cellValue = StringUtils.replaceEach(cellValue, FORMULA_STR, new String[] { "\t=", "\t-", "\t+", "\t@" });
+ }
+ cell.setCellValue(StringUtils.isNull(cellValue) ? attr.defaultValue() : cellValue + attr.suffix());
}
else if (ColumnType.NUMERIC == attr.cellType())
{
--
Gitblit v1.9.3