fj-dc/.svn/pristine/47/470555454ba7830567735c8a9439e8ba52fda74a.svn-base

package cn.com.goldenwater.dcproj.target;

import cn.com.goldenwater.dcproj.constValue.CommonLabel;
import cn.com.goldenwater.dcproj.dao.BisInspAllRlationPersDao;
import cn.com.goldenwater.dcproj.model.BisInspAllRlationPers;
import cn.com.goldenwater.dcproj.utils.RequestUtils;
import cn.com.goldenwater.target.CheckException;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import io.swagger.annotations.ApiModelProperty;
import org.apache.commons.lang3.StringUtils;
import org.aspectj.lang.JoinPoint;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.aspectj.lang.annotation.Pointcut;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Field;
import java.util.Arrays;
import java.util.Iterator;
import java.util.List;
import java.util.Map;

/**
 * zhengdafei bean验证切面,作用域为系统中所有的实体参数
 */
@Aspect
@Component("verifyBeanAspect")
public class VerifyBeanAspect {

    private static final Logger log = LoggerFactory.getLogger(VerifyBeanAspect.class);
    private final static String[] badSqlflag = new String[]{"$", " or", "select"
            , "&", " and", "drop", " 1=", "delete", "update", "from", "insert", "\\'", "execute", "dual", " order ", " by "};

    @Autowired
    private BisInspAllRlationPersDao inspAllRlationPersDao;

    @Pointcut("execution(* cn.com.goldenwater.dcproj.controller..*(..)) && !execution(* cn.com.goldenwater.dcproj.controller.index..*(..))&& !execution(* cn.com.goldenwater.dcproj.controller.sso..*(..))&& !execution(* cn.com.goldenwater.dcproj.controller.ducha..*(..))&& !execution(* cn.com.goldenwater.dcproj.task..*(..))\"")
//    @Pointcut("@annotation(cn.com.goldenwater.dcproj.target.VerifyBean)")
    public void verifyBeanAspect() {
    }

    /**
     * 前置通知：目标方法执行之前执行以下方法体的内容
     *
     * @param jp
     */
    @Before(value = "verifyBeanAspect()")
    public void beforeMethod(JoinPoint jp) throws Exception {
        getAnnotationDesc(jp);
    }

    private String getAnnotationDesc(JoinPoint joinPoint) throws Exception {
        List args = Arrays.asList(joinPoint.getArgs());
        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
        HttpServletResponse response = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getResponse();
        String paramPersId = RequestUtils.getPersId(request, response);
        String orgId = request.getHeader(CommonLabel.ORGId);
        if ("041".equals(orgId)) {
            return "";
        }
        if (args.size() > 0) {
            String reqPath = request.getRequestURL().toString();
            if (reqPath.contains("bis/insp/key/register") || reqPath.contains("pers/position")) {
                //172工程先放过
                return "";
            }
            String path = request.getRequestURI().substring(request.getContextPath().length()).replaceAll("[/]+$", "");
            if (path.equals("/bis/insp/news") ) {
                //通知公告 放过
                return "";
            }
            String persId = request.getHeader(CommonLabel.PERSID);
            BisInspAllRlationPers inspAllRlationPers = inspAllRlationPersDao.get(persId);
            for (Object object : args) {
                if (object == null) {
                    continue;
                }
                Field[] fields = object.getClass().getDeclaredFields();
                for (Field field : fields) {
                    field.setAccessible(true);
                    //所有字符数据校验
                    String name = field.getName();
                    if ("inIdsSql".equals(name)) {
                        continue;
                    }
                    String fieldStr = String.valueOf(field.get(object));
                    if (StringUtils.isBlank(fieldStr) || "null".equals(fieldStr)) {
                        continue;
                    }
                    if ("orgId".equals(name) || "orgid".equals(name) || "persType".equals(name) || "ownerSystem".equals(name)) {
                        if ("persType".equals(name)) {
                            if (!"041".equals(orgId)) {
                                if (!reqPath.contains("/sys/roles/updateRole")) {
                                    if (!fieldStr.equals(inspAllRlationPers.getPersType())) {
                                        int sysRole = Integer.parseInt(inspAllRlationPers.getPersType());
                                        //参数权限
                                        int paramRole = Integer.parseInt(fieldStr);
                                        if (sysRole > paramRole) {
                                            throw new CheckException("role系统存在危险操作!!");
                                        }
                                    }
                                }
                            }
                        }
                        if ("ownerSystem".equals(name)) {
                            if (!fieldStr.equals(inspAllRlationPers.getOwnerSystem())) {
                                throw new CheckException("ownerSystem系统存在危险操作!!");
                            }
                        }
                    }
                    //针对该参数的二次校验，防止系统中有遗漏
                    if ("persid".equals(name.toLowerCase())) {
                        //针对特定接口进行排除。有些接口可能不需要处理
                        if (StringUtils.isNotBlank(fieldStr) && !"null".equals(fieldStr)) {
                            if (StringUtils.isNotBlank(paramPersId)) {
                                if (!fieldStr.equals(paramPersId)) {
                                    throw new CheckException("[paramPersId]:" + paramPersId + "[persId]:" + fieldStr + ",当前用户无权限执行该操作!");
                                }
                            }
                        }
                    }
                    ValidInValue validInValue = field.getAnnotation(ValidInValue.class);
                    if (validInValue != null) {
                        checkBadStr(fieldStr, field, name, object);
                    }
                    if (field.getAnnotation(ApiModelProperty.class) != null) {
                        String notes = field.getAnnotation(ApiModelProperty.class).notes();
                        //有必填标准的数据
                        if (field.getAnnotation(ApiModelProperty.class).required()) {
                            if (field.get(object) == null || "".equals(field.get(object))) {
                                throw new CheckException(notes + "[" + name + "]不能为空:" + field.get(object));
                            }
                        } else {
                            Object fieldStr2 = field.get(object);
                            if (fieldStr2 instanceof String) {
                                String fieldS = String.valueOf(fieldStr2);
                                checkBadStr(fieldS, field, name, fieldStr2);
                            } else if (fieldStr2 instanceof List) {
                                checkList(fieldStr2, name, field, object);
                            }
                        }

                    }
                }
            }
        }
        return "";
    }

    /**
     * 递归检查list内部参数
     */
    private void checkList(Object fieldStr2, String name, Field field, Object object) throws Exception {
        String jsonObject = JSONObject.toJSONString(fieldStr2);
        JSONArray jsonArray = JSONArray.parseArray(jsonObject);
        JSONObject object1 = null;
        for (int i = 0; i < jsonArray.size(); i++) {
            object1 = jsonArray.getJSONObject(i);
            Iterator iter = object1.entrySet().iterator();
            while (iter.hasNext()) {
                Map.Entry entry = (Map.Entry) iter.next();
                Object value = entry.getValue();
                if (value == null || "".equals(value)) {
                    continue;
                }
                if (value instanceof String) {
                    checkBadStr(String.valueOf(value), field, name, object);
                } else if (value instanceof List) {
                    checkList(value, name, field, object);
                }
            }
        }
    }

    private void checkBadStr(String fieldStr, Field field, String name, Object object) throws Exception {
        if (StringUtils.isNotBlank(fieldStr)) {
            for (String str : badSqlflag) {
                if (fieldStr.contains(str)) {
                    if (fieldStr.startsWith("[")) {
                        continue;
                    }
                    throw new CheckException("[" + name + "]存在特殊字符:" + field.get(object));
                }
            }
        }
    }

}