修复漏洞

pjcloud-common/pjcloud-common-security/src/main/java/com/bsd/pjcloud/common/security/handler/SsoLogoutSuccessHandler.java

@@ -8,6 +8,9 @@ import org.springframework.security.web.authentication.logout.LogoutSuccessHandl
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Set;
 
 /**
  * @author pjcloud
@@ -19,21 +22,53 @@ public class SsoLogoutSuccessHandler implements LogoutSuccessHandler {
 
 	private static final String REDIRECT_URL = "redirect_url";
 
+	// 定义允许重定向的域名白名单
+	//todo 如果使用需要进行可配置话操作
+	private static final Set<String> ALLOWED_DOMAINS = Set.of(
+			"localhost",
+			"127.0.0.1"
+	);
+
 	@Override
 	public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
 			throws IOException {
 
-		// 获取请求参数中是否包含 回调地址
 		String redirectUrl = request.getParameter(REDIRECT_URL);
 		String referer = request.getHeader(HttpHeaders.REFERER);
 
-		if (StrUtil.isNotBlank(redirectUrl)) {
+		// 修复漏洞1：验证redirect_url参数
+		if (StrUtil.isNotBlank(redirectUrl) && isUrlSafe(redirectUrl)) {
 			response.sendRedirect(redirectUrl);
 		}
-		else if (StrUtil.isNotBlank(referer)) {
-			// 默认跳转referer 地址
+		// 修复漏洞2：验证Referer头
+		else if (StrUtil.isNotBlank(referer) && isUrlSafe(referer)) {
 			response.sendRedirect(referer);
 		}
+		else {
+			// 默认重定向到安全页面
+			response.sendRedirect("/login");
+		}
 	}
 
+	private boolean isUrlSafe(String url) {
+		try {
+			// 检查是否是相对URL
+			if (url.startsWith("/") || url.startsWith("./") || url.startsWith("../")) {
+				return true; // 相对URL是安全的
+			}
+
+			URI uri = new URI(url);
+			String host = uri.getHost();
+
+			// 检查是否在白名单中
+			if (host != null) {
+				return ALLOWED_DOMAINS.contains(host.toLowerCase());
+			}
+
+			return false; // 无效URL
+
+		} catch (URISyntaxException e) {
+			return false; // 无效URL
+		}
+	}
 }

pom.xml

@@ -116,7 +116,7 @@
         <module>pjcloud-common</module>
         <module>pjcloud-flow</module>
         <module>pjcloud-visual</module>
-        <module>pjcloud-app-server</module>
+<!--        <module>pjcloud-app-server</module>-->
         <module>pjcloud-thirdparty</module>
         <module>pjcloud-canteen</module>
         <module>pjcloud-integrated</module>