代码审计-spring

servers/boe-server-all/pom.xml

@@ -58,7 +58,7 @@
 			<artifactId>xboe-module-scorm</artifactId>
 			<version>1.0.0</version>
 		</dependency>
-		 <dependency>
+		<dependency>
 			<groupId>com.xboe</groupId>
 			<artifactId>xboe-core</artifactId>
 			<version>1.0.0</version>
@@ -233,6 +233,31 @@
 			<artifactId>spring-retry</artifactId>
 			<version>1.3.1</version>
 		</dependency>
+
+		<dependency>
+			<groupId>org.springframework</groupId>
+			<artifactId>spring-webmvc</artifactId>
+			<version>5.3.26</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.yaml</groupId>
+			<artifactId>snakeyaml</artifactId>
+			<version>2.0</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-text</artifactId>
+			<version>1.10.0</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.apache.tomcat.embed</groupId>
+			<artifactId>tomcat-embed-core</artifactId>
+			<version>9.0.83</version>
+		</dependency>
+
 	</dependencies>
 	<build>
 		<resources>

servers/boe-server-all/src/main/java/com/xboe/module/course/api/CourseWareApi.java

@@ -9,7 +9,6 @@ import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -29,7 +28,6 @@ import com.xboe.module.course.service.ICourseFileService;
  */
 @RestController
 @RequestMapping(value = "/xboe/m/course/cware")
-@Slf4j
 public class CourseWareApi extends ApiBaseController {
 
 	private String cookieName = "PLAYSIGN_TIME";
@@ -133,8 +131,6 @@ public class CourseWareApi extends ApiBaseController {
 		// 第一个/前端是时间
 		int index = signStr.indexOf("/");
 		if (index <= 0) {
-			log.info("解密后的字符串:"+signStr);
-			log.info("解密后的字符串的时间拼接:"+index);
 			return badRequest("验证错误");
 		}
 
@@ -142,13 +138,9 @@ public class CourseWareApi extends ApiBaseController {
 		String cfid = signStr.substring(index+1);// 文件路径
 
 		if (!time.equals(cookieTime)) {
-			log.info("请求头时间和解析后的时间对比:"+"解析时间:"+time+"    请求头时间："+cookieTime);
-			log.info("解密后的字符串的时间拼接:"+signStr);
 			return badRequest("验证错误");
 		}
 		if(StringUtils.isBlank(cfid) || cfid.length()<10) {
-			log.info("查看时间文件路径："+cfid);
-			log.info("解密后的字符串的时间拼接:"+signStr);
 			return badRequest("验证错误");
 		}
 

servers/boe-server-all/src/main/java/com/xboe/module/exam/api/AloneExamApi.java

@@ -355,17 +355,17 @@ public class AloneExamApi extends ApiBaseController {
     			return badRequest("此考试无试卷内容，考试已经过期或试卷已被删除");
     		}
             try {
-                List<TestQuestionVo> qlist=this.randomQuestion(examTest, paperJson);
+            	List<TestQuestionVo> qlist=this.randomQuestion(examTest, paperJson);
-                ObjectMapper objectMapper = new ObjectMapper();
+            	ObjectMapper objectMapper = new ObjectMapper();
-                paperJson=objectMapper.writeValueAsString(qlist);
+            	paperJson=objectMapper.writeValueAsString(qlist);
-            } catch (XaskException e) {
+			} catch (XaskException e) {
-                log.error("生成试卷错误",e);
+				log.error("生成试卷错误",e);
-                return error("生成考试试卷错误",e.getMessage(),map);
+				return error("生成考试试卷错误",e.getMessage(),map);
-            } catch (JsonProcessingException e) {
+			} catch (JsonProcessingException e) {
-                log.error("生成试卷，解析生成json错误",e);
+				log.error("生成试卷，解析生成json错误",e);
-                return error("生成考试试卷解析错误",e.getMessage(),map);
+				return error("生成考试试卷解析错误",e.getMessage(),map);
-            }
+			}
-        }
+    	}
     	map.put("paper", paperJson);
     	long end=System.currentTimeMillis();
     	log.info("开始考试用时="+(end-start)+" ms");

servers/boe-server-all/src/main/java/com/xboe/module/exam/api/ExamQuestionApi.java

@@ -166,258 +166,118 @@ public class ExamQuestionApi extends ApiBaseController {
                 return badRequest("请上传正确的试题文件");
             }
             //获取表头
-            Row row ;
+            Row row = sheetAt.getRow(1);
             //从第二行开始获取数据
             List<ExamQuestion> examQuestions1 = new ArrayList<>();
             QuestionDto questionDto = new QuestionDto();
-            if(sheetAt.getRow(1).getCell(0).getStringCellValue().equals("标题(*)") && !sheetAt.getRow(1).getCell(0).getStringCellValue().equals("")){
-                row = sheetAt.getRow(1);
-                for (int i = 2;i<sheetAt.getPhysicalNumberOfRows();i++) {
-                    //获取每一行
 
-                    Row row1 = sheetAt.getRow(i);
+            for (int i=2;i<sheetAt.getPhysicalNumberOfRows();i++) {
-                    if(row1==null || row1.getCell(0)==null){
+                //获取每一行
-                        break;
-                    }
-                    if(StringUtil.isBlank(row1.getCell(0).getStringCellValue())){
-                        break;
-                    }
-                    ExamQuestion examQuestion = new ExamQuestion();
-                    examQuestion.setTitle(row1.getCell(0).getStringCellValue());
-                    if(row1.getCell(1).getStringCellValue().equals("单选题")){
-                        examQuestion.setType(1);
-                    }
-                    if(row1.getCell(1).getStringCellValue().equals("多选题")){
-                        examQuestion.setType(2);
-                    }
-                    if(row1.getCell(2).getStringCellValue().equals("中")){
-                        examQuestion.setDifficulty(2f);
-                    }else if(row1.getCell(2).getStringCellValue().equals("难")){
-                        examQuestion.setDifficulty(3f);
-                    } else if(row1.getCell(2).getStringCellValue().equals("易")){
-                        examQuestion.setDifficulty(1f);
-                    }else  if(row1.getCell(2).getStringCellValue().equals("")){
-                        examQuestion.setDifficulty(null);
-                    }
-                    Cell cell = row1.getCell(3);
-                    cell.setCellType(CellType.STRING);
 
-//                examQuestion.setDefaultScore(Float.valueOf(cell.getStringCellValue()));
+                Row row1 = sheetAt.getRow(i);
-
+                if(row1==null || row1.getCell(0)==null){
-                    //单选
+                    break;
-                    if (!cell.getStringCellValue().contains(",")){
-                        examQuestion.setAnswer(row1.getCell(5).getStringCellValue());
-                        if (row1.getCell(3).getStringCellValue().isEmpty()){
-                            examQuestion.setDefaultScore(null);
-                        }else {
-                            examQuestion.setDefaultScore(Float.valueOf(row1.getCell(3).getStringCellValue()));
-                        }
-                        Cell cell1 = row1.getCell(4, Row.MissingCellPolicy.CREATE_NULL_AS_BLANK);
-                        cell1.setCellType(CellType.STRING);
-                        examQuestion.setAnalysis(cell1.getStringCellValue());
-
-                        List<ExamOption> examOptions = new ArrayList<>();
-                        for (int j=6;j<=12;j++) {
-
-                            if(row1.getCell(j)!=null) {
-                                ExamOption examOption = new ExamOption();
-//                            截取表头
-                                String substring = row.getCell(j).getStringCellValue().substring(3, 4);
-                                if (row1.getCell(5).getStringCellValue().contains(substring)) {
-
-                                    examOption.setIsAnswer(true);
-                                    if (row1.getCell(3).getStringCellValue().isEmpty()){
-                                        examOption.setScore(null);
-                                    }else {
-                                        examOption.setScore(Float.valueOf(row1.getCell(3).getStringCellValue()));
-                                    }
-                                } else {
-                                    examOption.setIsAnswer(false);
-                                }
-                                if (examOption.getIsAnswer()) {
-                                    if (row1.getCell(3).getStringCellValue().isEmpty()){
-                                        examOption.setScore(null);
-                                    }else {
-                                        examOption.setScore(Float.valueOf(row1.getCell(3).getStringCellValue()));
-                                    }
-                                }
-
-                                examOption.setOptions(row.getCell(j).getStringCellValue());
-
-                                Cell cell2 = row1.getCell(j);
-                                cell2.setCellType(CellType.STRING);
-                                examOption.setContent(cell2.getStringCellValue());
-
-                                if (examOption != null && StringUtil.isNotBlank(examOption.getContent())) {
-                                    examOptions.add(examOption);
-                                }
-                            }
-                        }
-
-                        examQuestion.setOptionList(examOptions);
-                        examQuestions1.add(examQuestion);
-                    }
-                    //多选 多选的默认分存的是最大分
-                    else{
-                        String stringCellValue = row1.getCell(4).getStringCellValue();
-                        String[] strings = stringCellValue.split(",");
-//                    String[] strings = new String[stringCellValue.length()];
-                        String max=strings[0];
-                        for (int j=0;j<strings.length;j++) {
-                            if(Float.valueOf(max)<Float.valueOf(strings[j])){
-                                max=strings[j];
-                            }
-                        }
-                        examQuestion.setDefaultScore(Float.valueOf(max));
-                        Cell cell1 = row1.getCell(4, Row.MissingCellPolicy.CREATE_NULL_AS_BLANK);
-                        cell1.setCellType(CellType.STRING);
-                        examQuestion.setAnalysis(cell1.getStringCellValue());
-                        examQuestion.setAnswer(row1.getCell(5).getStringCellValue());
-                        List<ExamOption> examOptions = new ArrayList<>();
-                        //A
-                        for (int j=6;j<=12;j++){
-                            if(row1.getCell(j)!=null && StringUtil.isNotBlank(row1.getCell(j).getStringCellValue())){
-                                ExamOption examOption=new ExamOption();
-                                examOption.setOptions(row.getCell(j).getStringCellValue());
-                                examOption.setContent(row1.getCell(j).getStringCellValue());
-                                examOption.setIsAnswer(true);
-                                examOption.setScore(Float.valueOf(strings[j-6]));
-                                if(examOption!=null && StringUtil.isNotBlank(examOption.getContent())){
-                                    examOptions.add(examOption);
-                                }
-
-                            }
-                        }
-                        examQuestion.setOptionList(examOptions);
-                        examQuestions1.add(examQuestion);
-                    }
                 }
-            }else {
+                if(StringUtil.isBlank(row1.getCell(0).getStringCellValue())){
-                row = sheetAt.getRow(2);
+                    break;
-                for (int i = 3;i<sheetAt.getPhysicalNumberOfRows();i++) {
+                }
-                    //获取每一行
+                ExamQuestion examQuestion = new ExamQuestion();
-
+                examQuestion.setTitle(row1.getCell(0).getStringCellValue());
-                    Row row1 = sheetAt.getRow(i);
+                if(row1.getCell(1).getStringCellValue().equals("单选题")){
-                    if(row1==null || row1.getCell(0)==null){
+                    examQuestion.setType(1);
-                        break;
+                }
-                    }
+                if(row1.getCell(1).getStringCellValue().equals("多选题")){
-                    if(StringUtil.isBlank(row1.getCell(0).getStringCellValue())){
+                    examQuestion.setType(2);
-                        break;
+                }
-                    }
+                examQuestion.setKnowledge(row1.getCell(2).getStringCellValue());
-                    ExamQuestion examQuestion = new ExamQuestion();
+                if(row1.getCell(3).getStringCellValue().equals("中")){
-                    examQuestion.setTitle(row1.getCell(0).getStringCellValue());
+                    examQuestion.setDifficulty(2f);
-                    if(row1.getCell(1).getStringCellValue().equals("单选题")){
+                }
-                        examQuestion.setType(1);
+                if(row1.getCell(3).getStringCellValue().equals("难")){
-                    }
+                    examQuestion.setDifficulty(3f);
-                    if(row1.getCell(1).getStringCellValue().equals("多选题")){
+                }
-                        examQuestion.setType(2);
+                if(row1.getCell(3).getStringCellValue().equals("低")){
-                    }
+                    examQuestion.setDifficulty(1f);
-                    log.debug("row1.getCell(2) = " + row1.getCell(2));
+                }
-                    if (row1.getCell(2)==null ||row1.getCell(2).getStringCellValue() == null  || row1.getCell(2).getStringCellValue().equals("")){
+                Cell cell = row1.getCell(4);
-                        examQuestion.setDifficulty(null);
+                cell.setCellType(CellType.STRING);
-                    }else{
-                        if( row1.getCell(2).getStringCellValue().equals("中")){
-                            examQuestion.setDifficulty(2f);
-                        }else if(row1.getCell(2).getStringCellValue().equals("难")){
-                            examQuestion.setDifficulty(3f);
-                        } else if(row1.getCell(2).getStringCellValue().equals("易")){
-                            examQuestion.setDifficulty(1f);
-                        }else  if(row1.getCell(2).getStringCellValue().equals("")){
-                            examQuestion.setDifficulty(null);
-                        }
-                    }
-                    Cell cell = row1.getCell(3);
-                    cell.setCellType(CellType.STRING);
 
 //                examQuestion.setDefaultScore(Float.valueOf(cell.getStringCellValue()));
 
-                    //单选
+                //单选
-                    if (!cell.getStringCellValue().contains(",")){
+                if (!cell.getStringCellValue().contains(",")){
-                        examQuestion.setAnswer(row1.getCell(5).getStringCellValue());
+                    examQuestion.setAnswer(row1.getCell(6).getStringCellValue());
-                        if (row1.getCell(3).getStringCellValue().isEmpty()){
+                    examQuestion.setDefaultScore(Float.valueOf(row1.getCell(4).getStringCellValue()));
-                            examQuestion.setDefaultScore(null);
+                    Cell cell1 = row1.getCell(5, Row.MissingCellPolicy.CREATE_NULL_AS_BLANK);
-                        }else {
+                    cell1.setCellType(CellType.STRING);
-                            examQuestion.setDefaultScore(Float.valueOf(row1.getCell(3).getStringCellValue()));
+                    examQuestion.setAnalysis(cell1.getStringCellValue());
-                        }
-                        Cell cell1 = row1.getCell(4, Row.MissingCellPolicy.CREATE_NULL_AS_BLANK);
-                        cell1.setCellType(CellType.STRING);
-                        examQuestion.setAnalysis(cell1.getStringCellValue());
 
-                        List<ExamOption> examOptions = new ArrayList<>();
+                    List<ExamOption> examOptions = new ArrayList<>();
-                        for (int j=6;j<=12;j++) {
+                    for (int j=7;j<=13;j++) {
 
-                            if(row1.getCell(j)!=null) {
+                        if(row1.getCell(j)!=null) {
-                                ExamOption examOption = new ExamOption();
+                            ExamOption examOption = new ExamOption();
 //                            截取表头
-                                String substring = row.getCell(j).getStringCellValue().substring(3, 4);
+                            String substring = row.getCell(j).getStringCellValue().substring(3, 4);
-                                if (row1.getCell(5).getStringCellValue().contains(substring)) {
+                            if (row1.getCell(6).getStringCellValue().contains(substring)) {
 
-                                    examOption.setIsAnswer(true);
-                                    if (row1.getCell(3).getStringCellValue().isEmpty()){
-                                        examOption.setScore(null);
-                                    }else {
-                                        examOption.setScore(Float.valueOf(row1.getCell(3).getStringCellValue()));
-                                    }
-                                } else {
-                                    examOption.setIsAnswer(false);
-                                }
-                                if (examOption.getIsAnswer()) {
-                                    if (row1.getCell(3).getStringCellValue().isEmpty()){
-                                        examOption.setScore(null);
-                                    }else {
-                                        examOption.setScore(Float.valueOf(row1.getCell(3).getStringCellValue()));
-                                    }
-                                }
-
-                                examOption.setOptions(row.getCell(j).getStringCellValue());
-
-                                Cell cell2 = row1.getCell(j);
-                                cell2.setCellType(CellType.STRING);
-                                examOption.setContent(cell2.getStringCellValue());
-
-                                if (examOption != null && StringUtil.isNotBlank(examOption.getContent())) {
-                                    examOptions.add(examOption);
-                                }
-                            }
-                        }
-
-                        examQuestion.setOptionList(examOptions);
-                        examQuestions1.add(examQuestion);
-                    }
-                    //多选 多选的默认分存的是最大分
-                    else{
-                        String stringCellValue = row1.getCell(4).getStringCellValue();
-                        String[] strings = stringCellValue.split(",");
-//                    String[] strings = new String[stringCellValue.length()];
-                        String max=strings[0];
-                        for (int j=0;j<strings.length;j++) {
-                            if(Float.valueOf(max)<Float.valueOf(strings[j])){
-                                max=strings[j];
-                            }
-                        }
-                        examQuestion.setDefaultScore(Float.valueOf(max));
-                        Cell cell1 = row1.getCell(4, Row.MissingCellPolicy.CREATE_NULL_AS_BLANK);
-                        cell1.setCellType(CellType.STRING);
-                        examQuestion.setAnalysis(cell1.getStringCellValue());
-                        examQuestion.setAnswer(row1.getCell(5).getStringCellValue());
-                        List<ExamOption> examOptions = new ArrayList<>();
-                        //A
-                        for (int j=6;j<=13;j++){
-                            if(row1.getCell(j)!=null && StringUtil.isNotBlank(row1.getCell(j).getStringCellValue())){
-                                ExamOption examOption=new ExamOption();
-                                examOption.setOptions(row.getCell(j).getStringCellValue());
-                                examOption.setContent(row1.getCell(j).getStringCellValue());
                                 examOption.setIsAnswer(true);
-                                examOption.setScore(Float.valueOf(strings[j-6]));
+                                examOption.setScore(Float.valueOf(row1.getCell(4).getStringCellValue()));
-                                if(examOption!=null && StringUtil.isNotBlank(examOption.getContent())){
+                            } else {
-                                    examOptions.add(examOption);
+                                examOption.setIsAnswer(false);
-                                }
+                            }
+                            if (examOption.getIsAnswer()) {
+                                examOption.setScore(Float.valueOf(row1.getCell(4).getStringCellValue()));
+                            }
 
+                            examOption.setOptions(row.getCell(j).getStringCellValue());
+
+                            Cell cell2 = row1.getCell(j);
+                            cell2.setCellType(CellType.STRING);
+                            examOption.setContent(cell2.getStringCellValue());
+
+                            if (examOption != null && StringUtil.isNotBlank(examOption.getContent())) {
+                                examOptions.add(examOption);
                             }
                         }
-                        examQuestion.setOptionList(examOptions);
-                        examQuestions1.add(examQuestion);
                     }
+
+                    examQuestion.setOptionList(examOptions);
+                    examQuestions1.add(examQuestion);
+                }
+                //多选 多选的默认分存的是最大分
+                else{
+                    String stringCellValue = row1.getCell(4).getStringCellValue();
+                    String[] strings = stringCellValue.split(",");
+//                    String[] strings = new String[stringCellValue.length()];
+                    String max=strings[0];
+                    for (int j=0;j<strings.length;j++) {
+                        if(Float.valueOf(max)<Float.valueOf(strings[j])){
+                            max=strings[j];
+                        }
+                    }
+                    examQuestion.setDefaultScore(Float.valueOf(max));
+                    Cell cell1 = row1.getCell(5, Row.MissingCellPolicy.CREATE_NULL_AS_BLANK);
+                    cell1.setCellType(CellType.STRING);
+                    examQuestion.setAnalysis(cell1.getStringCellValue());
+                    examQuestion.setAnswer(row1.getCell(6).getStringCellValue());
+                    List<ExamOption> examOptions = new ArrayList<>();
+                    //A
+                    for (int j=7;j<=13;j++){
+                        if(row1.getCell(j)!=null && StringUtil.isNotBlank(row1.getCell(j).getStringCellValue())){
+                            ExamOption examOption=new ExamOption();
+                            examOption.setOptions(row.getCell(j).getStringCellValue());
+                            examOption.setContent(row1.getCell(j).getStringCellValue());
+                            examOption.setIsAnswer(true);
+                            examOption.setScore(Float.valueOf(strings[j-7]));
+                            if(examOption!=null && StringUtil.isNotBlank(examOption.getContent())){
+                                examOptions.add(examOption);
+                            }
+
+                        }
+                    }
+                    examQuestion.setOptionList(examOptions);
+                    examQuestions1.add(examQuestion);
                 }
             }
             //判断题  只存在试题表中
@@ -440,30 +300,27 @@ public class ExamQuestionApi extends ApiBaseController {
                 ExamQuestion examQuestion1 = new ExamQuestion();
                 examQuestion1.setTitle(row2.getCell(0).getStringCellValue());
                 examQuestion1.setType(3);
-                System.out.println("1+++++++"+row2.getCell(1));
+                examQuestion1.setKnowledge(row2.getCell(1).getStringCellValue());
-                if(row2.getCell(1).getStringCellValue().equals("中")){
+                if(row2.getCell(2).getStringCellValue().equals("中")){
                     examQuestion1.setDifficulty(2f);
-                }else if(row2.getCell(1).getStringCellValue().equals("难")){
+                }
+                if(row2.getCell(2).getStringCellValue().equals("难")){
                     examQuestion1.setDifficulty(3f);
-                } else if(row2.getCell(1).getStringCellValue().equals("易")){
+                }
+                if(row2.getCell(2).getStringCellValue().equals("易")){
                     examQuestion1.setDifficulty(1f);
-                }else  if(row2.getCell(1).getStringCellValue().equals("")){
-                    examQuestion1.setDifficulty(null);
                 }
-                Cell cell1 = row2.getCell(2);
+                Cell cell1 = row2.getCell(3);
                 cell1.setCellType(CellType.STRING);
-                if (row2.getCell(2).getStringCellValue().isEmpty()){
+                examQuestion1.setDefaultScore(Float.valueOf(cell1.getStringCellValue()));
-                    examQuestion1.setDefaultScore(null);
+                
-                }else {
+                if(row2.getCell(4)!=null) {
-                    examQuestion1.setDefaultScore(Float.valueOf(row2.getCell(2).getStringCellValue()));
+                	examQuestion1.setAnalysis(row2.getCell(4).getStringCellValue());
-                }
-                if(row2.getCell(3)!=null) {
-                	examQuestion1.setAnalysis(row2.getCell(3).getStringCellValue());
                 }else {
                 	examQuestion1.setAnalysis("");
                 }
                 
-                String cvalue=row2.getCell(4).getStringCellValue();
+                String cvalue=row2.getCell(5).getStringCellValue();
                 examQuestion1.setAnswer(cvalue.equals("正确")? "true":"false");
                 if(examQuestion1!=null){
                     examQuestions2.add(examQuestion1);