添加 controller #9
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Summary by CodeRabbit
Walkthrough本次变更新增了一个名为 Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant CommandInject
participant SecurityUtil
participant WebUtils
participant Shell
Client->>CommandInject: GET /codeinject?filepath=xxx
CommandInject->>Shell: 执行 ls -la <filepath>
Shell-->>CommandInject: 返回命令输出
CommandInject->>WebUtils: convertStreamToString
WebUtils-->>CommandInject: 返回字符串
CommandInject-->>Client: 返回命令输出
Client->>CommandInject: GET /codeinject/host (Host 头)
CommandInject->>SecurityUtil: hostFilter(Host)
SecurityUtil-->>CommandInject: 返回过滤结果
alt Host 合法
CommandInject->>Shell: 执行 curl <Host>
Shell-->>CommandInject: 返回命令输出
CommandInject->>WebUtils: convertStreamToString
WebUtils-->>CommandInject: 返回字符串
CommandInject-->>Client: 返回命令输出
else Host 非法
CommandInject-->>Client: 抛出异常
end
Client->>CommandInject: GET /codeinject/sec?filepath=xxx
CommandInject->>SecurityUtil: cmdFilter(filepath)
SecurityUtil-->>CommandInject: 返回过滤结果
alt 过滤通过
CommandInject->>Shell: 执行 ls -la <filteredFilePath>
Shell-->>CommandInject: 返回命令输出
CommandInject->>WebUtils: convertStreamToString
WebUtils-->>CommandInject: 返回字符串
CommandInject-->>Client: 返回命令输出
else 过滤失败
CommandInject-->>Client: 返回 "Bad boy. I got u."
end
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
src/main/java/org/joychou/controller/CommandInject2.java (1)
13-68: 架构安全建议此控制器的所有方法都执行系统命令，这种设计模式存在根本性的安全风险。基于方法名和注释，这似乎是用于演示命令注入漏洞的代码。
建议：
- 生产环境禁用：如果这是演示代码，确保不会部署到生产环境
- 使用 Java API：尽可能使用 Java 原生 API 替代系统命令
- 最小权限原则：如果必须执行命令，使用受限的用户权限运行应用
- 添加认证授权：为这些端点添加严格的访问控制
- 审计日志：记录所有命令执行请求的详细信息
如需在生产环境中实现类似功能，建议重新设计架构，避免直接执行系统命令。
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
src/main/java/org/joychou/controller/CommandInject2.java(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
src/main/java/org/joychou/controller/CommandInject2.java (2)
src/main/java/org/joychou/security/SecurityUtil.java (1)
SecurityUtil(18-253)src/main/java/org/joychou/util/WebUtils.java (1)
WebUtils(10-51)
🔇 Additional comments (1)
src/main/java/org/joychou/controller/CommandInject2.java (1)
39-54: 注意：未能定位hostFilter的具体实现，请手动确认其安全性基于当前检查，
codeInjectHost方法仍存在安全隐患：
- 请求头
Host可被伪造，过滤逻辑是否完善尚无法验证- 直接拼接并执行
curl命令存在 SSRF 风险及内部网络探测风险建议：
- 避免基于用户输入执行系统命令
- 使用 Java 原生 HTTP 客户端（如
HttpClient）替代curl- 明确定义并严格维护目标主机白名单
- 手动审查
SecurityUtil.hostFilter实现，确保只允许合法域名或 IP
Comment on lines
+1
to
+14
| package org.joychou.controller; | ||
|
|
||
| import org.joychou.security.SecurityUtil; | ||
| import org.joychou.util.WebUtils; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import org.springframework.web.bind.annotation.GetMapping; | ||
| import org.springframework.web.bind.annotation.RestController; | ||
|
|
||
| import javax.servlet.http.HttpServletRequest; | ||
| import java.io.IOException; | ||
|
|
||
| @RestController | ||
| public class CommandInject { |
There was a problem hiding this comment.
文件名与类名不一致
文件名为 CommandInject2.java，但类名为 CommandInject。这会导致编译错误。
-public class CommandInject {
+public class CommandInject2 {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| package org.joychou.controller; | |
| import org.joychou.security.SecurityUtil; | |
| import org.joychou.util.WebUtils; | |
| import org.slf4j.Logger; | |
| import org.slf4j.LoggerFactory; | |
| import org.springframework.web.bind.annotation.GetMapping; | |
| import org.springframework.web.bind.annotation.RestController; | |
| import javax.servlet.http.HttpServletRequest; | |
| import java.io.IOException; | |
| @RestController | |
| public class CommandInject { | |
| package org.joychou.controller; | |
| import org.joychou.security.SecurityUtil; | |
| import org.joychou.util.WebUtils; | |
| import org.slf4j.Logger; | |
| import org.slf4j.LoggerFactory; | |
| import org.springframework.web.bind.annotation.GetMapping; | |
| import org.springframework.web.bind.annotation.RestController; | |
| import javax.servlet.http.HttpServletRequest; | |
| import java.io.IOException; | |
| @RestController | |
| public class CommandInject2 { |
🤖 Prompt for AI Agents
In src/main/java/org/joychou/controller/CommandInject2.java at lines 1 to 14,
the class name CommandInject does not match the file name CommandInject2.java,
causing a compilation error. Rename the class to CommandInject2 to match the
file name exactly.
Comment on lines
+56
to
+67
| @GetMapping("/codeinject/sec") | ||
| public String codeInjectSec(String filepath) throws IOException { | ||
| String filterFilePath = SecurityUtil.cmdFilter(filepath); | ||
| if (null == filterFilePath) { | ||
| return "Bad boy. I got u."; | ||
| } | ||
| String[] cmdList = new String[]{"sh", "-c", "ls -la " + filterFilePath}; | ||
| ProcessBuilder builder = new ProcessBuilder(cmdList); | ||
| builder.redirectErrorStream(true); | ||
| Process process = builder.start(); | ||
| return WebUtils.convertStreamToString(process.getInputStream()); | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
相对安全但仍需改进
此方法使用了 SecurityUtil.cmdFilter 进行输入过滤，相比其他方法更安全。根据代码片段，过滤器只允许字母、数字、下划线、斜杠、点和连字符。
但仍建议：
- 避免使用 shell 模式，改用参数化命令
- 考虑使用 Java 原生 API 替代系统命令
改进方案：
@GetMapping("/codeinject/sec")
public String codeInjectSec(String filepath) throws IOException {
String filterFilePath = SecurityUtil.cmdFilter(filepath);
if (null == filterFilePath) {
return "Bad boy. I got u.";
}
- String[] cmdList = new String[]{"sh", "-c", "ls -la " + filterFilePath};
+ // 使用参数化命令，避免 shell 注入
+ String[] cmdList = new String[]{"ls", "-la", filterFilePath};
ProcessBuilder builder = new ProcessBuilder(cmdList);
builder.redirectErrorStream(true);
Process process = builder.start();
return WebUtils.convertStreamToString(process.getInputStream());
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| @GetMapping("/codeinject/sec") | |
| public String codeInjectSec(String filepath) throws IOException { | |
| String filterFilePath = SecurityUtil.cmdFilter(filepath); | |
| if (null == filterFilePath) { | |
| return "Bad boy. I got u."; | |
| } | |
| String[] cmdList = new String[]{"sh", "-c", "ls -la " + filterFilePath}; | |
| ProcessBuilder builder = new ProcessBuilder(cmdList); | |
| builder.redirectErrorStream(true); | |
| Process process = builder.start(); | |
| return WebUtils.convertStreamToString(process.getInputStream()); | |
| } | |
| @GetMapping("/codeinject/sec") | |
| public String codeInjectSec(String filepath) throws IOException { | |
| String filterFilePath = SecurityUtil.cmdFilter(filepath); | |
| if (null == filterFilePath) { | |
| return "Bad boy. I got u."; | |
| } | |
| // 使用参数化命令，避免 shell 注入 | |
| String[] cmdList = new String[]{"ls", "-la", filterFilePath}; | |
| ProcessBuilder builder = new ProcessBuilder(cmdList); | |
| builder.redirectErrorStream(true); | |
| Process process = builder.start(); | |
| return WebUtils.convertStreamToString(process.getInputStream()); | |
| } |
🤖 Prompt for AI Agents
In src/main/java/org/joychou/controller/CommandInject2.java lines 56 to 67, the
method uses a shell command with ProcessBuilder that concatenates user input,
which is risky despite input filtering. To fix this, avoid using the shell by
passing command and arguments as separate parameters to ProcessBuilder without
"sh -c". Alternatively, replace the system command with Java native APIs like
java.nio.file.Files to list directory contents, eliminating the need for
external commands and improving security.
Comment on lines
+24
to
+32
| @GetMapping("/codeinject") | ||
| public String codeInject(String filepath) throws IOException { | ||
|
|
||
| String[] cmdList = new String[]{"sh", "-c", "ls -la " + filepath}; | ||
| ProcessBuilder builder = new ProcessBuilder(cmdList); | ||
| builder.redirectErrorStream(true); | ||
| Process process = builder.start(); | ||
| return WebUtils.convertStreamToString(process.getInputStream()); | ||
| } |
There was a problem hiding this comment.
严重安全漏洞：命令注入
此方法存在严重的命令注入漏洞。用户输入的 filepath 参数直接拼接到 shell 命令中，没有进行任何过滤或转义。攻击者可以通过注入特殊字符（如分号、管道符等）执行任意命令。
建议使用以下方式修复：
@GetMapping("/codeinject")
public String codeInject(String filepath) throws IOException {
- String[] cmdList = new String[]{"sh", "-c", "ls -la " + filepath};
+ // 方案1：使用参数化命令，避免 shell 解析
+ String[] cmdList = new String[]{"ls", "-la", filepath};
+
+ // 方案2：如果必须使用 shell，先进行严格过滤
+ // String filterFilePath = SecurityUtil.cmdFilter(filepath);
+ // if (filterFilePath == null) {
+ // throw new IllegalArgumentException("非法的文件路径");
+ // }
+ // String[] cmdList = new String[]{"sh", "-c", "ls -la " + filterFilePath};
+
ProcessBuilder builder = new ProcessBuilder(cmdList);
builder.redirectErrorStream(true);
Process process = builder.start();
return WebUtils.convertStreamToString(process.getInputStream());
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| @GetMapping("/codeinject") | |
| public String codeInject(String filepath) throws IOException { | |
| String[] cmdList = new String[]{"sh", "-c", "ls -la " + filepath}; | |
| ProcessBuilder builder = new ProcessBuilder(cmdList); | |
| builder.redirectErrorStream(true); | |
| Process process = builder.start(); | |
| return WebUtils.convertStreamToString(process.getInputStream()); | |
| } | |
| @GetMapping("/codeinject") | |
| public String codeInject(String filepath) throws IOException { | |
| // 方案1：使用参数化命令，避免 shell 解析 | |
| String[] cmdList = new String[]{"ls", "-la", filepath}; | |
| // 方案2：如果必须使用 shell，先进行严格过滤 | |
| // String filterFilePath = SecurityUtil.cmdFilter(filepath); | |
| // if (filterFilePath == null) { | |
| // throw new IllegalArgumentException("非法的文件路径"); | |
| // } | |
| // String[] cmdList = new String[]{"sh", "-c", "ls -la " + filterFilePath}; | |
| ProcessBuilder builder = new ProcessBuilder(cmdList); | |
| builder.redirectErrorStream(true); | |
| Process process = builder.start(); | |
| return WebUtils.convertStreamToString(process.getInputStream()); | |
| } |
🤖 Prompt for AI Agents
In src/main/java/org/joychou/controller/CommandInject2.java around lines 24 to
32, the method directly concatenates the user input filepath into a shell
command, causing a critical command injection vulnerability. To fix this, avoid
using shell command strings with concatenated user input; instead, pass the
filepath as a separate argument to ProcessBuilder without invoking a shell, or
validate and sanitize the filepath input strictly before use. This prevents
execution of arbitrary commands injected via special characters.
cccfeng
commented
Jun 30, 2025
Comment on lines
+1
to
+2
| package org.joychou.controller; | ||
|
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
hello body??