Skip to content
Permalink
Browse files Browse the repository at this point in the history
fix(测试跟踪): 缺陷平台请求转发添加白名单
  • Loading branch information
AgAngle committed Dec 9, 2022
1 parent c51cb6e commit d0f95b5
Show file tree
Hide file tree
Showing 10 changed files with 63 additions and 63 deletions.
Expand Up @@ -21,7 +21,7 @@ public class SessionFilter implements WebFilter {
private static final String[] TO_SUB_SERVICE = new String[]{"/license", "/system", "/resource", "/sso/callback/logout", "/sso/callback/cas/logout"};
private static final String PERFORMANCE_DOWNLOAD_PREFIX = "/jmeter/";
private static final String API_DOWNLOAD_PREFIX = "/api/jmeter/";
private static final String TRACK_IMAGE_PREFIX = "/resource/md/get/url";
private static final String TRACK_IMAGE_PREFIX = "/resource/md/get/path";

@Resource
private DiscoveryClient discoveryClient;
Expand Down
Expand Up @@ -106,10 +106,10 @@ public interface IssuesPlatform {

/**
* Get请求的代理
* @param url
* @param path
* @return
*/
ResponseEntity proxyForGet(String url, Class responseEntityClazz);
ResponseEntity proxyForGet(String path, Class responseEntityClazz);

/**
* 同步MS缺陷附件到第三方平台
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
Expand Up @@ -23,7 +23,7 @@
<spring-cloud.version>2021.0.5</spring-cloud.version>
<spring-security.version>5.7.5</spring-security.version>
<dubbo.version>2.7.18</dubbo.version>
<platform-plugin-sdk.version>1.0.0</platform-plugin-sdk.version>
<platform-plugin-sdk.version>1.1.0</platform-plugin-sdk.version>
<flyway.version>7.15.0</flyway.version>
<shiro.version>1.10.1</shiro.version>
<mssql-jdbc.version>7.4.1.jre8</mssql-jdbc.version>
Expand Down
Expand Up @@ -15,9 +15,10 @@ public class IssueProxyResourceController {
@Resource
IssueProxyResourceService issueProxyResourceService;

@GetMapping(value = "/md/get/url")
public ResponseEntity<byte[]> getFileByUrl(@RequestParam ("url") String url, @RequestParam (value = "platform", required = false) String platform,
@RequestParam (value = "workspace_id", required = false) String workspaceId) {
return issueProxyResourceService.getMdImageByUrl(url, platform, workspaceId);
@GetMapping(value = "/md/get/path")
public ResponseEntity<byte[]> getFileByPath(@RequestParam ("path") String path,
@RequestParam (value = "platform") String platform,
@RequestParam (value = "workspaceId") String workspaceId) {
return issueProxyResourceService.getMdImageByPath(path, platform, workspaceId);
}
}
Expand Up @@ -59,7 +59,6 @@
import io.metersphere.xpack.track.dto.request.IssuesRequest;
import io.metersphere.xpack.track.dto.request.IssuesUpdateRequest;
import io.metersphere.xpack.track.issue.IssuesPlatform;
import jodd.util.CollectionUtil;
import io.metersphere.xpack.track.service.XpackIssueService;
import org.apache.commons.collections.CollectionUtils;
import org.apache.commons.collections.MapUtils;
Expand Down Expand Up @@ -697,8 +696,6 @@ public List<IssuesDao> list(IssuesRequest request) {
item.setCaseCount(caseIdSet.size());
});
buildCustomField(issues);
//处理MD图片链接内容
handleJiraIssueMdUrl(request.getWorkspaceId(), request.getProjectId(), issues);
return issues;
}

Expand Down Expand Up @@ -789,35 +786,6 @@ private void buildCustomField(List<IssuesDao> data, Boolean isThirdTemplate, Lis

}

private void handleJiraIssueMdUrl(String workPlaceId, String projectId, List<IssuesDao> issues) {
issues.forEach(issue -> {
if (StringUtils.isNotEmpty(issue.getDescription()) && issue.getDescription().contains("platform=Jira&")) {
issue.setDescription(replaceJiraMdUrlParam(issue.getDescription(), workPlaceId, projectId));
}
if (StringUtils.isNotEmpty(issue.getCustomFields()) && issue.getCustomFields().contains("platform=Jira&")) {
issue.setCustomFields(replaceJiraMdUrlParam(issue.getCustomFields(), workPlaceId, projectId));
}
if (CollectionUtils.isNotEmpty(issue.getFields())) {
issue.getFields().forEach(field -> {
if (StringUtils.isNotEmpty(field.getTextValue()) && field.getTextValue().contains("platform=Jira&")) {
field.setTextValue(replaceJiraMdUrlParam(field.getTextValue(), workPlaceId, projectId));
}
if (StringUtils.isNotEmpty(field.getValue()) && field.getValue().contains("platform=Jira&")) {
field.setValue(replaceJiraMdUrlParam(field.getValue(), workPlaceId, projectId));
}
});
}
});
}

private String replaceJiraMdUrlParam(String url, String workspaceId, String projectId) {
if (url.contains("&workspace_id=")) {
return url;
}
return url.replaceAll("platform=Jira&",
"platform=Jira&workspace_id=" + workspaceId + "&");
}

private Map<String, List<IssueCommentDTO>> getCommentMap(List<IssuesDao> issues) {
List<String> issueIds = issues.stream().map(IssuesDao::getId).collect(Collectors.toList());
List<IssueCommentDTO> comments = extIssueCommentMapper.getCommentsByIssueIds(issueIds);
Expand Down
Expand Up @@ -88,6 +88,7 @@ public Platform getPlatform(String platformKey, String workspaceId) {
ServiceIntegration serviceIntegration = baseIntegrationService.get(integrationRequest);

PlatformRequest pluginRequest = new PlatformRequest();
pluginRequest.setWorkspaceId(workspaceId);
pluginRequest.setIntegrationConfig(serviceIntegration.getConfiguration());
Platform platform = getPluginManager().getPlatformByKey(platformKey, pluginRequest);
if (platform == null) {
Expand Down
Expand Up @@ -4,7 +4,6 @@
import io.metersphere.commons.utils.JSON;
import io.metersphere.commons.utils.LogUtil;
import io.metersphere.commons.utils.UnicodeConvertUtils;
import io.metersphere.i18n.Translator;
import io.metersphere.service.issue.domain.zentao.*;
import org.apache.commons.lang3.StringUtils;
import org.springframework.core.io.FileSystemResource;
Expand All @@ -13,6 +12,8 @@
import org.springframework.util.MultiValueMap;

import java.io.File;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.Map;

public abstract class ZentaoClient extends BaseClient {
Expand Down Expand Up @@ -244,4 +245,19 @@ public byte[] getAttachmentBytes(String fileId) {
null, byte[].class, fileId, sessionId);
return response.getBody();
}

public ResponseEntity proxyForGet(String path, Class responseEntityClazz) {
im.metersphere.plugin.utils.LogUtil.info("zentao proxyForGet: " + path);
String url = this.ENDPOINT + path;
try {
if (!StringUtils.containsAny(new URI(url).getPath(), "/index.php", "/file-read-")) {
// 只允许访问图片
MSException.throwException("illegal path");
}
} catch (URISyntaxException e) {
LogUtil.error(e);
MSException.throwException("illegal path");
}
return restTemplate.exchange(url, HttpMethod.GET, null, responseEntityClazz);
}
}
Expand Up @@ -6,7 +6,6 @@
import io.metersphere.base.mapper.TestCaseIssuesMapper;
import io.metersphere.base.mapper.ext.ExtIssuesMapper;
import io.metersphere.commons.constants.CustomFieldType;
import io.metersphere.commons.constants.IssueRefType;
import io.metersphere.commons.constants.IssuesStatus;
import io.metersphere.commons.exception.MSException;
import io.metersphere.commons.utils.*;
Expand All @@ -32,6 +31,7 @@

import java.io.File;
import java.net.URLDecoder;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.*;
import java.util.function.Function;
Expand Down Expand Up @@ -65,6 +65,8 @@ public abstract class AbstractIssuePlatform implements IssuesPlatform {
protected AttachmentModuleRelationMapper attachmentModuleRelationMapper;
protected BaseProjectService baseProjectService;

public static final String PROXY_PATH = "/resource/md/get/path?platform=%s&workspaceId=%s&path=%s";

public String getKey() {
return key;
}
Expand Down Expand Up @@ -114,6 +116,10 @@ protected String getPlatformConfig(String platform) {
return integration.getConfiguration();
}

protected String getProxyPath(String path) {
return String.format(PROXY_PATH, this.key, this.workspaceId, URLEncoder.encode(path, StandardCharsets.UTF_8));
}

protected HttpHeaders auth(String apiUser, String password) {
String authKey = EncryptUtils.base64Encoding(apiUser + ":" + password);
HttpHeaders headers = new HttpHeaders();
Expand Down Expand Up @@ -333,7 +339,7 @@ public List<File> getImageFiles(String input) {
while (matcher.find()) {
try {
String path = matcher.group(2);
if (!path.contains("/resource/md/get/url")) {
if (!path.contains("/resource/md/get/url") && !path.contains("/resource/md/get/path")) {
if (path.contains("/resource/md/get/")) { // 兼容旧数据
String name = path.substring(path.indexOf("/resource/md/get/") + 17);
files.add(new File(FileUtils.MD_IMAGE_DIR + "/" + name));
Expand Down
Expand Up @@ -492,7 +492,7 @@ private String ms2ZentaoDescription(String msDescription) {
while (matcher.find()) {
// get file name
String originSubUrl = matcher.group(1);
if (originSubUrl.contains("/url?url=")) {
if (originSubUrl.contains("/url?url=") || originSubUrl.contains("/path?")) {
String path = URLDecoder.decode(originSubUrl, StandardCharsets.UTF_8);
String fileName;
if (path.indexOf("fileID") > 0) {
Expand Down Expand Up @@ -565,15 +565,17 @@ private String packageDescriptionByPathAndName(String path, String name) {
}
} else {
name = name.replaceAll("&amp;", "&");
try {
URI uri = new URI(zentaoClient.getBaseUrl());
path = uri.getScheme() + "://" + uri.getHost() + path.replaceAll("&amp;", "&");
} catch (URISyntaxException e) {
path = zentaoClient.getBaseUrl() + path.replaceAll("&amp;", "&");
LogUtil.error(e);
path = path.replaceAll("&amp;", "&");
}
StringBuilder stringBuilder = new StringBuilder();
for (String item : path.split("&")) {
// 去掉多余的参数
if (!StringUtils.containsAny(item, "platform", "workspaceId")) {
stringBuilder.append(item);
stringBuilder.append("&");
}
}
path = "/resource/md/get/url?url=" + URLEncoder.encode(path, StandardCharsets.UTF_8);
path = getProxyPath(stringBuilder.toString());
}
// 图片与描述信息之间需换行,否则无法预览图片
result = "\n\n![" + name + "](" + path + ")";
Expand Down Expand Up @@ -682,4 +684,9 @@ public List<PlatformStatusDTO> getTransitions(String issueKey) {
}
return platformStatusDTOS;
}

@Override
public ResponseEntity proxyForGet(String path, Class responseEntityClazz) {
return zentaoClient.proxyForGet(path, responseEntityClazz);
}
}
@@ -1,10 +1,10 @@
package io.metersphere.service.wapper;

import io.metersphere.commons.exception.MSException;
import io.metersphere.i18n.Translator;
import io.metersphere.commons.constants.IssuesManagePlatform;
import io.metersphere.service.PlatformPluginService;
import io.metersphere.service.issue.platform.IssueFactory;
import io.metersphere.xpack.track.dto.request.IssuesRequest;
import org.apache.commons.lang3.StringUtils;
import org.springframework.http.HttpMethod;
import org.springframework.http.ResponseEntity;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
Expand All @@ -25,19 +25,20 @@ public class IssueProxyResourceService {
* http 代理
* 如果当前访问地址是 https,直接访问 http 的图片资源
* 由于浏览器的安全机制,http 会被转成 https
* @param url
* @param path
* @param platform
* @return
*/
public ResponseEntity<byte[]> getMdImageByUrl(String url, String platform, String workspaceId) {
if (url.contains("md/get/url")) {
MSException.throwException(Translator.get("invalid_parameter"));
}
if (StringUtils.isNotBlank(platform)) {
return platformPluginService.getPlatform(platform, workspaceId)
.proxyForGet(url, byte[].class);
public ResponseEntity<byte[]> getMdImageByPath(String path, String platform, String workspaceId) {
if (StringUtils.equals(IssuesManagePlatform.Zentao.name(), platform)) {
IssuesRequest issuesRequest = new IssuesRequest();
issuesRequest.setWorkspaceId(workspaceId);
return IssueFactory.createPlatform(platform, issuesRequest)
.proxyForGet(path, byte[].class);

} else {
return platformPluginService.getPlatform(platform, workspaceId)
.proxyForGet(path, byte[].class);
}
return restTemplate.exchange(url, HttpMethod.GET, null, byte[].class);
}
}

0 comments on commit d0f95b5

Please sign in to comment.