From 75069baad4cfb2671b38b3d9f66d82d24673e35b Mon Sep 17 00:00:00 2001 From: Binary Wang Date: Tue, 8 May 2018 23:19:03 +0800 Subject: [PATCH] =?UTF-8?q?#556=20=E6=97=A5=E5=BF=97=E4=BF=A1=E6=81=AF?= =?UTF-8?q?=E4=B8=AD=E5=A6=82=E6=9E=9C=E5=90=AB=E6=9C=89secret=E5=80=BC?= =?UTF-8?q?=E7=9A=84=EF=BC=8C=E5=B0=86=E5=85=B6=E5=80=BC=E9=9A=90=E8=97=8F?= =?UTF-8?q?=E6=8E=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- weixin-java-common/pom.xml | 5 ++++ .../chanjar/weixin/common/util/DataUtils.java | 24 +++++++++++++++++++ .../weixin/common/util/DataUtilsTest.java | 23 ++++++++++++++++++ .../cp/api/impl/WxCpServiceAbstractImpl.java | 14 +++++------ .../wx/miniapp/api/impl/WxMaServiceImpl.java | 21 ++++++++++------ .../mp/api/impl/WxMpServiceBaseImpl.java | 9 ++++--- 6 files changed, 78 insertions(+), 18 deletions(-) create mode 100644 weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java create mode 100644 weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java diff --git a/weixin-java-common/pom.xml b/weixin-java-common/pom.xml index 3f07954f..2b74fe0b 100644 --- a/weixin-java-common/pom.xml +++ b/weixin-java-common/pom.xml @@ -109,6 +109,11 @@ jetty-servlet test + + org.assertj + assertj-guava + test + diff --git a/weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java b/weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java new file mode 100644 index 00000000..983d9a66 --- /dev/null +++ b/weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java @@ -0,0 +1,24 @@ +package me.chanjar.weixin.common.util; + +import org.apache.commons.lang3.StringUtils; + +/** + *
+ *  数据处理工具类
+ *  Created by BinaryWang on 2018/5/8.
+ * 
+ * + * @author Binary Wang + */ +public class DataUtils { + /** + * 将数据中包含的secret字符使用星号替换,防止日志打印时被输出 + */ + public static E handleDataWithSecret(E data) { + E dataForLog = data; + if(data instanceof String && StringUtils.contains((String)data, "&secret=")){ + dataForLog = (E) StringUtils.replaceAll((String)data,"&secret=\\w+&","&secret=******&"); + } + return dataForLog; + } +} diff --git a/weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java b/weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java new file mode 100644 index 00000000..af348809 --- /dev/null +++ b/weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java @@ -0,0 +1,23 @@ +package me.chanjar.weixin.common.util; + +import org.testng.annotations.Test; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.testng.Assert.*; + +/** + *
+ *  Created by BinaryWang on 2018/5/8.
+ * 
+ * + * @author Binary Wang + */ +public class DataUtilsTest { + + @Test + public void testHandleDataWithSecret() { + String data = "js_code=001tZveq0SMoiq1AEXeq0ECJeq0tZveZ&secret=5681022fa1643845392367ea88888888&grant_type=authorization_code&appid=wxe156d4848d999999"; + final String s = DataUtils.handleDataWithSecret(data); + assertThat(s).contains("&secret=******&"); + } +} diff --git a/weixin-java-cp/src/main/java/me/chanjar/weixin/cp/api/impl/WxCpServiceAbstractImpl.java b/weixin-java-cp/src/main/java/me/chanjar/weixin/cp/api/impl/WxCpServiceAbstractImpl.java index c7ebfa1d..560cb2c1 100644 --- a/weixin-java-cp/src/main/java/me/chanjar/weixin/cp/api/impl/WxCpServiceAbstractImpl.java +++ b/weixin-java-cp/src/main/java/me/chanjar/weixin/cp/api/impl/WxCpServiceAbstractImpl.java @@ -5,13 +5,12 @@ import com.google.gson.JsonElement; import com.google.gson.JsonObject; import com.google.gson.JsonParser; import me.chanjar.weixin.common.bean.WxJsapiSignature; -import me.chanjar.weixin.common.bean.menu.WxMenu; import me.chanjar.weixin.common.bean.result.WxError; -import me.chanjar.weixin.common.bean.result.WxMediaUploadResult; import me.chanjar.weixin.common.exception.WxErrorException; import me.chanjar.weixin.common.session.StandardSessionManager; import me.chanjar.weixin.common.session.WxSession; import me.chanjar.weixin.common.session.WxSessionManager; +import me.chanjar.weixin.common.util.DataUtils; import me.chanjar.weixin.common.util.RandomUtils; import me.chanjar.weixin.common.util.crypto.SHA1; import me.chanjar.weixin.common.util.http.RequestExecutor; @@ -21,14 +20,11 @@ import me.chanjar.weixin.common.util.http.SimplePostRequestExecutor; import me.chanjar.weixin.cp.api.*; import me.chanjar.weixin.cp.bean.*; import me.chanjar.weixin.cp.config.WxCpConfigStorage; -import org.apache.commons.lang3.StringUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.io.File; import java.io.IOException; -import java.io.InputStream; -import java.util.List; public abstract class WxCpServiceAbstractImpl implements WxCpService, RequestHttp { protected final Logger log = LoggerFactory.getLogger(this.getClass()); @@ -201,6 +197,8 @@ public abstract class WxCpServiceAbstractImpl implements WxCpService, Requ } protected T executeInternal(RequestExecutor executor, String uri, E data) throws WxErrorException { + E dataForLog = DataUtils.handleDataWithSecret(data); + if (uri.contains("access_token=")) { throw new IllegalArgumentException("uri参数中不允许有access_token: " + uri); } @@ -210,7 +208,7 @@ public abstract class WxCpServiceAbstractImpl implements WxCpService, Requ try { T result = executor.execute(uriWithAccessToken, data); - this.log.debug("\n【请求地址】: {}\n【请求参数】:{}\n【响应数据】:{}", uriWithAccessToken, data, result); + this.log.debug("\n【请求地址】: {}\n【请求参数】:{}\n【响应数据】:{}", uriWithAccessToken, dataForLog, result); return result; } catch (WxErrorException e) { WxError error = e.getError(); @@ -227,12 +225,12 @@ public abstract class WxCpServiceAbstractImpl implements WxCpService, Requ } if (error.getErrorCode() != 0) { - this.log.error("\n【请求地址】: {}\n【请求参数】:{}\n【错误信息】:{}", uriWithAccessToken, data, error); + this.log.error("\n【请求地址】: {}\n【请求参数】:{}\n【错误信息】:{}", uriWithAccessToken, dataForLog, error); throw new WxErrorException(error, e); } return null; } catch (IOException e) { - this.log.error("\n【请求地址】: {}\n【请求参数】:{}\n【异常信息】:{}", uriWithAccessToken, data, e.getMessage()); + this.log.error("\n【请求地址】: {}\n【请求参数】:{}\n【异常信息】:{}", uriWithAccessToken, dataForLog, e.getMessage()); throw new RuntimeException(e); } } diff --git a/weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/WxMaServiceImpl.java b/weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/WxMaServiceImpl.java index 014ca1c9..e238a345 100644 --- a/weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/WxMaServiceImpl.java +++ b/weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/WxMaServiceImpl.java @@ -16,6 +16,7 @@ import com.google.common.base.Joiner; import me.chanjar.weixin.common.bean.WxAccessToken; import me.chanjar.weixin.common.bean.result.WxError; import me.chanjar.weixin.common.exception.WxErrorException; +import me.chanjar.weixin.common.util.DataUtils; import me.chanjar.weixin.common.util.crypto.SHA1; import me.chanjar.weixin.common.util.http.HttpType; import me.chanjar.weixin.common.util.http.RequestExecutor; @@ -24,6 +25,7 @@ import me.chanjar.weixin.common.util.http.SimpleGetRequestExecutor; import me.chanjar.weixin.common.util.http.SimplePostRequestExecutor; import me.chanjar.weixin.common.util.http.apache.ApacheHttpClientBuilder; import me.chanjar.weixin.common.util.http.apache.DefaultApacheHttpClientBuilder; +import org.apache.commons.lang3.StringUtils; import org.apache.http.HttpHost; import org.apache.http.client.config.RequestConfig; import org.apache.http.client.methods.CloseableHttpResponse; @@ -38,6 +40,9 @@ import java.util.HashMap; import java.util.Map; import java.util.concurrent.locks.Lock; +import static cn.binarywang.wx.miniapp.constant.WxMaConstants.*; +import static cn.binarywang.wx.miniapp.constant.WxMaConstants.ErrorCode.*; + /** * @author Binary Wang */ @@ -212,7 +217,9 @@ public class WxMaServiceImpl implements WxMaService, RequestHttp T executeInternal(RequestExecutor executor, String uri, E data) throws WxErrorException { + private T executeInternal(RequestExecutor executor, String uri, E data) throws WxErrorException { + E dataForLog = DataUtils.handleDataWithSecret(data); + if (uri.contains("access_token=")) { throw new IllegalArgumentException("uri参数中不允许有access_token: " + uri); } @@ -222,16 +229,16 @@ public class WxMaServiceImpl implements WxMaService, RequestHttp implements WxMpService, RequestH } public T executeInternal(RequestExecutor executor, String uri, E data) throws WxErrorException { + E dataForLog = DataUtils.handleDataWithSecret(data); + if (uri.contains("access_token=")) { throw new IllegalArgumentException("uri参数中不允许有access_token: " + uri); } @@ -275,7 +278,7 @@ public abstract class WxMpServiceBaseImpl implements WxMpService, RequestH try { T result = executor.execute(uriWithAccessToken, data); - this.log.debug("\n【请求地址】: {}\n【请求参数】:{}\n【响应数据】:{}", uriWithAccessToken, data, result); + this.log.debug("\n【请求地址】: {}\n【请求参数】:{}\n【响应数据】:{}", uriWithAccessToken, dataForLog, result); return result; } catch (WxErrorException e) { WxError error = e.getError(); @@ -294,12 +297,12 @@ public abstract class WxMpServiceBaseImpl implements WxMpService, RequestH } if (error.getErrorCode() != 0) { - this.log.error("\n【请求地址】: {}\n【请求参数】:{}\n【错误信息】:{}", uriWithAccessToken, data, error); + this.log.error("\n【请求地址】: {}\n【请求参数】:{}\n【错误信息】:{}", uriWithAccessToken, dataForLog, error); throw new WxErrorException(error, e); } return null; } catch (IOException e) { - this.log.error("\n【请求地址】: {}\n【请求参数】:{}\n【异常信息】:{}", uriWithAccessToken, data, e.getMessage()); + this.log.error("\n【请求地址】: {}\n【请求参数】:{}\n【异常信息】:{}", uriWithAccessToken, dataForLog, e.getMessage()); throw new WxErrorException(WxError.builder().errorMsg(e.getMessage()).build(), e); } }