优化验证与过滤

2022-12-28 00:21:20 +08:00
parent 656548eb64
commit 123f62f9d5
8 changed files with 108 additions and 112 deletions
@@ -1,6 +1,6 @@
 from flask_login import current_user

-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import AdminLog

@@ -10,8 +10,8 @@ def login_log(request, uid, is_access):
        'method': request.method,
        'url': request.path,
        'ip': request.remote_addr,
-        'user_agent': xss_escape(request.headers.get('User-Agent')),
-        'desc': xss_escape(request.form.get('username')),
+        'user_agent': str_escape(request.headers.get('User-Agent')),
+        'desc': str_escape(request.form.get('username')),
        'uid': uid,
        'success': int(is_access)

@@ -36,8 +36,8 @@ def admin_log(request, is_access):
        'method': request.method,
        'url': request.path,
        'ip': request.remote_addr,
-        'user_agent': xss_escape(request.headers.get('User-Agent')),
-        'desc': xss_escape(str(dict(request.values))),
+        'user_agent': str_escape(request.headers.get('User-Agent')),
+        'desc': str_escape(str(dict(request.values))),
        'uid': current_user.id,
        'success': int(is_access)

@@ -1,13 +1,11 @@
 # xss过滤
-from flask import abort, make_response, jsonify
+from flask import abort, make_response, jsonify, escape


-def xss_escape(s: str):
-    if s is None:
+def str_escape(s):
+    if not s:
        return None
-    else:
-        return s.replace("&", "&amp;").replace(">", "&gt;").replace("<", "&lt;").replace("'", "&#39;").replace('"',
-                                                                                                               "&#34;")
+    return str(escape(s))


 def check_data(schema, data):
@@ -13,6 +13,8 @@ admin_log = Blueprint('adminLog', __name__, url_prefix='/admin/log')
@admin_log.get('/')
@authorize("admin:log:main")
 def index():
+    from markupsafe import escape
+    escape
    return render_template('admin/admin_log/main.html')


@@ -4,7 +4,7 @@ from applications.common import curd
 from applications.common.helper import ModelFilter
 from applications.common.utils.http import table_api, success_api, fail_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import DictType, DictData
 from applications.schemas import DictTypeOutSchema, DictDataOutSchema
@@ -23,7 +23,7 @@ def main():
@authorize("admin:dict:main", log=True)
 def dict_type_data():
    # 获取请求参数
-    type_name = xss_escape(request.args.get('typeName', type=str))
+    type_name = str_escape(request.args.get('typeName', type=str))
    # 查询参数构造
    mf = ModelFilter()
    if type_name:
@@ -46,10 +46,10 @@ def dict_type_add():
@authorize("admin:dict:add", log=True)
 def dict_type_save():
    req_json = request.json
-    description = xss_escape(req_json.get("description"))
-    enable = xss_escape(req_json.get("enable"))
-    type_code = xss_escape(req_json.get("typeCode"))
-    type_name = xss_escape(req_json.get("typeName"))
+    description = str_escape(req_json.get("description"))
+    enable = str_escape(req_json.get("enable"))
+    type_code = str_escape(req_json.get("typeCode"))
+    type_name = str_escape(req_json.get("typeName"))
    d = DictType(type_name=type_name, type_code=type_code, enable=enable, description=description)
    db.session.add(d)
    db.session.commit()
@@ -72,11 +72,11 @@ def dict_type_edit():
@authorize("admin:dict:edit", log=True)
 def dict_type_update():
    req_json = request.json
-    id = xss_escape(req_json.get("id"))
-    description = xss_escape(req_json.get("description"))
-    enable = xss_escape(req_json.get("enable"))
-    type_code = xss_escape(req_json.get("typeCode"))
-    type_name = xss_escape(req_json.get("typeName"))
+    id = str_escape(req_json.get("id"))
+    description = str_escape(req_json.get("description"))
+    enable = str_escape(req_json.get("enable"))
+    type_code = str_escape(req_json.get("typeCode"))
+    type_name = str_escape(req_json.get("typeName"))
    DictType.query.filter_by(id=id).update({
        "description": description,
        "enable": enable,
@@ -126,7 +126,7 @@ def dict_type_delete(_id):
@admin_dict.get('/dictData/data')
@authorize("admin:dict:main", log=True)
 def dict_code_data():
-    type_code = xss_escape(request.args.get('typeCode', type=str))
+    type_code = str_escape(request.args.get('typeCode', type=str))
    dict_data = DictData.query.filter_by(type_code=type_code).layui_paginate()
    count = dict_data.total
    data = curd.model_to_dicts(schema=DictDataOutSchema, data=dict_data.items)
@@ -146,11 +146,11 @@ def dict_data_add():
@authorize("admin:dict:add", log=True)
 def dict_data_save():
    req_json = request.json
-    data_label = xss_escape(req_json.get("dataLabel"))
-    data_value = xss_escape(req_json.get("dataValue"))
-    enable = xss_escape(req_json.get("enable"))
-    remark = xss_escape(req_json.get("remark"))
-    type_code = xss_escape(req_json.get("typeCode"))
+    data_label = str_escape(req_json.get("dataLabel"))
+    data_value = str_escape(req_json.get("dataValue"))
+    enable = str_escape(req_json.get("enable"))
+    remark = str_escape(req_json.get("remark"))
+    type_code = str_escape(req_json.get("typeCode"))
    d = DictData(data_label=data_label, data_value=data_value, enable=enable, remark=remark, type_code=type_code)
    db.session.add(d)
    db.session.commit()
@@ -175,11 +175,11 @@ def dict_data_update():
    req_json = request.json
    id = req_json.get("dataId")
    DictData.query.filter_by(id=id).update({
-        "data_label": xss_escape(req_json.get("dataLabel")),
-        "data_value": xss_escape(req_json.get("dataValue")),
-        "enable": xss_escape(req_json.get("enable")),
-        "remark": xss_escape(req_json.get("remark")),
-        "type_code": xss_escape(req_json.get("typeCode"))
+        "data_label": str_escape(req_json.get("dataLabel")),
+        "data_value": str_escape(req_json.get("dataValue")),
+        "enable": str_escape(req_json.get("enable")),
+        "remark": str_escape(req_json.get("remark")),
+        "type_code": str_escape(req_json.get("typeCode"))
    })
    db.session.commit()
    return success_api(msg="更新成功")
@@ -3,7 +3,7 @@ from flask import Blueprint, render_template, request, jsonify
 from applications.common import curd
 from applications.common.utils.http import success_api, fail_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import Power
 from applications.schemas import PowerOutSchema2
@@ -52,14 +52,14 @@ def select_parent():
@authorize("admin:power:add", log=True)
 def save():
    req = request.json
-    icon = xss_escape(req.get("icon"))
-    openType = xss_escape(req.get("openType"))
-    parentId = xss_escape(req.get("parentId"))
-    powerCode = xss_escape(req.get("powerCode"))
-    powerName = xss_escape(req.get("powerName"))
-    powerType = xss_escape(req.get("powerType"))
-    powerUrl = xss_escape(req.get("powerUrl"))
-    sort = xss_escape(req.get("sort"))
+    icon = str_escape(req.get("icon"))
+    openType = str_escape(req.get("openType"))
+    parentId = str_escape(req.get("parentId"))
+    powerCode = str_escape(req.get("powerCode"))
+    powerName = str_escape(req.get("powerName"))
+    powerType = str_escape(req.get("powerType"))
+    powerUrl = str_escape(req.get("powerUrl"))
+    sort = str_escape(req.get("sort"))
    power = Power(
        icon=icon,
        open_type=openType,
@@ -96,14 +96,14 @@ def update():
    req_json = request.json
    id = request.json.get("powerId")
    data = {
-        "icon": xss_escape(req_json.get("icon")),
-        "open_type": xss_escape(req_json.get("openType")),
-        "parent_id": xss_escape(req_json.get("parentId")),
-        "code": xss_escape(req_json.get("powerCode")),
-        "name": xss_escape(req_json.get("powerName")),
-        "type": xss_escape(req_json.get("powerType")),
-        "url": xss_escape(req_json.get("powerUrl")),
-        "sort": xss_escape(req_json.get("sort"))
+        "icon": str_escape(req_json.get("icon")),
+        "open_type": str_escape(req_json.get("openType")),
+        "parent_id": str_escape(req_json.get("parentId")),
+        "code": str_escape(req_json.get("powerCode")),
+        "name": str_escape(req_json.get("powerName")),
+        "type": str_escape(req_json.get("powerType")),
+        "url": str_escape(req_json.get("powerUrl")),
+        "sort": str_escape(req_json.get("sort"))
    }
    res = Power.query.filter_by(id=id).update(data)
    db.session.commit()
@@ -4,7 +4,7 @@ from applications.common.curd import model_to_dicts, enable_status, disable_stat
 from applications.common.helper import ModelFilter
 from applications.common.utils.http import table_api, success_api, fail_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import Role, Power, User
 from applications.schemas import RoleOutSchema, PowerOutSchema2
@@ -23,21 +23,15 @@ def main():
@admin_role.get('/data')
@authorize("admin:role:main", log=True)
 def table():
-    # 获取请求参数
-    role_name = xss_escape(request.args.get('roleName', type=str))
-    role_code = xss_escape(request.args.get('roleCode', type=str))
-    # 查询参数构造
-    mf = ModelFilter()
+    role_name = str_escape(request.args.get('roleName', type=str))
+    role_code = str_escape(request.args.get('roleCode', type=str))
+    filters = []
    if role_name:
-        mf.vague(field_name="name", value=role_name)
+        filters.append(Role.name.contains(role_name))
    if role_code:
-        mf.vague(field_name="code", value=role_code)
-    # orm查询
-    # 使用分页获取data需要.items
-    role = Role.query.filter(mf.get_filter(Role)).layui_paginate()
-    count = role.total
-    # 返回api
-    return table_api(data=model_to_dicts(schema=RoleOutSchema, data=role.items), count=count)
+        filters.append(Role.code.contains(role_code))
+    roles = Role.query.filter(*filters).layui_paginate()
+    return table_api(data=model_to_dicts(schema=RoleOutSchema, data=roles.items), count=roles.total)


 # 角色增加
@@ -52,11 +46,11 @@ def add():
@authorize("admin:role:add", log=True)
 def save():
    req = request.json
-    details = xss_escape(req.get("details"))
-    enable = xss_escape(req.get("enable"))
-    roleCode = xss_escape(req.get("roleCode"))
-    roleName = xss_escape(req.get("roleName"))
-    sort = xss_escape(req.get("sort"))
+    details = str_escape(req.get("details"))
+    enable = str_escape(req.get("enable"))
+    roleCode = str_escape(req.get("roleCode"))
+    roleName = str_escape(req.get("roleName"))
+    sort = str_escape(req.get("sort"))
    role = Role(
        details=details,
        enable=enable,
@@ -132,11 +126,11 @@ def update():
    req_json = request.json
    id = req_json.get("roleId")
    data = {
-        "code": xss_escape(req_json.get("roleCode")),
-        "name": xss_escape(req_json.get("roleName")),
-        "sort": xss_escape(req_json.get("sort")),
-        "enable": xss_escape(req_json.get("enable")),
-        "details": xss_escape(req_json.get("details"))
+        "code": str_escape(req_json.get("roleCode")),
+        "name": str_escape(req_json.get("roleName")),
+        "sort": str_escape(req_json.get("sort")),
+        "enable": str_escape(req_json.get("enable")),
+        "details": str_escape(req_json.get("details"))
    }
    role = Role.query.filter_by(id=id).update(data)
    db.session.commit()
@@ -4,10 +4,9 @@ from sqlalchemy import desc

 from applications.common import curd
 from applications.common.curd import enable_status, disable_status
-from applications.common.helper import ModelFilter
 from applications.common.utils.http import table_api, fail_api, success_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import Role, Dept
 from applications.models import User, AdminLog
@@ -27,17 +26,20 @@ def main():
@authorize("admin:user:main", log=True)
 def data():
    # 获取请求参数
-    real_name = xss_escape(request.args.get('realName', type=str))
-    username = xss_escape(request.args.get('username', type=str))
+    real_name = str_escape(request.args.get('realName', type=str))
+
+    username = str_escape(request.args.get('username', type=str))
    dept_id = request.args.get('deptId', type=int)
-    # 查询参数构造
-    mf = ModelFilter()
+
+    filters = []
    if real_name:
-        mf.contains(field_name="realname", value=real_name)
+        filters.append(User.realname.contains(real_name))
    if username:
-        mf.contains(field_name="username", value=username)
+        filters.append(User.realname.contains(username))
    if dept_id:
-        mf.exact(field_name="dept_id", value=dept_id)
+        filters.append(User.realname == dept_id)
+
+    # print(*filters)
    data, count = db.session.query(
        User.id,
        User.username,
@@ -46,7 +48,7 @@ def data():
        User.create_at,
        User.update_at,
        Dept.dept_name
-    ).filter(mf.get_filter(model=User)).filter(User.dept_id==Dept.id).layui_paginate_db_json()
+    ).filter(*filters).filter(User.dept_id == Dept.id).layui_paginate_db_json()
    return table_api(data=data, count=count)


@@ -63,9 +65,9 @@ def add():
 def save():
    req_json = request.json
    a = req_json.get("roleIds")
-    username = xss_escape(req_json.get('username'))
-    real_name = xss_escape(req_json.get('realName'))
-    password = xss_escape(req_json.get('password'))
+    username = str_escape(req_json.get('username'))
+    real_name = str_escape(req_json.get('realName'))
+    password = str_escape(req_json.get('password'))
    role_ids = a.split(',')

    if not username or not real_name or not password:
@@ -114,11 +116,11 @@ def edit(id):
@authorize("admin:user:edit", log=True)
 def update():
    req_json = request.json
-    a = xss_escape(req_json.get("roleIds"))
-    id = xss_escape(req_json.get("userId"))
-    username = xss_escape(req_json.get('username'))
-    real_name = xss_escape(req_json.get('realName'))
-    dept_id = xss_escape(req_json.get('deptId'))
+    a = str_escape(req_json.get("roleIds"))
+    id = str_escape(req_json.get("userId"))
+    username = str_escape(req_json.get('username'))
+    real_name = str_escape(req_json.get('realName'))
+    dept_id = str_escape(req_json.get('deptId'))
    role_ids = a.split(',')
    User.query.filter_by(id=id).update({'username': username, 'realname': real_name, 'dept_id': dept_id})
    u = User.query.filter_by(id=id).first()
@@ -4,7 +4,7 @@ from applications.common import curd
 from applications.common.utils import validate
 from applications.common.utils.http import success_api, fail_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import Dept, User
 from applications.schemas import DeptOutSchema
@@ -58,13 +58,13 @@ def save():
    req_json = request.json
    dept = Dept(
        parent_id=req_json.get('parentId'),
-        dept_name=xss_escape(req_json.get('deptName')),
-        sort=xss_escape(req_json.get('sort')),
-        leader=xss_escape(req_json.get('leader')),
-        phone=xss_escape(req_json.get('phone')),
-        email=xss_escape(req_json.get('email')),
-        status=xss_escape(req_json.get('status')),
-        address=xss_escape(req_json.get('address'))
+        dept_name=str_escape(req_json.get('deptName')),
+        sort=str_escape(req_json.get('sort')),
+        leader=str_escape(req_json.get('leader')),
+        phone=str_escape(req_json.get('phone')),
+        email=str_escape(req_json.get('email')),
+        status=str_escape(req_json.get('status')),
+        address=str_escape(req_json.get('address'))
    )
    r = db.session.add(dept)
    db.session.commit()
@@ -115,13 +115,13 @@ def update():
    json = request.json
    id = json.get("deptId"),
    data = {
-        "dept_name": validate.xss_escape(json.get("deptName")),
-        "sort": validate.xss_escape(json.get("sort")),
-        "leader": validate.xss_escape(json.get("leader")),
-        "phone": validate.xss_escape(json.get("phone")),
-        "email": validate.xss_escape(json.get("email")),
-        "status": validate.xss_escape(json.get("status")),
-        "address": validate.xss_escape(json.get("address"))
+        "dept_name": validate.str_escape(json.get("deptName")),
+        "sort": validate.str_escape(json.get("sort")),
+        "leader": validate.str_escape(json.get("leader")),
+        "phone": validate.str_escape(json.get("phone")),
+        "email": validate.str_escape(json.get("email")),
+        "status": validate.str_escape(json.get("status")),
+        "address": validate.str_escape(json.get("address"))
    }
    d = Dept.query.filter_by(id=id).update(data)
    if not d: