使用ueditor-plus解决ueditor中JSP的SSRF漏洞的实现方案

一、背景项目中使用ueditor进行文章的富文本编辑，因ueditor使用过程中存在SSRF漏洞，考虑到开源项目ueditor-plus是在ueditor的基础上进行了二次开发，保留了ueditor的使用方式不变，同时ueditor-plus在不断更新维护，特选用ueditor-plus来平替ueditor，并解决ueditor中jsp的SSRF漏洞。二、项目使用ueditor的前后端结构2.1 前端：add.jsp!-- 配置文件 -- script type="text/javascript"/script !-- 编辑器源码文件 -- script type="text/javascript"/script script type="text/javascript" var ue = UE.getEditor('add-content'); function back(){ window.history.back(-1); } function preview(){ $('#preview-dialog').dialog({ closed: false, modal:true, title: "预览封面图片", buttons: [{ text: '关闭', iconCls: 'icon-cancel', handler: function () { $('#preview-dialog').dialog('close'); } }], onBeforeOpen:function(){ //$("#add-form input").val(''); } }); } //上传图片 function start(){ var value = $('#p').progressbar('getValue'); if (value 100){ value += Math.floor(Math.random() * 10); $('#p').progressbar('setValue', value); }else{ $('#p').progressbar('setValue',0) } }; function upload(){ if($("#photo-file").val() == '')return; var formData = new FormData(); formData.append('photo',document.getElementById('photo-file').files[0]); $("#process-dialog").dialog('open'); var interval = setInterval(start,200); $.ajax({ url:'admin/news/upload_photo', type:'post', data:formData, contentType:false, processData:false, success:function(data){ clearInterval(interval); $("#process-dialog").dialog('close'); if(data.type == 'success'){ $("#preview-photo").attr('src',data.filepath); $("#add-photo").val(data.filepath); }else{ $.messager.alert("消息提醒",data.msg,"warning"); } }, error:function(data){ clearInterval(interval); $("#process-dialog").dialog('close'); $.messager.alert("消息提醒","上传失败!","warning"); } }); } function uploadPhoto(){ $("#photo-file").click(); } function checkChange(){ if(document.getElementById("isLevel2").checked){ $("#newsLevel2").show(); }else{ $("#newsLevel2").hide(); } } function submitForm(){ var validate = $("#add-form").form("validate"); if(!validate){ $.messager.alert("消息提醒","请检查你输入的数据!","warning"); return; } var content = ue.getContent(); if(content == ''){ $.messager.alert("消息提醒","请输入新闻内容!","warning"); return; } var data = $("#add-form").serialize(); $.ajax({ url:'admin/news/add', type:'post', dataType:'json', data:data, success:function(rst){ if(rst.type == 'success'){ $.messager.alert("消息提醒","添加成功!","warning"); setTimeout(function(){ window.history.go(-1); },500); }else{ $.messager.alert("消息提醒",rst.msg,"warning"); } } }); } /script2.2 后端：NewsController.java@RequestMapping("/admin/news") @Controller public class NewsController { @Autowired private NewsCategoryService newsCategoryService; @Autowired private NewsService newsService; @Autowired private NewsLevel2Service newslevel2service; /** * 新闻列表页面 * @param model * @return */ @RequestMapping(value="/list",method=RequestMethod.GET) public ModelAndView list(ModelAndView model){ model.addObject("newsCategoryList", newsCategoryService.findAll()); model.addObject("newsLevel2List",newslevel2service.findAll()); model.setViewName("news/list"); return model; } /** * 新闻添加页面 * @param model * @return */ @RequestMapping(value="/add",method=RequestMethod.GET) public ModelAndView add(ModelAndView model){ model.addObject("newsCategoryList", newsCategoryService.findAll()); model.addObject("newsLevel2List",newslevel2service.findAll()); model.setViewName("news/add"); return model; } /** * 新闻添加 * @param news * @return */ @RequestMapping(value="/add",method=RequestMethod.POST) @ResponseBody public MapString,String add(News news){ MapString,String ret = new HashMapString, String(); if(news == null){ ret.put("type", "error"); ret.put("msg", "请填写正确的信息！"); return ret; } if(StringUtils.isEmpty(news.getTitle())){ ret.put("type", "error"); ret.put("msg", "新闻标题不能为空！"); return ret; } if(news.getCategoryId() == null){ ret.put("type", "error"); ret.put("msg", "请选择新闻分类！"); return ret; } if(StringUtils.isEmpty(news.getAbstrs())){ ret.put("type", "error"); ret.put("msg", "新闻摘要不能为空！"); return ret; } if(StringUtils.isEmpty(news.getTags())){ ret.put("type", "error"); ret.put("msg", "新闻标签不能为空！"); return ret; } if(StringUtils.isEmpty(news.getPhoto())){ ret.put("type", "error"); ret.put("msg", "新闻封面图片必须上传！"); return ret; } if(StringUtils.isEmpty(news.getAuthor())){ ret.put("type", "error"); ret.put("msg", "新闻作者不能为空！"); return ret; } if(StringUtils.isEmpty(news.getContent())){ ret.put("type", "error"); ret.put("msg", "新闻内容不能为空！"); return ret; } if( news.getNewsLevel2Id()0 news.getIsLevel2()==0) { news.setNewsLevel2Id(0L); } news.setCreateTime(new Date()); if(newsService.add(news) = 0){ ret.put("type", "error"); ret.put("msg", "添加失败，请联系管理员！"); return ret; } ret.put("type", "success"); ret.put("msg", "添加成功！"); return ret; }2.3 ueditor组件资源：controller.jsp%@ page language="java" content