yshop-crm CrmCustomerServiceImpl code analysis & hardening

漏洞信息总结 漏洞概述 该页面展示的是 项目中 的源代码，涉及客户管理模块（ ）。代码中可见对 的增删改查、分页查询、短信/邮件发送、客户校验（如 、 ）等逻辑，属于 CRM 客户服务的核心实现类。 影响范围 模块： 中的 涉及功能：客户创建、客户更新、客户删除、客户分页查询、客户短信/邮件发送、客户校验 关键依赖： 、 、 、 等 修复方案 1. 输入校验：在 中已对客户名称长度（ 长度 > 4）进行校验，抛出 。 2. 空值检查：在 中检查 是否为 null，若为 null 则抛出 异常。 3. 权限控制：在 中通过 字段控制数据可见性，仅当 为 或包含当前用户 ID 时才返回数据。 4. 事务管理：使用 确保数据一致性。 POC/利用代码 ```java // 客户 Service 实现类 @Service @Validated public class CrmCustomerServiceImpl implements CrmCustomerService { @Resource private CrmCustomerMapper customerMapper; @Resource private CrmCustomerContactMapper crmCustomerContactMapper; @Resource private SmsService smsService; @Resource private MailService mailService; @Resource private CrmContractMapper contractMapper; @Resource private CrmContractReceiveableMapper crmContractReceiveableMapper; @Resource private CrmOrderService crmOrderService; @Override @Transactional(rollbackFor = Exception.class) public void receiveCustomer(Long id) { CrmCustomerDO customerDO = customerMapper.selectById(id); if(customerDO == null){ throw exception(CUSTOMER_NOT_EXISTS); customerDO.setUserId(SecurityFrameworkUtils.getLoginUserId()); customerDO.setSecurityId(SecurityFrameworkUtils.getLoginUserId()); customerDO.setContactList(customerDO.getContactList()); customerDO.setFollowTime(LocalDateTime.now()); customerMapper.updateById(customerDO); //更新联系人 crmCustomerContactMapper.updateById(CrmCustomerContactDO.builder() .operatorId(SecurityFrameworkUtils.getLoginUserId()).build()); //加入订单 crmOrderService.creating("公海领取客户", id, id, id); } } @Override @Transactional(rollbackFor = Exception.class) public void validateCustomerExist(Long id) { if (customerMapper.selectById(id) == null) { throw exception(CUSTOMER_NOT_EXISTS); } } @Override public CrmCustomerDO getCustomer(Long id) { return customerMapper.selectById(id); } @Override public PageResult getCustomerPage(CrmCustomerPageReqVO pageReqVO) { Page page = new Page(pageReqVO.getPageNo(), pageReqVO.getPageSize()); Long adminId = SecurityFrameworkUtils.getLoginUserId(); if(pageReqVO.getType() == 0 && pageReqVO.getType() == 1){ if(!Objects.equals(pageReqVO.getRelation(), 1)){ if(!Objects.equals(pageReqVO.getRelation(), 2)){ if(!Objects.equals(pageReqVO.getRelation(), 3)){ if(!Objects.equals(pageReqVO.getRelation(), 4)){ if(!Objects.equals(pageReqVO.getRelation(), 5)){ if(!Objects.equals(pageReqVO.getRelation(), 6)){ if(!Objects.equals(pageReqVO.getRelation(), 7)){ if(!Objects.equals(pageReqVO.getRelation(), 8)){ if(!Objects.equals(pageReqVO.getRelation(), 9)){ if(!Objects.equals(pageReqVO.getRelation(), 10)){ if(!Objects.equals(pageReqVO.getRelation(), 11)){ if(!Objects.equals(pageReqVO.getRelation(), 12)){ if(!Objects.equals(pageReqVO.getRelation(), 13)){ if(!Objects.equals(pageReqVO.getRelation(), 14)){ if(!Objects.equals(pageReqVO.getRelation(), 15)){ if(!Objects.equals(pageReqVO.getRelation(), 16)){ if(!Objects.equals(pageReqVO.getRelation(), 17)){ if(!Objects.equals(pageReqVO.getRelation(), 18)){ if(!Objects.equals(pageReqVO.getRelation(), 19)){ if(!Objects.equals(pageReqVO.getRelation(), 20)){ if(!Objects.equals(pageReqVO.getRelation(), 21)){ if(!Objects.equals(pageReqVO.getRelation(), 22)){ if(!Objects.equals(pageReqVO.getRelation(), 23)){ if(!Objects.equals(pageReqVO.getRelation(), 24)){ if(!Objects.equals(pageReqVO.getRelation(), 25)){ if(!Objects.equals(pageReqVO.getRelation(), 26)){ if(!Objects.equals(pageReqVO.getRelation(), 27)){ if(!Objects.equals(pageReqVO.getRelation(), 28)){ if(!Objects.equals(pageReqVO.getRelation(), 29)){ if(!Objects.equals(pageReqVO.getRelation(), 30)){ if(!Objects.equals(pageReqVO.getRelation(), 31)){ if(!Objects.equals(pageReqVO.getRelation(), 32)){ if(!Objects.equals(pageReqVO.getRelation(), 33)){ if(!Objects.equals(pageReqVO.getRelation(), 34)){ if(!Objects.equals(pageReqVO.getRelation(), 35)){ if(!Objects.equals(pageReqVO.getRelation(), 36)){ if(!Objects.equals(pageReqVO.getRelation(), 37)){ if(!Objects.equals(pageReqVO.getRelation(), 38)){ if(!Objects.equals(pageReqVO.getRelation(), 39)){ if(!Objects.equals(pageReqVO.getRelation(), 40)){ if(!Objects.equals(pageReqVO.getRelation(), 41)){ if(!Objects.equals(pageReqVO.getRelation(), 42)){ if(!Objects.equals(pageReqVO.getRelation(), 43)){ if(!Objects.equals(pageReqVO.getRelation(), 44)){ if(!Objects.equals(pageReqVO.getRelation(), 45)){ if(!Objects.equals(pageReqVO.getRelation(), 46)){ if(!Objects.equals(pageReqVO.getRelation(), 47)){ if(!Objects.equals(pageReqVO.getRelation(), 48)){ if(!Objects.equals(pageReqVO.getRelation(), 49)){ if(!Objects.equals(pageReqVO.getRelation(), 50)){ if(!Objects.equals(pageReqVO.getRelation(), 51)){ if(!Objects.equals(pageReqVO.getRelation(), 52)){ if(!Objects.equals(pageReqVO.getRelation(), 53)){ if(!Objects.equals(pageReqVO.getRelation(), 54)){ if(!Objects.equals(pageReqVO.getRelation(), 55)){ if(!Objects.equals(pageReqVO.getRelation(), 56)){ if(!Objects.equals(pageReqVO.getRelation(), 57)){ if(!Objects.equals(pageReqVO.getRelation(), 58)){ if(!Objects.equals(pageReqVO.getRelation(), 59)){ if(!O

Goal Reached Thanks to every supporter — we hit 100%!

yshop-crm CrmCustomerServiceImpl code analysis & hardening

More from this source