fix: 修复钱包充值退款权限与 IoT 固件上传校验

- 钱包充值退款复用用户余额修改权限，阻止无权限用户发起退款（#1328） - 允许 .bin 固件上传、预签名及直传登记，保留未知后缀和内容类型校验 - 补充方法权限拦截与固件上传回归用例星球反馈：https://t.zsxq.com/bAppp

fix: 修复钱包充值退款权限与 IoT 固件上传校验
- 钱包充值退款复用用户余额修改权限，阻止无权限用户发起退款（#1328） - 允许 .bin 固件上传、预签名及直传登记，保留未知后缀和内容类型校验 - 补充方法权限拦截与固件上传回归用例星球反馈：https://t.zsxq.com/bAppp
YunaiV
1 parent 19829c6c
Showing 4 changed files with 309 additions and 5 deletions
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImpl.java
yudao-module-infra/src/test/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImplTest.java
yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/wallet/PayWalletRechargeController.java
yudao-module-pay/src/test/java/cn/iocoder/yudao/module/pay/controller/admin/wallet/PayWalletRechargeControllerSecurityTest.java
@@ -22,9 +22,11 @@ import cn.iocoder.yudao.module.infra.framework.file.core.utils.FileTypeUtils;
 import com.google.common.annotations.VisibleForTesting;
 import jakarta.annotation.Resource;
 import lombok.SneakyThrows;
+import org.apache.tika.mime.MimeTypes;
 import org.springframework.stereotype.Service;
  
 import java.util.List;
+import java.util.Locale;
 import java.util.Set;
  
 import static cn.hutool.core.date.DatePattern.PURE_DATE_PATTERN;
@@ -63,6 +65,14 @@ public class FileServiceImpl implements FileService {
     );
  
     /**
+     * 允许上传的二进制文件后缀，例如说 IoT OTA 固件的 .bin
+     *
+     * 为什么不直接放行 application/octet-stream？它也是所有未知后缀、未知内容的识别结果，放行后等于不限制类型。
+     * 所以只放行这里的后缀，并且上传内容也必须识别为 application/octet-stream（不能是可执行文件、脚本、HTML 等）
+     */
+    private static final Set<String> ALLOWED_BINARY_EXTENSIONS = Set.of("bin");
+
+    /**
      * 上传文件的前缀，是否包含日期（yyyyMMdd）
      *
      * 目的：按照日期，进行分目录
@@ -106,8 +116,10 @@ public class FileServiceImpl implements FileService {
         }
         type = FileTypeUtils.getMineType(content, name);
         String nameType = StrUtil.isNotEmpty(FileUtil.extName(name)) ? validateFileType(name) : null;
-        if (!ALLOWED_FILE_TYPES.contains(type)
-                || (FileTypeUtils.isImage(nameType) && ObjectUtil.notEqual(type, nameType))) {
+        if (!isAllowedFileType(type, name)
+                // 图片、二进制文件（例如说 .bin 固件）：内容识别的类型，必须与后缀一致
+                || ((FileTypeUtils.isImage(nameType) || isAllowedBinaryFile(nameType, name))
+                    && ObjectUtil.notEqual(type, nameType))) {
             throw exception(FILE_TYPE_NOT_ALLOWED);
         }
         // 1.2.2 处理 name 为空的情况
@@ -221,12 +233,24 @@ public class FileServiceImpl implements FileService {
  
     private String validateFileType(String name) {
         String type = FileTypeUtils.getMineType(name);
-        if (!ALLOWED_FILE_TYPES.contains(type)) {
+        if (!isAllowedFileType(type, name)) {
             throw exception(FILE_TYPE_NOT_ALLOWED);
         }
         return type;
     }
  
+    private static boolean isAllowedFileType(String type, String name) {
+        return ALLOWED_FILE_TYPES.contains(type) || isAllowedBinaryFile(type, name);
+    }
+
+    private static boolean isAllowedBinaryFile(String type, String name) {
+        if (ObjectUtil.notEqual(type, MimeTypes.OCTET_STREAM)) {
+            return false;
+        }
+        String extension = FileUtil.extName(name);
+        return StrUtil.isNotEmpty(extension) && ALLOWED_BINARY_EXTENSIONS.contains(extension.toLowerCase(Locale.ROOT));
+    }
+
     @Override
     public FileDO getFile(Long id) {
         return validateFileExists(id);
@@ -322,6 +322,79 @@ public class FileServiceImplTest extends BaseDbUnitTest {
     }
  
     @Test
+    public void testCreateFile_success_bin() throws Exception {
+        for (String name : new String[]{"固件.bin", "FIRMWARE.BIN", "firmware.Bin"}) {
+            // 准备参数：IoT OTA 固件，Tika 无法识别的二进制内容
+            byte[] content = buildFirmwareContent();
+            // mock 方法
+            FileClient client = mock(FileClient.class);
+            when(fileConfigService.getMasterFileClient()).thenReturn(client);
+            String url = randomString();
+            when(client.upload(same(content), anyString(), eq("application/octet-stream"))).thenReturn(url);
+
+            // 调用：不信任客户端传入的 type
+            String result = fileService.createFile(content, name, "iot/ota", "image/png");
+            // 断言
+            assertEquals(url, result);
+            FileDO file = fileMapper.selectOne(FileDO::getUrl, url);
+            assertEquals(name, file.getName());
+            assertEquals("application/octet-stream", file.getType());
+            assertEquals((long) content.length, file.getSize());
+        }
+    }
+
+    @Test
+    public void testCreateFile_typeNotAllowed_binContent() {
+        byte[] elf = buildFirmwareContent();
+        System.arraycopy(new byte[]{0x7F, 'E', 'L', 'F', 2, 1, 1}, 0, elf, 0, 7);
+        elf[16] = 2; // e_type = ET_EXEC
+        byte[] exe = buildFirmwareContent();
+        exe[0] = 'M';
+        exe[1] = 'Z';
+        for (byte[] content : new byte[][]{elf, exe,
+                "#!/bin/sh\nrm -rf /tmp/test\n".getBytes(StandardCharsets.UTF_8),
+                "<html><script>alert(1)</script></html>".getBytes(StandardCharsets.UTF_8),
+                "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>".getBytes(StandardCharsets.UTF_8),
+                ResourceUtil.readBytes("file/erweima.jpg")}) {
+            // 调用，并断言异常：.bin 的内容，必须是无法识别为其他类型的二进制
+            assertServiceException(() -> fileService.createFile(content, "固件.bin", null, "application/octet-stream"),
+                    FILE_TYPE_NOT_ALLOWED);
+            // 断言未上传文件、未保存记录
+            verifyNoInteractions(fileConfigService);
+            assertEquals(0L, fileMapper.selectCount());
+        }
+    }
+
+    @Test
+    public void testCreateFile_typeNotAllowed_binaryOtherExtension() {
+        for (String name : new String[]{"固件.so", "固件.dump", "固件.unknown", "固件"}) {
+            // 准备参数：同样识别为 application/octet-stream 的其它后缀，不放行
+            byte[] content = buildFirmwareContent();
+
+            // 调用，并断言异常
+            assertServiceException(() -> fileService.createFile(content, name, null, "application/octet-stream"),
+                    FILE_TYPE_NOT_ALLOWED);
+            // 断言未上传文件、未保存记录
+            verifyNoInteractions(fileConfigService);
+            assertEquals(0L, fileMapper.selectCount());
+        }
+    }
+
+    /**
+     * 构造固件内容：类似 ARM Cortex-M 的向量表开头，包含 0x00 等不可打印字节，Tika 无法识别
+     */
+    private static byte[] buildFirmwareContent() {
+        byte[] content = new byte[256];
+        byte[] header = new byte[]{0x00, 0x50, 0x00, 0x20, (byte) 0xC1, 0x01, 0x00, 0x08,
+                (byte) 0xC9, 0x01, 0x00, 0x08, (byte) 0xCB, 0x01, 0x00, 0x08};
+        System.arraycopy(header, 0, content, 0, header.length);
+        for (int i = header.length; i < content.length; i++) {
+            content[i] = (byte) (i * 7);
+        }
+        return content;
+    }
+
+    @Test
     public void testCreateFile_fileIsEmpty() {
         // 准备参数
         byte[] content = new byte[0];
@@ -337,7 +410,7 @@ public class FileServiceImplTest extends BaseDbUnitTest {
         for (String extension : new String[]{"jpg", "JPEG", "jfif", "png", "gif", "webp", "bmp", "ico", "tiff",
                 "avif", "heic", "heif", "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "txt", "csv", "md",
                 "zip", "rar", "mp3", "mp4", "svg", "html", "htm", "xml", "markdown", "eml", "msg", "epub",
-                "json", "opus", "ogg", "m4a", "webm", "amr", "wma", "wmv", "flv", "mkv"}) {
+                "json", "opus", "ogg", "m4a", "webm", "amr", "wma", "wmv", "flv", "mkv", "bin", "BIN"}) {
             // 准备参数
             String name = "测试文件." + extension;
             // mock 方法
@@ -360,7 +433,8 @@ public class FileServiceImplTest extends BaseDbUnitTest {
     @Test
     public void testPresignPutUrl_typeNotAllowed() {
         // 准备参数
-        for (String name : new String[]{"test.php", "test.jsp", "test.js", "test.exe", "test.unknown", "test"}) {
+        for (String name : new String[]{"test.php", "test.jsp", "test.js", "test.exe", "test.unknown", "test",
+                "test.so", "test.dump", "test.sh", "test.bin.exe"}) {
             // 调用，并断言异常
             assertServiceException(() -> fileService.presignPutUrl(name, null), FILE_TYPE_NOT_ALLOWED);
             // 校验调用
@@ -491,6 +565,47 @@ public class FileServiceImplTest extends BaseDbUnitTest {
     }
  
     @Test
+    public void testCreateFileByPresignedPath_success_bin() {
+        // 准备参数：IoT OTA 固件，后缀大小写不敏感
+        FileCreateReqVO reqVO = randomPojo(FileCreateReqVO.class, o -> {
+            o.setPath("iot/ota/firmware.bin");
+            o.setName("FIRMWARE.BIN");
+            o.setUrl("https://www.iocoder.cn/iot/ota/firmware.bin");
+            o.setType("text/html"); // 不信任客户端传入的 type
+        });
+
+        // 调用
+        Long fileId = fileService.createFile(reqVO);
+
+        // 断言
+        FileDO file = fileMapper.selectById(fileId);
+        assertEquals("iot/ota/firmware.bin", file.getPath());
+        assertEquals("FIRMWARE.BIN", file.getName());
+        assertEquals("application/octet-stream", file.getType());
+    }
+
+    @Test
+    public void testCreateFileByPresignedPath_typeNotAllowed_bin() {
+        for (String[] file : new String[][]{{"firmware.bin", "iot/firmware.exe"}, {"firmware.bin", "iot/firmware.so"},
+                {"firmware.so", "iot/firmware.so"}, {"firmware.exe", "iot/firmware.bin"},
+                {"firmware.bin", "iot/firmware.html"}, {"firmware", "iot/firmware.bin"}}) {
+            // 准备参数
+            String name = file[0];
+            String path = file[1];
+            FileCreateReqVO reqVO = randomPojo(FileCreateReqVO.class, o -> {
+                o.setName(name);
+                o.setPath(path);
+                o.setType("application/octet-stream");
+            });
+
+            // 调用，并断言异常
+            assertServiceException(() -> fileService.createFile(reqVO), FILE_TYPE_NOT_ALLOWED);
+            // 断言未保存记录
+            assertEquals(0L, fileMapper.selectCount());
+        }
+    }
+
+    @Test
     public void testCreateFileByPresignedPath_nameInvalid() {
         // 准备参数
         FileCreateReqVO reqVO = randomPojo(FileCreateReqVO.class, o -> {
@@ -8,6 +8,7 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
  
@@ -40,6 +41,7 @@ public class PayWalletRechargeController {
     @PostMapping("/refund")
     @Operation(summary = "发起钱包充值退款")
     @Parameter(name = "id", description = "编号", required = true, example = "1024")
+    @PreAuthorize("@ss.hasPermission('pay:wallet:update-balance')") // 退款会扣减用户钱包余额，复用「用户余额修改」权限
     public CommonResult<Boolean> refundWalletRecharge(@RequestParam("id") Long id) {
         walletRechargeService.refundWalletRecharge(id, getClientIP());
         return success(true);
+package cn.iocoder.yudao.module.pay.controller.admin.wallet;
+
+import cn.iocoder.yudao.framework.common.biz.system.permission.PermissionCommonApi;
+import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
+import cn.iocoder.yudao.framework.security.core.LoginUser;
+import cn.iocoder.yudao.framework.security.core.service.SecurityFrameworkService;
+import cn.iocoder.yudao.framework.security.core.service.SecurityFrameworkServiceImpl;
+import cn.iocoder.yudao.module.pay.api.notify.dto.PayOrderNotifyReqDTO;
+import cn.iocoder.yudao.module.pay.service.wallet.PayWalletRechargeService;
+import jakarta.annotation.Resource;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.aop.support.AopUtils;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.authentication.AnonymousAuthenticationToken;
+import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
+
+import java.util.Collections;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+/**
+ * {@link PayWalletRechargeController} 的方法级权限测试
+ *
+ * 通过真实的 Spring Security 方法拦截（{@link EnableMethodSecurity}）+ 真实的 {@code @ss} 权限判断，
+ * 校验发起钱包充值退款需要 pay:wallet:update-balance 权限，拒绝时不会调用 Service
+ *
+ * @author 芋道源码
+ */
+@SpringJUnitConfig(PayWalletRechargeControllerSecurityTest.Config.class)
+public class PayWalletRechargeControllerSecurityTest {
+
+    private static final String PERMISSION = "pay:wallet:update-balance";
+    private static final Long USER_ID = 1L;
+    private static final Long RECHARGE_ID = 1024L;
+
+    @Resource
+    private PayWalletRechargeController controller;
+    @Resource
+    private PayWalletRechargeService walletRechargeService;
+    @Resource
+    private PermissionCommonApi permissionApi;
+
+    @BeforeEach
+    public void setUp() {
+        reset(walletRechargeService, permissionApi);
+        SecurityContextHolder.clearContext();
+    }
+
+    @AfterEach
+    public void tearDown() {
+        SecurityContextHolder.clearContext();
+    }
+
+    @Test
+    public void testControllerIsProxied() {
+        // 确认测试走的是方法安全代理，而不是裸对象
+        assertTrue(AopUtils.isAopProxy(controller));
+    }
+
+    @Test
+    public void testRefundWalletRecharge_hasPermission() {
+        // mock 方法
+        loginAdmin();
+        when(permissionApi.hasAnyPermissions(eq(USER_ID), eq(PERMISSION))).thenReturn(true);
+
+        // 调用
+        assertTrue(controller.refundWalletRecharge(RECHARGE_ID).getData());
+        // 断言
+        verify(permissionApi).hasAnyPermissions(eq(USER_ID), eq(PERMISSION));
+        verify(walletRechargeService).refundWalletRecharge(eq(RECHARGE_ID), isNull());
+    }
+
+    @Test
+    public void testRefundWalletRecharge_noPermission() {
+        // mock 方法
+        loginAdmin();
+        when(permissionApi.hasAnyPermissions(anyLong(), any(String[].class))).thenReturn(false);
+
+        // 调用，并断言
+        assertThrows(AccessDeniedException.class, () -> controller.refundWalletRecharge(RECHARGE_ID));
+        verify(permissionApi).hasAnyPermissions(eq(USER_ID), eq(PERMISSION));
+        verifyNoInteractions(walletRechargeService);
+    }
+
+    @Test
+    public void testRefundWalletRecharge_anonymous() {
+        // 未登录：Web 过滤链会放入匿名用户
+        SecurityContextHolder.getContext().setAuthentication(new AnonymousAuthenticationToken("key", "anonymousUser",
+                AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")));
+
+        // 调用，并断言
+        assertThrows(AccessDeniedException.class, () -> controller.refundWalletRecharge(RECHARGE_ID));
+        verifyNoInteractions(permissionApi, walletRechargeService);
+    }
+
+    @Test
+    public void testRefundWalletRecharge_noAuthentication() {
+        // 没有任何认证信息，同样拒绝：取决于 Spring Security 是否读取认证信息，抛出拒绝访问或认证缺失
+        Exception ex = assertThrows(Exception.class, () -> controller.refundWalletRecharge(RECHARGE_ID));
+        assertTrue(ex instanceof AccessDeniedException || ex instanceof AuthenticationCredentialsNotFoundException,
+                "非预期的异常：" + ex);
+        verifyNoInteractions(permissionApi, walletRechargeService);
+    }
+
+    @Test
+    public void testUpdateWalletRechargerPaid_callbackNotRestricted() {
+        // 支付回调：仍由 @PermitAll + 内部校验，不受后台权限约束
+        PayOrderNotifyReqDTO reqDTO = PayOrderNotifyReqDTO.builder().merchantOrderId("1").payOrderId(2L).build();
+
+        // 调用
+        assertTrue(controller.updateWalletRechargerPaid(reqDTO).getData());
+        // 断言
+        verify(walletRechargeService).updateWalletRechargerPaid(eq(1L), eq(2L));
+        verifyNoInteractions(permissionApi);
+    }
+
+    private static void loginAdmin() {
+        LoginUser loginUser = new LoginUser();
+        loginUser.setId(USER_ID);
+        loginUser.setUserType(UserTypeEnum.ADMIN.getValue());
+        loginUser.setTenantId(1L);
+        SecurityContextHolder.getContext().setAuthentication(
+                new UsernamePasswordAuthenticationToken(loginUser, null, Collections.emptyList()));
+    }
+
+    @Configuration
+    @EnableMethodSecurity(securedEnabled = true)
+    public static class Config {
+
+        @Bean
+        public PayWalletRechargeController payWalletRechargeController() {
+            return new PayWalletRechargeController();
+        }
+
+        @Bean
+        public PayWalletRechargeService payWalletRechargeService() {
+            return mock(PayWalletRechargeService.class);
+        }
+
+        @Bean
+        public PermissionCommonApi permissionCommonApi() {
+            return mock(PermissionCommonApi.class);
+        }
+
+        @Bean("ss")
+        public SecurityFrameworkService securityFrameworkService(PermissionCommonApi permissionApi) {
+            return new SecurityFrameworkServiceImpl(permissionApi);
+        }
+
+    }
+
+}