接到安全漏洞扫描的通知:Spring Boot 集成环境信息泄露漏洞【POC】
处置建议:Spring 官方已发布漏洞修复版本,请用户及时更新至最新版本。
https://github.com/spring-projects/spring-framework/tags
安全版本:
Spring Framework == 5.3.18
Spring Framework == 5.2.20
我检查了项目当前的框架版本:
1 <parent>
2 <groupId>org.springframework.boot</groupId>
3 <artifactId>spring-boot-starter-parent</artifactId>
4 <version>2.3.9.RELEASE</version>
5 </parent>
7 <properties>
8 <spring-framework.version>5.2.13.RELEASE</spring-framework.version>
9 ......
10 </properties>
妥妥地命中,必须要整改。
一、升级框架依赖
无论如何,安全是第一,所以先把框架升级再说。(具体是选择哪个版本升级,建议按照安全厂商的要求)
1 <parent>
2 <groupId>org.springframework.boot</groupId>
3 <artifactId>spring-boot-starter-parent</artifactId>
4 <version>2.6.5</version>
5 </parent>
8 <properties>
9 <spring-framework.version>5.3.18</spring-framework.version>
10 <spring-boot.version>2.6.5</spring-boot.version>
11 <spring-data.version>2.6.3</spring-data.version>
12 ......
13 </properties>
JDK使用corretto-1.8.0_322
框架依赖升级了之后,开始编译调试,也就是升级框架带来的兼容性问题,通常最令人抓狂的也就是这部分。
二、调试基础框的兼容性问题
不断地发现报错有各种问题,网上找类似的情况,再分析、筛选、尝试,将搜罗的解决方法记录下来。
1.RedisCacheWriter错误
先把升级后接口新加的3个方法添加上,后续有问题再调试。
1 @Override
2 public void clearStatistics(String name) {
3 statistics.reset(name) ;
6 @Override
7 public RedisCacheWriter withStatisticsCollector(CacheStatisticsCollector cacheStatisticsCollector){
8 return this;
11 @Override
12 public CacheStatistics getCacheStatistics(String cacheName) {
13 return statistics.getCacheStatistics(cacheName);
在该类头部,添加定义:
1 private final CacheStatisticsCollector statistics = CacheStatisticsCollector.create();
2.RedisUtil错误
(1)替换报错的方法
1 private Set<String> keys(String keyPrefix) {
2 String realKey = keyPrefix + "*";
4 try {
5 return redisTemplate.execute((RedisCallback<Set<String>>) connection -> {
6 Set<String> binaryKeys = new HashSet<>();
8 Cursor<byte[]> cursor = connection.scan(ScanOptions.scanOptions().match(realKey).count(Integer.MAX_VALUE).build());
9 while (cursor.hasNext()) {
10 binaryKeys.add(new String(cursor.next()));
11 }
13 return binaryKeys;
14 });
15 } catch (Throwable e) {
16 e.printStackTrace();
17 }
19 return null;
(2)报错语句加上类型转换
1 @SuppressWarnings("unchecked")
2 public void del(String... key) {
3 if (key != null && key.length > 0) {
4 if (key.length == 1) {
5 redisTemplate.delete(key[0]);
6 } else {
7 redisTemplate.delete((Collection<String>) CollectionUtils.arrayToList(key));
3.无法访问okhttp3.HttpUrl
1 private static MinioClient initMinio(String minioUrl, String minioName,String minioPass) {
2 if (minioClient == null) {
3 try {
4 minioClient = MinioClient.builder()
5 .endpoint(minioUrl)
6 .credentials(minioName, minioPass)
7 .build();
8 } catch (Exception e) {
9 e.printStackTrace();
10 }
11 }
12 return minioClient;
分析原因:项目里的依赖包版本冲突,修改pom.xml
1 <properties>
2 <minio.version>8.3.7</minio.version>
3 <okhttp.version>4.8.1</okhttp.version>
4 </properties>
7 <dependencies>
8 ......
9 <dependency>
10 <groupId>io.minio</groupId>
11 <artifactId>minio</artifactId>
12 <version>${minio.version}</version>
13 <scope>compile</scope>
14 </dependency>
16 <dependency>
17 <groupId>com.squareup.okhttp3</groupId>
18 <artifactId>okhttp</artifactId>
19 <version>${okhttp.version}</version>
20 <scope>compile</scope>
21 </dependency>
22 ......
23 </dependencies>
4.程序包feign.hystrix不存在
添加依赖引用:
1 <dependencies>
2 <!-- feign -->
3 <dependency>
4 <groupId>org.springframework.cloud</groupId>
5 <artifactId>spring-cloud-starter-openfeign</artifactId>
6 </dependency>
7 ......
8 <dependency>
9 <groupId>io.github.openfeign</groupId>
10 <artifactId>feign-hystrix</artifactId>
11 </dependency>
12 </dependencies>
5.程序包org.springframework.cloud.netflix.ribbon不存在
1 <dependency>
2 <groupId>org.springframework.cloud</groupId>
3 <artifactId>spring-cloud-openfeign-core</artifactId>
4 <version>3.1.1</version>
5 <scope>compile</scope>
6 </dependency>
检查项目里的依赖包版本冲突问题
6.程序包org.junit不存在
1 <dependency>
2 <groupId>junit</groupId>
3 <artifactId>junit</artifactId>
4 <version>4.13.2</version>
5 <scope>test</scope>
6 </dependency>
7.对RemoteApplicationEvent的引用不明确
1 public JeecgRemoteApplicationEvent(EventObj source, String originService) {
2 super(source, originService, (String) null);
3 this.eventObj = source;
8.dependencies.dependency.version
1 [INFO] Scanning for projects...
2 [ERROR] [ERROR] Some problems were encountered while processing the POMs:
3 [ERROR] 'dependencies.dependency.version' for org.springframework.cloud:spring-cloud-starter-netflix-hystrix:jar is missing. @ line 51, column 21
5 [ERROR] The build could not read 1 project -> [Help 1]
注明依赖包的版本号:
1 <dependency>
2 <groupId>org.springframework.cloud</groupId>
3 <artifactId>spring-cloud-starter-netflix-hystrix</artifactId>
4 <version>2.2.10.RELEASE</version>
5 <scope>compile</scope>
6 </dependency>
9.解决其他一些依赖包的引用与版本冲突问题,在此就不一一列举
Cannot resolve io.github.openfeign:feign-hystrix:11.8
Cannot resolve org.springframework.boot:spring-boot-configuration-processor:2.6.5
Cannot resolve org.springframework.cloud:spring-cloud-starter-openfeign:3.1.1
Cannot resolve io.netty:netty-all:4.1.75.Final
Cannot resolve org.codehaus.groovy:groovy:3.0.10
10.项目编译通过,检查框架是否升级成功,并且不存在其他版本冲突
(1)如图:Spring Framework == 5.3.18
(2)如图:Spring Boot== 2.6.5
注:看到以上2个图中的版本与预期一致,说明框架升级编译已没问题,后续再对业务代码进行调试、试运行。
项目框架升级:Spring Boot 升级到2.6.5, Spring Framework升级到5.3.18 【续】 - 圆觉悟禅道 - 博客园 (cnblogs.com)