From eb271379fe22d8ff39c237d4480db0f66b9e94e4 Mon Sep 17 00:00:00 2001
From: kl <chenkailing@xd.com>
Date: Wed, 24 Jun 2026 11:38:40 +0800
Subject: [PATCH] fix: protect addTask with trust filters

---
 .../main/java/cn/keking/config/WebConfig.java |  2 ++
 .../java/cn/keking/config/WebConfigTests.java | 27 +++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 server/src/test/java/cn/keking/config/WebConfigTests.java

diff --git a/server/src/main/java/cn/keking/config/WebConfig.java b/server/src/main/java/cn/keking/config/WebConfig.java
index eb85367d..404e688e 100644
--- a/server/src/main/java/cn/keking/config/WebConfig.java
+++ b/server/src/main/java/cn/keking/config/WebConfig.java
@@ -46,6 +46,7 @@ public class WebConfig implements WebMvcConfigurer {
         filterUri.add("/onlinePreview");
         filterUri.add("/picturesPreview");
         filterUri.add("/getCorsFile");
+        filterUri.add("/addTask");
         TrustHostFilter filter = new TrustHostFilter();
         FilterRegistrationBean<TrustHostFilter> registrationBean = new FilterRegistrationBean<>();
         registrationBean.setFilter(filter);
@@ -59,6 +60,7 @@ public class WebConfig implements WebMvcConfigurer {
         filterUri.add("/onlinePreview");
         filterUri.add("/picturesPreview");
         filterUri.add("/getCorsFile");
+        filterUri.add("/addTask");
         TrustDirFilter filter = new TrustDirFilter();
         FilterRegistrationBean<TrustDirFilter> registrationBean = new FilterRegistrationBean<>();
         registrationBean.setFilter(filter);
diff --git a/server/src/test/java/cn/keking/config/WebConfigTests.java b/server/src/test/java/cn/keking/config/WebConfigTests.java
new file mode 100644
index 00000000..9675c927
--- /dev/null
+++ b/server/src/test/java/cn/keking/config/WebConfigTests.java
@@ -0,0 +1,27 @@
+package cn.keking.config;
+
+import cn.keking.web.filter.TrustDirFilter;
+import cn.keking.web.filter.TrustHostFilter;
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class WebConfigTests {
+
+    private final WebConfig webConfig = new WebConfig();
+
+    @Test
+    void shouldApplyTrustHostFilterToAddTaskEndpoint() {
+        FilterRegistrationBean<TrustHostFilter> registration = webConfig.getTrustHostFilter();
+
+        assertTrue(registration.getUrlPatterns().contains("/addTask"));
+    }
+
+    @Test
+    void shouldApplyTrustDirFilterToAddTaskEndpoint() {
+        FilterRegistrationBean<TrustDirFilter> registration = webConfig.getTrustDirFilter();
+
+        assertTrue(registration.getUrlPatterns().contains("/addTask"));
+    }
+}