fix: protect addTask with trust filters

server/src/main/java/cn/keking/config/WebConfig.java

@@ -46,6 +46,7 @@ public class WebConfig implements WebMvcConfigurer {
         filterUri.add("/onlinePreview");
         filterUri.add("/picturesPreview");
         filterUri.add("/getCorsFile");
+        filterUri.add("/addTask");
         TrustHostFilter filter = new TrustHostFilter();
         FilterRegistrationBean<TrustHostFilter> registrationBean = new FilterRegistrationBean<>();
         registrationBean.setFilter(filter);
@@ -59,6 +60,7 @@ public class WebConfig implements WebMvcConfigurer {
         filterUri.add("/onlinePreview");
         filterUri.add("/picturesPreview");
         filterUri.add("/getCorsFile");
+        filterUri.add("/addTask");
         TrustDirFilter filter = new TrustDirFilter();
         FilterRegistrationBean<TrustDirFilter> registrationBean = new FilterRegistrationBean<>();
         registrationBean.setFilter(filter);

server/src/test/java/cn/keking/config/WebConfigTests.java

@@ -0,0 +1,27 @@
+package cn.keking.config;
+
+import cn.keking.web.filter.TrustDirFilter;
+import cn.keking.web.filter.TrustHostFilter;
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class WebConfigTests {
+
+    private final WebConfig webConfig = new WebConfig();
+
+    @Test
+    void shouldApplyTrustHostFilterToAddTaskEndpoint() {
+        FilterRegistrationBean<TrustHostFilter> registration = webConfig.getTrustHostFilter();
+
+        assertTrue(registration.getUrlPatterns().contains("/addTask"));
+    }
+
+    @Test
+    void shouldApplyTrustDirFilterToAddTaskEndpoint() {
+        FilterRegistrationBean<TrustDirFilter> registration = webConfig.getTrustDirFilter();
+
+        assertTrue(registration.getUrlPatterns().contains("/addTask"));
+    }
+}