mirror of
https://gitcode.com/ageerle/ruoyi-ai.git
synced 2026-09-15 17:35:00 +00:00
fix: 移除FastJson 1.2.83严重安全漏洞,替换为Jackson
- 移除FastJson 1.2.83依赖(存在严重RCE漏洞CVE-2022-25845等) - 替换为Spring Boot内置的Jackson 2.18.2 - 修改6个Java文件的JSON处理逻辑 - 所有模块编译验证通过 修改文件: 1. pom.xml - 移除fastjson依赖定义 2. ruoyi-common-chat/pom.xml - 替换为jackson-databind 3. QwenFileUploadUtils.java - 千问文件上传JSON解析 4. ChatRequest.java - 移除FastJson注解 5. MailSendNode.java - 邮件节点JSON处理 6. SwitcherNode.java - 条件分支JSON处理 7. AbstractAuthWeChatEnterpriseRequest.java - 企业微信登录 8. AuthDingTalkV2Request.java - 钉钉登录 安全提升:消除FastJson反序列化RCE漏洞攻击面 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
10
pom.xml
10
pom.xml
@@ -43,8 +43,7 @@
|
||||
<aws.sdk.version>2.28.22</aws.sdk.version>
|
||||
<!-- SMS 配置 -->
|
||||
<sms4j.version>3.3.5</sms4j.version>
|
||||
<!-- 限制框架中的fastjson版本 -->
|
||||
<fastjson.version>1.2.83</fastjson.version>
|
||||
<!-- FastJson已移除,使用Jackson替代 -->
|
||||
<!-- 面向运行时的D-ORM依赖 -->
|
||||
<anyline.version>8.7.2-20250603</anyline.version>
|
||||
<!-- 工作流配置 -->
|
||||
@@ -356,11 +355,8 @@
|
||||
<version>${ip2region.version}</version>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
<groupId>com.alibaba</groupId>
|
||||
<artifactId>fastjson</artifactId>
|
||||
<version>${fastjson.version}</version>
|
||||
</dependency>
|
||||
<!-- FastJson已完全移除,项目统一使用Jackson -->
|
||||
<!-- Jackson相关依赖已由Spring Boot统一管理 -->
|
||||
|
||||
<dependency>
|
||||
<groupId>org.ruoyi</groupId>
|
||||
|
||||
Reference in New Issue
Block a user