mirror of
https://gitcode.com/ageerle/ruoyi-ai.git
synced 2026-09-16 01:44:57 +00:00
fix: 移除FastJson 1.2.83严重安全漏洞,替换为Jackson
- 移除FastJson 1.2.83依赖(存在严重RCE漏洞CVE-2022-25845等) - 替换为Spring Boot内置的Jackson 2.18.2 - 修改6个Java文件的JSON处理逻辑 - 所有模块编译验证通过 修改文件: 1. pom.xml - 移除fastjson依赖定义 2. ruoyi-common-chat/pom.xml - 替换为jackson-databind 3. QwenFileUploadUtils.java - 千问文件上传JSON解析 4. ChatRequest.java - 移除FastJson注解 5. MailSendNode.java - 邮件节点JSON处理 6. SwitcherNode.java - 条件分支JSON处理 7. AbstractAuthWeChatEnterpriseRequest.java - 企业微信登录 8. AuthDingTalkV2Request.java - 钉钉登录 安全提升:消除FastJson反序列化RCE漏洞攻击面 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
@@ -37,9 +37,10 @@
|
||||
<artifactId>ruoyi-common-sse</artifactId>
|
||||
</dependency>
|
||||
|
||||
<!-- FastJson已移除,使用Spring Boot自带的Jackson -->
|
||||
<dependency>
|
||||
<groupId>com.alibaba</groupId>
|
||||
<artifactId>fastjson</artifactId>
|
||||
<groupId>com.fasterxml.jackson.core</groupId>
|
||||
<artifactId>jackson-databind</artifactId>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
package org.ruoyi.common.chat.domain.dto.request;
|
||||
|
||||
import com.alibaba.fastjson.annotation.JSONField;
|
||||
import com.fasterxml.jackson.databind.annotation.JsonSerialize;
|
||||
import com.fasterxml.jackson.databind.ser.std.ToStringSerializer;
|
||||
import dev.langchain4j.data.message.ChatMessage;
|
||||
@@ -31,7 +30,6 @@ public class ChatRequest {
|
||||
* 智能体ID。传入时后端按智能体配置解析模型/工具/技能/知识库/提示词/是否深度思考。
|
||||
*/
|
||||
@JsonSerialize(using = ToStringSerializer.class)
|
||||
@JSONField(serializeUsing = String.class)
|
||||
private Long agentId;
|
||||
|
||||
/**
|
||||
@@ -54,7 +52,6 @@ public class ChatRequest {
|
||||
* 会话id
|
||||
*/
|
||||
@JsonSerialize(using = ToStringSerializer.class)
|
||||
@JSONField(serializeUsing = String.class)
|
||||
private Long sessionId;
|
||||
|
||||
/**
|
||||
@@ -71,7 +68,6 @@ public class ChatRequest {
|
||||
* 对话id(每个聊天窗口都不一样)
|
||||
*/
|
||||
@JsonSerialize(using = ToStringSerializer.class)
|
||||
@JSONField(serializeUsing = String.class)
|
||||
private Long uuid;
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user