`NewsController.index`中疑似的权限检查缺失

[kingkingkingson]

问题描述

在NewsController.index方法中，调用了数据库查询语句List<CmsArticle> articles = cmsArticleService.selectByExampleForOffsetPage(cmsArticleExample, (page - 1) * rows, rows);然而这个方法不存在任何的权限保护。与之相对的，在另一个方法中CmsArticleController.list中，也存在List<CmsArticle> rows = cmsArticleService.selectByExampleForOffsetPage(cmsArticleExample, offset, limit);的查询语句。但是CmsArticleController.list存在@RequiresPermissions("cms:article:read")表明需要一定的权限。是否可能通过直接调用NewsController.index接口绕过CmsArticleController.list的权限检测，获得里面的相关数据。

相关代码

• NewsController.index

/**
     * 首页
     * @param page
     * @param sort
     * @param order
     * @param request
     * @param model
     * @return
     */
    @RequestMapping(value = "", method = RequestMethod.GET)
    public String index(@RequestParam(required = false, defaultValue = "1", value = "page") int page,
                        @RequestParam(required = false, defaultValue = "orders", value = "sort") String sort,
                        @RequestParam(required = false, defaultValue = "desc", value = "order") String order,
                        HttpServletRequest request,
                        Model model) {
        // 系统id
        CmsSystemExample cmsSystemExample = new CmsSystemExample();
        cmsSystemExample.createCriteria()
                .andCodeEqualTo(CODE);
        CmsSystem system = cmsSystemService.selectFirstByExample(cmsSystemExample);
        model.addAttribute("system", system);
        // 该系统类目
        CmsCategoryExample cmsCategoryExample = new CmsCategoryExample();
        cmsCategoryExample.createCriteria()
                .andSystemIdEqualTo(system.getSystemId());
        cmsCategoryExample.setOrderByClause("orders asc");
        List<CmsCategory> categories = cmsCategoryService.selectByExample(cmsCategoryExample);
        model.addAttribute("categories", categories);
        // 该系统标签
        CmsTagExample cmsTagExample = new CmsTagExample();
        cmsTagExample.createCriteria()
                .andSystemIdEqualTo(system.getSystemId());
        cmsTagExample.setOrderByClause("orders asc");
        List<CmsTag> tags = cmsTagService.selectByExample(cmsTagExample);
        model.addAttribute("tags", tags);
        // 该系统文章列表
        int rows = 10;
        CmsArticleExample cmsArticleExample = new CmsArticleExample();
        cmsArticleExample.createCriteria()
                .andStatusEqualTo((byte) 1)
                .andSystemIdEqualTo(system.getSystemId());
        if (!StringUtils.isBlank(sort) && !StringUtils.isBlank(order)) {
            cmsArticleExample.setOrderByClause(sort + " " + order);
        }
// 和 CmsArticleController.list 查询相同
        List<CmsArticle> articles = cmsArticleService.selectByExampleForOffsetPage(cmsArticleExample, (page - 1) * rows, rows);
        model.addAttribute("articles", articles);
        // 文章总数
        long total = cmsArticleService.countByExample(cmsArticleExample);
        // 分页
        Paginator paginator = new Paginator(total, page, rows, request);
        model.addAttribute("paginator", paginator);
        return thymeleaf("/news/index");
    }

• CmsArticleController.list

        @ApiOperation(value = "文章列表")
	@RequiresPermissions("cms:article:read")  // 存在权限注解
	@RequestMapping(value = "/list", method = RequestMethod.GET)
	@ResponseBody
	public Object list(
			@RequestParam(required = false, defaultValue = "0", value = "offset") int offset,
			@RequestParam(required = false, defaultValue = "10", value = "limit") int limit,
			@RequestParam(required = false, value = "sort") String sort,
			@RequestParam(required = false, value = "order") String order) {
		CmsArticleExample cmsArticleExample = new CmsArticleExample();
		if (!StringUtils.isBlank(sort) && !StringUtils.isBlank(order)) {
			cmsArticleExample.setOrderByClause(sort + " " + order);
		}
		List<CmsArticle> rows = cmsArticleService.selectByExampleForOffsetPage(cmsArticleExample, offset, limit);
		long total = cmsArticleService.countByExample(cmsArticleExample);
		Map<String, Object> result = new HashMap<>(2);
		result.put("rows", rows);
		result.put("total", total);
		return result;
	}

感谢解答疑问！

[kingkingkingson]

类似的，在NewsController的其他方法中，比如category, tag, article也存在类似的情况