认证日志和锁定记录 的分页查询接口userAgent参数注入问题

Blade 未结 2 27
zeal
zeal 剑圣 1小时前

一、该问题的重现步骤是什么?

1. AuthLock的分页查询接口参数注入问题关于这个问题找根因了吗

2. 

3.


二、你期待的结果是什么?实际看到的又是什么?


三、你正在使用的是什么产品,什么版本?在什么操作系统上?


四、请提供详细的错误堆栈信息,这很重要。


五、若有更多详细信息,请在下面提供。

2条回答
  • 清空控制台,点击查询的时候把控制台打印的日志复制一份完整版本发这里看下

    0 讨论(0)
  • 1小时前


    ================  Request Start  ================

    ===> GET: /api/blade-system/auth-log/page Parameters: {"query":{"current":1,"size":10,"ascs":null,"descs":null},"authLog":{"id":null,"userId":null,"tenantId":null,"serviceId":null,"serverIp":null,"serverHost":null,"env":null,"account":null,"realName":null,"grantType":null,"clientType":null,"remoteIp":null,"userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","loginTime":null,"status":null,"isDeleted":null}}

    ===Headers===  Cookie: SESSION=YjY1MzY4YTUtOTZiYi00YjUyLTljZmMtNWNhMTU3MTIxZjlk; saber3-access-token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJibGFkZXguY24iLCJhdWQiOlsiYmxhZGV4Il0sInRva2VuX3R5cGUiOiJhY2Nlc3NfdG9rZW4iLCJjbGllbnRfaWQiOiJzYWJlcjMiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsImRlcHRfaWQiOiIxMTIzNTk4ODEzNzM4Njc1MjAxLDExMjM1OTg4MTM3Mzg2NzUyMDIsMTEyMzU5ODgxMzczODY3NTIwMyIsInBvc3RfaWQiOiIxMTIzNTk4ODE3NzM4Njc1MjAxIiwicm9sZV9pZCI6IjExMjM1OTg4MTY3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJ1c2VyX25hbWUiOiJhZG1pbiIsIm5pY2tfbmFtZSI6IueuoeeQhuWRmCIsInJlYWxfbmFtZSI6IueuoeeQhuWRmCIsInJvbGVfbmFtZSI6ImFkbWluaXN0cmF0b3IiLCJkZXB0X2NvZGVzIjoieGRsayIsImRldGFpbCI6eyJ0eXBlIjoid2ViIn0sImV4cCI6MTc4OTcwNTg1MiwibmJmIjoxNzg5NzAyMTkyfQ.-vW2oyDJ0ftQrxo0Eid88euDW_bO6F98fVondlyfo18; saber3-refresh-token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJibGFkZXguY24iLCJhdWQiOlsiYmxhZGV4Il0sInRva2VuX3R5cGUiOiJyZWZyZXNoX3Rva2VuIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJkZXB0X2lkIjoiMTEyMzU5ODgxMzczODY3NTIwMSwxMTIzNTk4ODEzNzM4Njc1MjAyLDExMjM1OTg4MTM3Mzg2NzUyMDMiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsImRlcHRfY29kZXMiOiJ4ZGxrIiwiYXV0aF90aW1lIjoxNzg5Njk1MTE2LCJleHAiOjE3OTAzMDcwNTIsIm5iZiI6MTc4OTcwMjE5Mn0.Mnx-6WrjY1QS01MxMF93wbtA1riF1GxgcsyBu8zQ9As

    ===Headers===  User-Time-Zone: Asia/Shanghai

    ===Headers===  Accept: application/json, text/plain, */*

    ===Headers===  Referer: http://smartlink-t.xindecolink.com/system/user

    ===Headers===  X-Forwarded-Host: smartlink-t.xindecolink.com

    ===Headers===  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36

    ===Headers===  X-Forwarded-Proto: http

    ===Headers===  Host: smartlink-t.xindecolink.com

    ===Headers===  Accept-Encoding: gzip, deflate

    ===Headers===  Pragma: no-cache

    ===Headers===  Authorization: Basic c2FiZXIzOnNhYmVyM19zZWNyZXQ=

    ===Headers===  Cache-Control: no-cache

    ===Headers===  Blade-Requested-With: BladeHttpRequest

    ===Headers===  X-Forwarded-For: 218.207.101.93

    ===Headers===  Data-Tenant-Id: 000000

    ===Headers===  Accept-Language: zh-CN

    ===Headers===  X-Real-IP: 218.207.101.93

    ===Headers===  Blade-Auth: bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJibGFkZXguY24iLCJhdWQiOlsiYmxhZGV4Il0sInRva2VuX3R5cGUiOiJhY2Nlc3NfdG9rZW4iLCJjbGllbnRfaWQiOiJzYWJlcjMiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsImRlcHRfaWQiOiIxMTIzNTk4ODEzNzM4Njc1MjAxLDExMjM1OTg4MTM3Mzg2NzUyMDIsMTEyMzU5ODgxMzczODY3NTIwMyIsInBvc3RfaWQiOiIxMTIzNTk4ODE3NzM4Njc1MjAxIiwicm9sZV9pZCI6IjExMjM1OTg4MTY3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJ1c2VyX25hbWUiOiJhZG1pbiIsIm5pY2tfbmFtZSI6IueuoeeQhuWRmCIsInJlYWxfbmFtZSI6IueuoeeQhuWRmCIsInJvbGVfbmFtZSI6ImFkbWluaXN0cmF0b3IiLCJkZXB0X2NvZGVzIjoieGRsayIsImRldGFpbCI6eyJ0eXBlIjoid2ViIn0sImV4cCI6MTc4OTcwNTg1MiwibmJmIjoxNzg5NzAyMTkyfQ.-vW2oyDJ0ftQrxo0Eid88euDW_bO6F98fVondlyfo18


    作者追问:1小时前

    要控制台的完整日志,包括sql日志。

    清空后麻烦再操作下然后复制日志发这里

    回答: 54分钟前

    image.pngimage.png


    ================  Request Start  ================

    ===> GET: /api/blade-system/auth-log/page Parameters: {"query":{"current":1,"size":10,"ascs":null,"descs":null},"authLog":{"id":null,"userId":null,"tenantId":null,"serviceId":null,"serverIp":null,"serverHost":null,"env":null,"account":null,"realName":null,"grantType":null,"clientType":null,"remoteIp":null,"userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","loginTime":null,"status":null,"isDeleted":null}}

    ===Headers===  Cookie: SESSION=YjY1MzY4YTUtOTZiYi00YjUyLTljZmMtNWNhMTU3MTIxZjlk; saber3-access-token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJibGFkZXguY24iLCJhdWQiOlsiYmxhZGV4Il0sInRva2VuX3R5cGUiOiJhY2Nlc3NfdG9rZW4iLCJjbGllbnRfaWQiOiJzYWJlcjMiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsImRlcHRfaWQiOiIxMTIzNTk4ODEzNzM4Njc1MjAxLDExMjM1OTg4MTM3Mzg2NzUyMDIsMTEyMzU5ODgxMzczODY3NTIwMyIsInBvc3RfaWQiOiIxMTIzNTk4ODE3NzM4Njc1MjAxIiwicm9sZV9pZCI6IjExMjM1OTg4MTY3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJ1c2VyX25hbWUiOiJhZG1pbiIsIm5pY2tfbmFtZSI6IueuoeeQhuWRmCIsInJlYWxfbmFtZSI6IueuoeeQhuWRmCIsInJvbGVfbmFtZSI6ImFkbWluaXN0cmF0b3IiLCJkZXB0X2NvZGVzIjoieGRsayIsImRldGFpbCI6eyJ0eXBlIjoid2ViIn0sImV4cCI6MTc4OTcwNTg1MiwibmJmIjoxNzg5NzAyMTkyfQ.-vW2oyDJ0ftQrxo0Eid88euDW_bO6F98fVondlyfo18; saber3-refresh-token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJibGFkZXguY24iLCJhdWQiOlsiYmxhZGV4Il0sInRva2VuX3R5cGUiOiJyZWZyZXNoX3Rva2VuIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJkZXB0X2lkIjoiMTEyMzU5ODgxMzczODY3NTIwMSwxMTIzNTk4ODEzNzM4Njc1MjAyLDExMjM1OTg4MTM3Mzg2NzUyMDMiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsImRlcHRfY29kZXMiOiJ4ZGxrIiwiYXV0aF90aW1lIjoxNzg5Njk1MTE2LCJleHAiOjE3OTAzMDcwNTIsIm5iZiI6MTc4OTcwMjE5Mn0.Mnx-6WrjY1QS01MxMF93wbtA1riF1GxgcsyBu8zQ9As

    ===Headers===  User-Time-Zone: Asia/Shanghai

    ===Headers===  Accept: application/json, text/plain, */*

    ===Headers===  Referer: http://smartlink-t.xindecolink.com/system/user

    ===Headers===  X-Forwarded-Host: smartlink-t.xindecolink.com

    ===Headers===  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36

    ===Headers===  X-Forwarded-Proto: http

    ===Headers===  Host: smartlink-t.xindecolink.com

    ===Headers===  Accept-Encoding: gzip, deflate

    ===Headers===  Pragma: no-cache

    ===Headers===  Authorization: Basic c2FiZXIzOnNhYmVyM19zZWNyZXQ=

    ===Headers===  Cache-Control: no-cache

    ===Headers===  Blade-Requested-With: BladeHttpRequest

    ===Headers===  X-Forwarded-For: 218.207.101.93

    ===Headers===  Data-Tenant-Id: 000000

    ===Headers===  Accept-Language: zh-CN

    ===Headers===  X-Real-IP: 218.207.101.93

    ===Headers===  Blade-Auth: bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJibGFkZXguY24iLCJhdWQiOlsiYmxhZGV4Il0sInRva2VuX3R5cGUiOiJhY2Nlc3NfdG9rZW4iLCJjbGllbnRfaWQiOiJzYWJlcjMiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsImRlcHRfaWQiOiIxMTIzNTk4ODEzNzM4Njc1MjAxLDExMjM1OTg4MTM3Mzg2NzUyMDIsMTEyMzU5ODgxMzczODY3NTIwMyIsInBvc3RfaWQiOiIxMTIzNTk4ODE3NzM4Njc1MjAxIiwicm9sZV9pZCI6IjExMjM1OTg4MTY3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJ1c2VyX25hbWUiOiJhZG1pbiIsIm5pY2tfbmFtZSI6IueuoeeQhuWRmCIsInJlYWxfbmFtZSI6IueuoeeQhuWRmCIsInJvbGVfbmFtZSI6ImFkbWluaXN0cmF0b3IiLCJkZXB0X2NvZGVzIjoieGRsayIsImRldGFpbCI6eyJ0eXBlIjoid2ViIn0sImV4cCI6MTc4OTcwNTg1MiwibmJmIjoxNzg5NzAyMTkyfQ.-vW2oyDJ0ftQrxo0Eid88euDW_bO6F98fVondlyfo18

    ================   Request End   ================


    2026-09-18 11:36:57.307  INFO 1 --- [  XNIO-1 task-7] o.s.core.mp.plugins.SqlLogInterceptor    : 


    ==============  Sql Start  ==============

    Execute SQL : select id, code, user_type, account, password , name, real_name, avatar, email, phone , birthday, sex, role_id, dept_id, post_id , leader_id, is_leader, dept_codes, tenant_id, create_user , create_dept, create_time, update_user, update_time, status , is_deleted from blade_user where id = 1123598821738675201 and is_deleted = 0

    Execute Time: 0.547ms

    ==============  Sql  End   ==============


    2026-09-18 11:36:57.309  INFO 1 --- [  XNIO-1 task-7] o.s.core.mp.plugins.SqlLogInterceptor    : 


    ==============  Sql Start  ==============

    Execute SQL : select count(*) as total from blade_auth_log where is_deleted = 0 and user_agent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36' and (tenant_id = '000000')

    Execute Time: 0.541ms

    ==============  Sql  End   ==============


    2026-09-18 11:36:57.311  INFO 1 --- [  XNIO-1 task-7] o.s.core.mp.plugins.SqlLogInterceptor    : 


    ==============  Sql Start  ==============

    Execute SQL : select id, user_id, tenant_id, service_id, server_ip , server_host, env, account, real_name, grant_type , client_type, remote_ip, user_agent, login_time, status , is_deleted from blade_auth_log where is_deleted = 0 and user_agent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36' and (tenant_id = '000000') order by login_time desc limit 10

    Execute Time: 0.474ms

    ==============  Sql  End   ==============


    2026-09-18 11:36:57.313  INFO 1 --- [  XNIO-1 task-7] o.s.core.log.aspect.RequestLogAspect     : 


    ===============  Response Start  ================

    ===Result===  {"code":200,"success":true,"data":{"records":[{"id":"2100768119682789377","userId":"1123598821738675201","tenantId":"000000","serviceId":"smartlink-rfid","serverIp":"10.25.1.1:80","serverHost":"kkdeMacBook-Pro.local","env":"dev","account":"admin","realName":"管理员","grantType":"behavior","clientType":"saber3","remoteIp":"0:0:0:0:0:0:0:1","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","loginTime":"2026-09-18 10:05:25","status":1,"isDeleted":0,"userName":"管理员","clientTypeName":"用户WEB端登录"},{"id":"2100759698005602306","userId":"1123598821738675201","tenantId":"000000","serviceId":"smartlink-rfid","serverIp":"192.168.0.231:19004","serverHost":"smartlink-rfid-boot-54b485d6c8-qfz9h","env":"test","account":"admin","realName":"管理员","grantType":"behavior","clientType":"saber3","remoteIp":"218.207.101.93","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","loginTime":"2026-09-18 09:31:57","status":1,"isDeleted":0,"userName":"管理员","clientTypeName":"用户WEB端登录"},{"id":"2100400322254254081","userId":"1123598821738675201","tenantId":"000000","serviceId":"smartlink-rfid","serverIp":"192.168.0.231:19004","serverHost":"smartlink-rfid-boot-54b485d6c8-qfz9h","env":"test","account":"admin","realName":"管理员","grantType":"behavior","clientType":"saber3","remoteIp":"218.207.101.93","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","loginTime":"2026-09-17 09:43:55","status":1,"isDeleted":0,"userName":"管理员","clientTypeName":"用户WEB端登录"}],"total":3,"size":10,"current":1,"pages":1},"msg":"操作成功"}

    <=== GET: /api/blade-system/auth-log/page (12 ms)

    ===============   Response End   ================

    而且本地不会


    0 讨论(0)
提交回复