【新增】web 模块新增 encrypt 实现 API 加解密 #681

craftsman4j · 2024-10-26T17:16:53Z

No description provided.

liyujiang-gzu · 2024-11-18T07:24:58Z

这个功能很好，RSA+AES 实现加密解密，支持一下。

darren4neil · 2024-12-17T13:25:02Z

好功能，希望能把前端也同步推送一下 @craftsman4j

craftsman4j · 2024-12-23T13:40:56Z

好功能，希望能把前端也同步推送一下 @craftsman4j

前端由作者来贡献，他估计没时间

liyujiang-gzu · 2024-12-23T13:44:50Z

好功能，希望能把前端也同步推送一下 @craftsman4j

前端由作者来贡献，他估计没时间

兄弟，你不就是这个PR的作者吗？

craftsman4j · 2024-12-23T14:05:54Z

好功能，希望能把前端也同步推送一下 @craftsman4j

前端由作者来贡献，他估计没时间

兄弟，你不就是这个PR的作者吗？

我说的项目作者 yudao

YunaiV · 2025-07-08T06:54:54Z

bugbot run

cursor

Bug: Incorrect `ServletInputStream` Method Implementations

The ServletInputStream implementation in ApiDecryptRequestBodyWrapper incorrectly implements isFinished(), isReady(), and available() methods.

isFinished() always returns false instead of true when all data has been read from the underlying stream.
isReady() always returns false instead of true, despite data being immediately available from the wrapped ByteArrayInputStream.
available() returns the total body length (body.length) instead of the remaining bytes available in the stream.

This violates the Servlet API contract and can cause issues with servlet containers, particularly in asynchronous or non-blocking I/O operations.

yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/filter/ApiDecryptRequestBodyWrapper.java#L73-L90

ruoyi-vue-pro/yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/filter/ApiDecryptRequestBodyWrapper.java

Lines 73 to 90 in a784685

    
           @Override 
        
           public boolean isFinished() { 
        
               return false; 
        
           } 
        
           @Override 
        
           public boolean isReady() { 
        
               return false; 
        
           } 
        
           @Override 
        
           public void setReadListener(ReadListener readListener) { 
        
           } 
        
           @Override 
        
           public int available() { 
        
               return body.length; 
        
           }

Fix in Cursor • Fix in Web

Bug: Null Handler Mapping Causes NullPointerException

A NullPointerException can occur if handlerMapping.getHandler(servletRequest) returns null. This results in mappingHandler being null, and a subsequent call to mappingHandler.getHandler() will throw an NPE. The existing try-catch block only handles exceptions thrown by handlerMapping.getHandler(), not a null return, leaving this scenario unaddressed.

yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/filter/ApiDecryptRequestBodyFilter.java#L83-L84

ruoyi-vue-pro/yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/filter/ApiDecryptRequestBodyFilter.java

Lines 83 to 84 in a784685

    
           } 
        
           Object handler = mappingHandler.getHandler();

Fix in Cursor • Fix in Web

Bug: AES Key Generation Relies on Default Charset

AES key generation in EncryptUtils uses key.getBytes(), which relies on the platform's default charset. This leads to inconsistent encryption and decryption behavior across environments, as a configurable charset (e.g., from EncryptProperties) should be used instead.

yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/util/EncryptUtils.java#L57-L58

ruoyi-vue-pro/yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/util/EncryptUtils.java

Lines 57 to 58 in a784685

    
           public static String encryptBase64ByAES(String content, String key) { 
        
               byte[] byteKey = SecureUtil.generateKey(AES, key.getBytes()).getEncoded();

yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/util/EncryptUtils.java#L66-L67

ruoyi-vue-pro/yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/util/EncryptUtils.java

Lines 66 to 67 in a784685

    
           public static String decryptStrByAES(String encryptString, String key) { 
        
               byte[] byteKey = SecureUtil.generateKey(AES, key.getBytes()).getEncoded();

Fix in Cursor • Fix in Web

BugBot free trial expires on July 22, 2025
You have used $0.00 of your $50.00 spend limit so far. Manage your spend limit in the Cursor dashboard.

Was this report helpful? Give feedback by reacting with 👍 or 👎

Copilot

Pull Request Overview

This PR adds encryption and decryption functionality to the web module for API requests and responses. It implements a hybrid RSA + AES encryption scheme where clients encrypt data using AES and transmit the AES key encrypted with RSA.

Key changes:

Adds encryption utilities for RSA and AES operations
Implements request body decryption through filters
Provides response body encryption through response advice
Introduces annotations for marking endpoints as requiring encryption/decryption

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`org.springframework.boot.autoconfigure.AutoConfiguration.imports`	Registers the new encryption auto-configuration
`EncryptUtils.java`	Utility class providing RSA and AES encryption/decryption methods
`ApiDecryptRequestBodyWrapper.java`	HTTP request wrapper that decrypts incoming request bodies
`ApiDecryptRequestBodyFilter.java`	Filter that applies request body decryption to annotated endpoints
`ApiEncrypt.java`	Annotation to mark methods requiring response encryption
`ApiDecrypt.java`	Annotation to mark methods requiring request decryption
`ApiEncryptResponseBodyAdvice.java`	Response advice that encrypts outgoing response bodies
`YudaoApiEncryptAutoConfiguration.java`	Auto-configuration class for encryption components
`EncryptProperties.java`	Configuration properties for encryption settings
`WebFilterOrderEnum.java`	Adds filter order constant for encryption filter

Comments suppressed due to low confidence (1)

yudao-framework/yudao-spring-boot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/filter/ApiDecryptRequestBodyFilter.java:60

The variable name 'apiEncrypt' is misleading as it holds an ApiDecrypt annotation. It should be renamed to 'apiDecrypt' for clarity.

        ApiDecrypt apiEncrypt = getApiDecryptAnnotation(request);

Copilot · 2025-07-30T07:06:51Z

...c/main/java/cn/iocoder/yudao/framework/encrypt/core/filter/ApiDecryptRequestBodyWrapper.java

+
+            @Override
+            public boolean isFinished() {
+                return false;


The isFinished() method should return true when the stream has been completely read. Currently it always returns false, which may cause issues with stream handling.

Suggested change

return false;

return inputStream.available() == 0;

Copilot · 2025-07-30T07:06:51Z

...c/main/java/cn/iocoder/yudao/framework/encrypt/core/filter/ApiDecryptRequestBodyWrapper.java

+
+            @Override
+            public boolean isReady() {
+                return false;


The isReady() method should indicate whether data is available for reading. Currently it always returns false, which may prevent proper stream reading.

Suggested change

return false;

return inputStream.available() > 0;

Copilot · 2025-07-30T07:06:52Z

...rc/main/java/cn/iocoder/yudao/framework/encrypt/core/filter/ApiDecryptRequestBodyFilter.java

+            mappingHandler = handlerMapping.getHandler(servletRequest);
+        } catch (Exception e) {
+            return null;
+        }


The code should check if mappingHandler is null before calling getHandler() to avoid potential NullPointerException.

Suggested change

}

}

if (mappingHandler == null) {

return null;

}

Copilot · 2025-07-30T07:06:52Z

...oot-starter-web/src/main/java/cn/iocoder/yudao/framework/encrypt/core/util/EncryptUtils.java

+ */
+public class EncryptUtils {
+
+    public static final String RSA = "RSA";


The constant RSA is defined but never used in this class. Consider removing it or using it consistently throughout the encryption operations.

craftsman4j added 2 commits October 27, 2024 01:13

【新增】web 模块新增 encrypt 实现 API 加解密

3618619

重命名 encrypt.util 包

a784685

liyujiang-gzu approved these changes Dec 23, 2024

View reviewed changes

craftsman4j closed this Dec 23, 2024

craftsman4j reopened this Dec 23, 2024

craftsman4j requested a review from liyujiang-gzu April 2, 2025 13:09

liyujiang-gzu approved these changes Apr 9, 2025

View reviewed changes

YunaiV mentioned this pull request Jun 15, 2025

接口加密问题麻烦一起搞搞吧，一帮搞安全的在扫描，头疼阿 #875

Closed

cursor bot reviewed Jul 8, 2025

View reviewed changes

YunaiV requested a review from Copilot July 30, 2025 07:05

Copilot AI reviewed Jul 30, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

【新增】web 模块新增 encrypt 实现 API 加解密 #681

【新增】web 模块新增 encrypt 实现 API 加解密 #681

craftsman4j commented Oct 26, 2024

Uh oh!

liyujiang-gzu commented Nov 18, 2024

Uh oh!

darren4neil commented Dec 17, 2024

Uh oh!

craftsman4j commented Dec 23, 2024

Uh oh!

liyujiang-gzu commented Dec 23, 2024

Uh oh!

craftsman4j commented Dec 23, 2024

Uh oh!

YunaiV commented Jul 8, 2025

Uh oh!

cursor bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jul 30, 2025

Uh oh!

Copilot AI Jul 30, 2025

Uh oh!

Copilot AI Jul 30, 2025

Uh oh!

Copilot AI Jul 30, 2025

Uh oh!

Uh oh!

	@Override
	public boolean isFinished() {
	return false;
	}

	@Override
	public boolean isReady() {
	return false;
	}

	@Override
	public void setReadListener(ReadListener readListener) {
	}

	@Override
	public int available() {
	return body.length;
	}

	public static String encryptBase64ByAES(String content, String key) {
	byte[] byteKey = SecureUtil.generateKey(AES, key.getBytes()).getEncoded();

	public static String decryptStrByAES(String encryptString, String key) {
	byte[] byteKey = SecureUtil.generateKey(AES, key.getBytes()).getEncoded();

【新增】web 模块新增 encrypt 实现 API 加解密 #681

Are you sure you want to change the base?

【新增】web 模块新增 encrypt 实现 API 加解密 #681

Conversation

craftsman4j commented Oct 26, 2024

Uh oh!

liyujiang-gzu commented Nov 18, 2024

Uh oh!

darren4neil commented Dec 17, 2024

Uh oh!

craftsman4j commented Dec 23, 2024

Uh oh!

liyujiang-gzu commented Dec 23, 2024

Uh oh!

craftsman4j commented Dec 23, 2024

Uh oh!

YunaiV commented Jul 8, 2025

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Bug: Incorrect `ServletInputStream` Method Implementations

Bug: Null Handler Mapping Causes NullPointerException

Bug: AES Key Generation Relies on Default Charset

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!