修改支付账号和rememberme反序列漏洞

puzhibing

2026-09-20 2c922395efc2e000e1382a79ab93e1bc47135140

 UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java

@@ -5,12 +5,10 @@
import com.stylefeng.guns.core.shiro.ShiroDbRealm;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.cache.ehcache.EhCacheManager;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.Cookie;
import org.apache.shiro.web.servlet.ShiroHttpSession;
@@ -41,11 +39,10 @@
     * 安全管理器
     */
    @Bean
    public DefaultWebSecurityManager securityManager(CookieRememberMeManager rememberMeManager, CacheManager cacheShiroManager, SessionManager sessionManager) {
    public DefaultWebSecurityManager securityManager(CacheManager cacheShiroManager, SessionManager sessionManager) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(this.shiroDbRealm());
        securityManager.setCacheManager(cacheShiroManager);
        securityManager.setRememberMeManager(rememberMeManager);
        securityManager.setSessionManager(sessionManager);
        return securityManager;
    }
@@ -97,27 +94,33 @@
    }

    /**
     * rememberMe管理器, cipherKey生成见{@code Base64Test.java}
     * rememberMe已关闭 - 2026-09-20
     * 原 rememberMeManager 与 rememberMeCookie Bean 已移除，
     * 登录入口不应再 setRememberMe(true)。
     * 如需恢复，取消下方注释并恢复 securityManager.setRememberMeManager(...) 即可。
     */
    @Bean
    public CookieRememberMeManager rememberMeManager(SimpleCookie rememberMeCookie) {
        CookieRememberMeManager manager = new CookieRememberMeManager();
//        manager.setCipherKey(Base64.decode("Z3VucwAAAAAAAAAAAAAAAA=="));
        manager.setCookie(rememberMeCookie);
        return manager;
    }

    /**
     * 记住密码Cookie
     */
    @Bean
    public SimpleCookie rememberMeCookie() {
//        SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
        SimpleCookie simpleCookie = new SimpleCookie("");
        simpleCookie.setHttpOnly(true);
        simpleCookie.setMaxAge(7 * 24 * 60 * 60);//7天
        return simpleCookie;
    }
//    /**
//     * rememberMe管理器, cipherKey生成见{@code Base64Test.java}
//     */
//    @Bean
//    public CookieRememberMeManager rememberMeManager(SimpleCookie rememberMeCookie) {
//        CookieRememberMeManager manager = new CookieRememberMeManager();
////        manager.setCipherKey(Base64.decode("Z3VucwAAAAAAAAAAAAAAAA=="));
//        manager.setCookie(rememberMeCookie);
//        return manager;
//    }
//
//    /**
//     * 记住密码Cookie
//     */
//    @Bean
//    public SimpleCookie rememberMeCookie() {
////        SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
//        SimpleCookie simpleCookie = new SimpleCookie("");
//        simpleCookie.setHttpOnly(true);
//        simpleCookie.setMaxAge(7 * 24 * 60 * 60);//7天
//        return simpleCookie;
//    }

    /**
     * Shiro的过滤器链
@@ -153,7 +156,7 @@
         * authc 需要认证
         * user  验证通过或RememberMe登录的都可以
         *
         * 当应用开启了rememberMe时,用户下次访问时可以是一个user,但不会是authc,因为authc是需要重新认证的
         * 已关闭 RememberMe，/** 由 user 改为 authc，每次请求都需要重新登录态
         *
         * 顺序从上到下,优先级依次降低
         *
@@ -176,7 +179,7 @@
        hashMap.put("/global/sessionError", "anon");
        hashMap.put("/kaptcha", "anon");
        hashMap.put("/api/placeOrder/notifyUrl", "anon");
        hashMap.put("/**", "user");
        hashMap.put("/**", "authc");


        shiroFilter.setFilterChainDefinitionMap(hashMap);