From 8bde916232eb23c02e01fb0e1dc0d51dae43ae97 Mon Sep 17 00:00:00 2001 From: lixiaolong <702156524@qq.com> Date: Wed, 18 Mar 2026 09:27:25 +0800 Subject: [PATCH] =?UTF-8?q?fix(util):=20=E4=BF=AE=E5=A4=8DNashornJsExecuto?= =?UTF-8?q?r=E6=89=A7=E8=A1=8C=E7=BB=93=E6=9E=9C=E5=8F=8D=E5=BA=8F?= =?UTF-8?q?=E5=88=97=E5=8C=96=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 修改execute方法返回值注释，明确返回原生类型/JSONObject而非JSON字符串 - 在execute方法中添加JSON字符串反序列化为Java对象的核心修复逻辑 - 在JS代码中添加JSON.stringify确保统一结果格式便于反序列化 - 更新toJson和fromJson方法使用fastjson2保持版本一致性 - 修改fromJson方法返回Object类型以支持自动类型适配 - 简化SecurityConfig中URL权限配置，移除冗余路径配置 --- .../cmvr/framework/config/SecurityConfig.java | 3 +-- .../com/cmvr/test/util/NashornJsExecutor.java | 25 ++++++++++++------- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/cmvr-iot-framework/src/main/java/com/cmvr/framework/config/SecurityConfig.java b/cmvr-iot-framework/src/main/java/com/cmvr/framework/config/SecurityConfig.java index 072eb59..3419b27 100644 --- a/cmvr-iot-framework/src/main/java/com/cmvr/framework/config/SecurityConfig.java +++ b/cmvr-iot-framework/src/main/java/com/cmvr/framework/config/SecurityConfig.java @@ -115,8 +115,7 @@ public class SecurityConfig // 静态资源，可匿名访问 .antMatchers(HttpMethod.GET, "/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js", "/profile/**").permitAll() .antMatchers("/system/file/upload","/evaluation/callback","/flow/**","/flowise/**","/kws/**","/ws/**","/api/grpc/**","/show/**", - "/node-red/**","/swagger-ui.html", "/swagger-resources/**", "/webjars/**", "/*/api-docs", "/druid/**", - "/ti/ui/findNextClickToFunction", "/ti/function/**").permitAll() + "/node-red/**","/swagger-ui.html", "/swagger-resources/**", "/webjars/**", "/*/api-docs", "/druid/**", "/ti/**").permitAll() // 除上面外的所有请求全部需要鉴权认证 .anyRequest().authenticated(); }) diff --git a/cmvr-iot-test/src/main/java/com/cmvr/test/util/NashornJsExecutor.java b/cmvr-iot-test/src/main/java/com/cmvr/test/util/NashornJsExecutor.java index 4900a47..3637e9e 100644 --- a/cmvr-iot-test/src/main/java/com/cmvr/test/util/NashornJsExecutor.java +++ b/cmvr-iot-test/src/main/java/com/cmvr/test/util/NashornJsExecutor.java @@ -50,7 +50,7 @@ public class NashornJsExecutor { NashornScriptEngineFactory factory = new NashornScriptEngineFactory(); String[] strings = {"--language=es6"}; this.engine = factory.getScriptEngine( - strings, // 关键在这里 + strings, null, new ClassFilter() { @Override @@ -66,7 +66,7 @@ public class NashornJsExecutor { * * @param jsCode JS 代码，必须包含 handler 函数 * @param params 传入的参数（Map 或 POJO） - * @return 执行结果 Map + * @return 执行结果（自动反序列化后的原生类型/JSONObject） */ public Object execute(String jsCode, Object params) { // 1. 代码安全检查 @@ -111,15 +111,17 @@ public class NashornJsExecutor { throw new RuntimeException("脚本返回 null"); } + // ========== 核心修复点 1 ========== + // 将 JS 执行返回的 JSON 字符串反序列化为 Java 对象 String resultJson = result.toString(); // 检查结果大小 if (resultJson.length() > MAX_RESULT_SIZE) { throw new RuntimeException("返回结果超过 " + (MAX_RESULT_SIZE/1024/1024) + "MB 限制"); } - return resultJson; - // 解析为 Map -// return fromJson(resultJson); + + // 反序列化 JSON 字符串为 Java 对象（JSONObject/原生类型） + return fromJson(resultJson); } // 更简单的版本：不覆盖 eval，依赖其他安全措施 @@ -145,6 +147,8 @@ public class NashornJsExecutor { sb.append(" \n"); sb.append(" var params = JSON.parse('").append(escapeJson(jsonParams)).append("');\n"); sb.append(" var result = handler(params);\n"); + // ========== 核心修复点 2 ========== + // JSON.stringify 是必要的：统一结果格式，确保能反序列化 sb.append(" return JSON.stringify(result);\n"); sb.append("})()"); @@ -217,19 +221,22 @@ public class NashornJsExecutor { */ private String toJson(Object obj) { try { - return com.alibaba.fastjson.JSON.toJSONString(obj); + // ========== 补充优化：使用 fastjson2 的 API 保持版本一致 ========== + return com.alibaba.fastjson2.JSON.toJSONString(obj); } catch (Exception e) { throw new RuntimeException("参数序列化失败", e); } } /** - * JSON 转 Map + * JSON 转 Java 对象（自动适配类型） */ @SuppressWarnings("unchecked") - private JSONObject fromJson(String json) { + private Object fromJson(String json) { try { - return JSONObject.parseObject(json); + // ========== 核心修复点 3 ========== + // 使用 parse 而非 parseObject，自动识别类型（字符串/数字/布尔/JSONObject） + return com.alibaba.fastjson2.JSON.parse(json); } catch (Exception e) { throw new RuntimeException("结果反序列化失败", e); }