😎1、增加网安必要的响应安全头 2、修复字典验证逻辑 3、增加表单上传大小限制 4、升级依赖
This commit is contained in:
zuohuaijun
parent
9d7a249dd4
commit
c13cb271f3
@ -57,12 +57,12 @@ public class DictAttribute : ValidationAttribute
|
||||
var sysDictDataServiceProvider = App.GetRequiredService<SysDictDataService>();
|
||||
var dictDataList = sysDictDataServiceProvider.GetDataList(DictTypeCode).Result;
|
||||
|
||||
// 获取枚举类型，可能存在Nullable类型，所以需要尝试获取最终类型
|
||||
var type = value?.GetType();
|
||||
type = type != null ? Nullable.GetUnderlyingType(type) ?? type : null;
|
||||
//// 获取枚举类型，可能存在Nullable类型，所以需要尝试获取最终类型
|
||||
//var type = value?.GetType();
|
||||
//type = type != null ? Nullable.GetUnderlyingType(type) ?? type : null;
|
||||
|
||||
// 使用HashSet来提高查找效率
|
||||
var valueList = (type?.IsEnum ?? DictTypeCode.EndsWith("Enum")) ? dictDataList.Select(u => u.Value) : dictDataList.Select(u => u.Code);
|
||||
var valueList = dictDataList.Select(u => u.Code); // (type?.IsEnum ?? DictTypeCode.EndsWith("Enum")) ? dictDataList.Select(u => u.Value) : dictDataList.Select(u => u.Code);
|
||||
var dictHash = new HashSet<string>(valueList);
|
||||
|
||||
if (!dictHash.Contains(valueAsString))
|
||||
|
||||
@ -268,7 +268,32 @@ public class Startup : AppStartup
|
||||
|
||||
app.Use(async (context, next) =>
|
||||
{
|
||||
context.Response.Headers.Append("Admin.NET", "Admin.NET");
|
||||
// 隐藏服务器信息
|
||||
context.Response.Headers.Append("Server", "none");
|
||||
// 防止浏览器 MIME 类型嗅探，确保内容按照声明的类型处理
|
||||
context.Response.Headers.Append("X-Content-Type-Options", "nosniff");
|
||||
// 防止点击劫持，确保页面内容不被其他页面覆盖
|
||||
context.Response.Headers.Append("X-Frame-Options", "DENY");
|
||||
// 启用 XSS 保护，防止跨站脚本注入
|
||||
context.Response.Headers.Append("X-XSS-Protection", "1; mode=block");
|
||||
// 控制在请求中发送的来源信息，减少潜在的隐私泄露
|
||||
context.Response.Headers.Append("Referrer-Policy", "no-referrer");
|
||||
// 防止 Internet Explorer 在下载文件时自动打开，降低恶意文件执行的风险
|
||||
context.Response.Headers.Append("X-Download-Options", "noopen");
|
||||
// 限制 Flash 和其他插件的跨域访问，防止数据泄露
|
||||
context.Response.Headers.Append("X-Permitted-Cross-Domain-Policies", "none");
|
||||
// 限制可执行的脚本和样式，降低 XSS 攻击的风险
|
||||
context.Response.Headers.Append("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;");
|
||||
// 允许浏览器使用地理位置 API，但仅限于当前站点
|
||||
context.Response.Headers.Append("Permissions-Policy", "geolocation=(self)");
|
||||
// 强制使用 HTTPS，防止中间人攻击
|
||||
context.Response.Headers.Append("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload");
|
||||
// 隐藏服务器端技术栈
|
||||
context.Response.Headers.Append("X-Powered-By", "Admin.NET v2.0.0");
|
||||
// 移除特性响应头
|
||||
context.Response.Headers.Remove("Furion");
|
||||
// 添加自定义响应头
|
||||
context.Response.Headers.Append("Admin.NET", "v2.0.0");
|
||||
await next();
|
||||
});
|
||||
|
||||
|
||||
@ -4,6 +4,8 @@
|
||||
//
|
||||
// 不得利用本项目从事危害国家安全、扰乱社会秩序、侵犯他人合法权益等法律法规禁止的活动！任何基于本项目二次开发而产生的一切法律纠纷和责任，我们不承担任何责任！
|
||||
|
||||
using Microsoft.AspNetCore.Http.Features;
|
||||
|
||||
Serve.Run(RunOptions.Default.AddWebComponent<WebComponent>());
|
||||
|
||||
public class WebComponent : IWebComponent
|
||||
@ -16,12 +18,17 @@ public class WebComponent : IWebComponent
|
||||
return !new[] { "Microsoft.Hosting", "Microsoft.AspNetCore" }.Any(u => category.StartsWith(u)) && logLevel >= LogLevel.Information;
|
||||
});
|
||||
|
||||
// 设置接口超时时间和上传大小-Kestrel
|
||||
builder.WebHost.ConfigureKestrel(u =>
|
||||
// 配置接口超时时间和请求大小（Kestrel方式）
|
||||
builder.WebHost.ConfigureKestrel(options =>
|
||||
{
|
||||
u.Limits.KeepAliveTimeout = TimeSpan.FromMinutes(30);
|
||||
u.Limits.RequestHeadersTimeout = TimeSpan.FromMinutes(30);
|
||||
u.Limits.MaxRequestBodySize = null;
|
||||
options.Limits.KeepAliveTimeout = TimeSpan.FromMinutes(30);
|
||||
options.Limits.RequestHeadersTimeout = TimeSpan.FromMinutes(30);
|
||||
options.Limits.MaxRequestBodySize = 1073741824; // 限制大小1GB（默认28.6MB）
|
||||
});
|
||||
// 配置 Formoptions（multipart/form-data）请求大小
|
||||
builder.Services.Configure<FormOptions>(options =>
|
||||
{
|
||||
options.MultipartBodyLengthLimit = 1073741824; // 限制大小1GB（默认128MB）
|
||||
});
|
||||
}
|
||||
}
|
||||
@ -6,6 +6,11 @@
|
||||
<requestLimits maxAllowedContentLength="1073741824" maxQueryString="1073741824" />
|
||||
</requestFiltering>
|
||||
</security>
|
||||
<httpProtocol>
|
||||
<customHeaders>
|
||||
<remove name="X-Powered-By" />
|
||||
</customHeaders>
|
||||
</httpProtocol>
|
||||
<handlers>
|
||||
<add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
|
||||
</handlers>
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
"name": "admin.net.pro",
|
||||
"type": "module",
|
||||
"version": "2.4.33",
|
||||
"lastBuildTime": "2025.01.09",
|
||||
"lastBuildTime": "2025.01.10",
|
||||
"description": "Admin.NET 站在巨人肩膀上的 .NET 通用权限开发框架",
|
||||
"author": "zuohuaijun",
|
||||
"license": "MIT",
|
||||
@ -45,7 +45,7 @@
|
||||
"jsplumb": "^2.15.6",
|
||||
"jwchat": "^2.0.3",
|
||||
"lodash-es": "^4.17.21",
|
||||
"md-editor-v3": "^5.1.1",
|
||||
"md-editor-v3": "^5.2.1",
|
||||
"mitt": "^3.0.1",
|
||||
"monaco-editor": "^0.52.2",
|
||||
"mqtt": "^5.10.3",
|
||||
@ -75,7 +75,7 @@
|
||||
"vue-signature-pad": "^3.0.2",
|
||||
"vue3-tree-org": "^4.2.2",
|
||||
"vxe-pc-ui": "^4.3.67",
|
||||
"vxe-table": "^4.10.3",
|
||||
"vxe-table": "^4.10.5",
|
||||
"vxe-table-plugin-element": "^4.0.4",
|
||||
"vxe-table-plugin-export-xlsx": "^4.0.7",
|
||||
"xe-utils": "^3.7.0",
|
||||
|
||||
Loading…
Reference in New Issue
Block a user