update: 安全检测报告后优化及修复

朱兆平
config/application.yml
config/logback-dev.xml
pom.xml
src/main/java/com/tianbo/warehouse/Swagger2.java
src/main/java/com/tianbo/warehouse/annotation/cache/util/redis/DefaultKeyGenerator.java
src/main/resources/static/index.html
src/main/resources/templates/error.html
src/main/resources/templates/home.html
src/main/resources/templates/login.html
--- a/config/application.yml
查看文件 @8ea5484
+++ b/config/application.yml
查看文件 @8ea5484
@@ -10,7 +10,7 @@ spring:
   devtools:
     add-properties: false
   profiles:
-    active: dev
+    active: prd
   mvc:
     #静态资源，设置上传文件的访问，
     static-path-pattern: /**
@@ -51,7 +51,7 @@ spring:
         enabled: true
   datasource:
-        type: com.alibaba.druid.pool.DruidDataSource
+        type: com.zaxxer.hikari.HikariDataSource
         #oracle
         #driver-class-name=oracle.jdbc.OracleDriver
         #url=jdbc:oracle:thin:@10.50.3.68:1521:CGODW
@@ -62,30 +62,26 @@ spring:
         username: 110
         password: QAHqCJf2kFYCLirM
         driver-class-name: com.mysql.cj.jdbc.Driver
-        #配置初始化大小/最小/最大
-        druid:
-          initial-size: 1
-          min-idle: 1
-          max-active: 20
-          #获取连接等待超时时间
-          max-wait: 60000
-          #一个连接在池中最小生存的时间
-          min-evictable-idle-time-millis: 300000
-          #间隔多久进行一次检测，检测需要关闭的空闲连接
-          time-between-eviction-runs-millis: 60000
-          #mysql
-          validation-query: SELECT 1 FROM DUAL
-          #oracle
-          #druid.validation-query:SELECT 'x' FROM DUAL
-          test-while-idle: true
-          test-on-borrow: false
-          test-on-return: false
-          default-auto-commit: true
-#        tomcat:
-#          max-wait: 10
-#          max-idle: 10000
-#          min-idle: 5
-#          initial-size: 5
+        # HikariCP特有配置
+        hikari:
+          # 连接池名称
+          pool-name: KakoUserHikariCP-
+          # 最小空闲连接数
+          minimum-idle: 1
+          # 最大连接数
+          maximum-pool-size: 20
+          # 连接超时时间(毫秒)
+          connection-timeout: 60000
+          # 空闲连接超时时间(毫秒)
+          idle-timeout: 300000
+          # 连接测试超时时间
+          validation-timeout: 3000
+          # 连接最大生命周期
+          max-lifetime: 1800000
+          # 连接测试查询
+          connection-test-query: SELECT 1
+          # 初始化连接数
+          initialization-fail-timeout: 1
 eureka:
   instance:
@@ -96,11 +92,7 @@ eureka:
     hostname: ${spring.cloud.client.ip-address}
     lease-renewal-interval-in-seconds: 15
     lease-expiration-duration-in-seconds: 45
-    health-check-url-path: /actuator/health
-    metadata-map:
-          user:
-            name: "admin"         #These two are needed so that the server
-            password: "123456"
+    health-check-url-path: /ac/health
   client:
     #eureka注册中心服务器地址
     service-url:
@@ -108,19 +100,27 @@ eureka:
       defaultZone: http://192.168.1.53:12345/eureka/
     registry-fetch-interval-seconds:  30
-
-
 management:
   endpoints:
     enabled-by-default: true
     web:
+      base-path: /ac  # 端点路径更改为 /ac
       exposure:
-        include: "*"
+        include: "health,info"  # 仅暴露必要端点
   endpoint:
     health:
-      show-details: always
+      show-details: never  # 不显示详细健康信息
     shutdown:
-      enabled: true
+      enabled: false  # 禁用关闭端点
+    env:
+      enabled: false  # 禁用环境端点（防止敏感信息泄露）
+    mappings:
+      enabled: false  # 禁用映射端点（防止接口路径泄露）
+    beans:
+      enabled: false  # 禁用beans端点
+    configprops:
+      enabled: false  # 禁用configprops端点
+
 mybatis:
   mapper-locations: classpath:mapping/*.xml
--- a/config/logback-dev.xml
查看文件 @8ea5484
+++ b/config/logback-dev.xml
查看文件 @8ea5484
@@ -184,7 +184,7 @@
     </springProfile>
     <!--生产环境:输出到文件-->
-    <springProfile name="pro">
+    <springProfile name="prd">
         <root level="info">
             <appender-ref ref="CONSOLE" />
             <appender-ref ref="DEBUG_FILE" />
--- a/pom.xml
查看文件 @8ea5484
+++ b/pom.xml
查看文件 @8ea5484
@@ -169,12 +169,6 @@
 			<version>${fastjson_version}</version>
 		</dependency>
 		<!-- tools-->
-		<!-- alibaba的druid数据库连接池 -->
-		<dependency>
-			<groupId>com.alibaba</groupId>
-			<artifactId>druid-spring-boot-starter</artifactId>
-			<version>1.1.9</version>
-		</dependency>
 		<!-- mysql-->
 		<dependency>
 			<groupId>mysql</groupId>
--- a/src/main/java/com/tianbo/warehouse/Swagger2.java
查看文件 @8ea5484
+++ b/src/main/java/com/tianbo/warehouse/Swagger2.java
查看文件 @8ea5484
@@ -2,6 +2,7 @@ package com.tianbo.warehouse;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Profile;
 import springfox.documentation.builders.ApiInfoBuilder;
 import springfox.documentation.builders.PathSelectors;
 import springfox.documentation.builders.RequestHandlerSelectors;
@@ -13,6 +14,7 @@ import springfox.documentation.swagger2.annotations.EnableSwagger2;
 @Configuration
 @EnableSwagger2
+@Profile({"dev", "test"})  // 只在dev和test环境启用
 public class Swagger2 {
     //swagger2的配置文件，这里可以配置swagger2的一些基本的内容，比如扫描的包等等
     @Bean
--- a/src/main/java/com/tianbo/warehouse/annotation/cache/util/redis/DefaultKeyGenerator.java
查看文件 @8ea5484
+++ b/src/main/java/com/tianbo/warehouse/annotation/cache/util/redis/DefaultKeyGenerator.java
查看文件 @8ea5484
 package com.tianbo.warehouse.annotation.cache.util.redis;
-import com.alibaba.druid.util.StringUtils;
+
 import lombok.extern.slf4j.Slf4j;
 import org.aspectj.lang.ProceedingJoinPoint;
@@ -10,6 +10,7 @@ import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.spel.standard.SpelExpressionParser;
 import org.springframework.expression.spel.support.StandardEvaluationContext;
 import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
 import java.util.Arrays;
--- a/src/main/resources/static/index.html
查看文件 @8ea5484
+++ b/src/main/resources/static/index.html
查看文件 @8ea5484
@@ -19,7 +19,7 @@
 <nav class="navbar navbar-inverse navbar-fixed-top">
     <div class="container">
         <div class="navbar-header">
-            <a class="navbar-brand" href="#">Spring Security演示</a>
+            <a class="navbar-brand" href="#">u have no rights</a>
         </div>
         <div id="navbar" class="collapse navbar-collapse">
             <ul class="nav navbar-nav">
--- a/src/main/resources/templates/error.html
查看文件 @8ea5484
+++ b/src/main/resources/templates/error.html
查看文件 @8ea5484
@@ -19,7 +19,7 @@
 <nav class="navbar navbar-inverse navbar-fixed-top">
     <div class="container">
         <div class="navbar-header">
-            <a class="navbar-brand" href="#">Spring Security演示</a>
+            <a class="navbar-brand" href="#">user center</a>
         </div>
         <div id="navbar" class="collapse navbar-collapse">
             <ul class="nav navbar-nav">
--- a/src/main/resources/templates/home.html
查看文件 @8ea5484
+++ b/src/main/resources/templates/home.html
查看文件 @8ea5484
@@ -19,7 +19,7 @@
 <nav class="navbar navbar-inverse navbar-fixed-top">
     <div class="container">
         <div class="navbar-header">
-            <a class="navbar-brand" href="#">Spring Security演示</a>
+            <a class="navbar-brand" href="#">user center</a>
         </div>
         <div id="navbar" class="collapse navbar-collapse">
             <ul class="nav navbar-nav">
--- a/src/main/resources/templates/login.html
查看文件 @8ea5484
+++ b/src/main/resources/templates/login.html
查看文件 @8ea5484
@@ -19,7 +19,7 @@
 <nav class="navbar navbar-inverse navbar-fixed-top">
     <div class="container">
         <div class="navbar-header">
-            <a class="navbar-brand" href="#">Spring Security演示</a>
+            <a class="navbar-brand" href="#">user center</a>
         </div>
         <div id="navbar" class="collapse navbar-collapse">
             <ul class="nav navbar-nav">