halo-dev / halo

强大易用的开源建站工具。
https://www.halo.run
GNU General Public License v3.0
33.3k stars 9.61k forks source link

Make ApplicationContext inaccessible in ServerWebExchange #6679

Closed JohnNiang closed 22 hours ago

JohnNiang commented 1 day ago

What type of PR is this?

/kind improvement /area core /area plugin /milestone 2.20.x

What this PR does / why we need it:

Plugins can implement their own RouterFunctions and ControllerMappings, but those might expose root ApplicationContext for plugins, which is not expected.

So this PR fixes the insecure access to root ApplicationContext.

Does this PR introduce a user-facing change?

None
sonarcloud[bot] commented 1 day ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

codecov[bot] commented 1 day ago

Codecov Report

Attention: Patch coverage is 76.92308% with 3 lines in your changes missing coverage. Please review.

Project coverage is 58.13%. Comparing base (6cd8dc8) to head (fd2a4fb). Report is 80 commits behind head on main.

Files with missing lines Patch % Lines
...n/java/run/halo/app/infra/SecureServerRequest.java 66.66% 1 Missing :warning:
...va/run/halo/app/infra/SecureServerWebExchange.java 66.66% 1 Missing :warning:
.../run/halo/app/plugin/AggregatedRouterFunction.java 0.00% 1 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #6679 +/- ## ============================================ - Coverage 58.18% 58.13% -0.05% - Complexity 3774 3945 +171 ============================================ Files 651 678 +27 Lines 22125 23127 +1002 Branches 1538 1578 +40 ============================================ + Hits 12873 13446 +573 - Misses 8641 9061 +420 - Partials 611 620 +9 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

f2c-ci-robot[bot] commented 22 hours ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: guqing

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/halo-dev/halo/blob/main/OWNERS)~~ [guqing] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment