Merge branch 'master' of http://git.iamberry.com/hexiugang/iamberry-common-parent

iamberry-common-tool/src/main/java/com/iamberry/wechat/tools/GetWxOrderno.java

@@ -23,25 +23,14 @@ public class GetWxOrderno {
    */
   public static Object getPayNo(String url,String xmlParam){
 	try {
-		
-
-System.out.println("getPayNo start....");
-		
 		String jsonStr = HttpClient431Util.doPostContent(xmlParam, "application/json", url);
 		//判断
-	    if(jsonStr.indexOf("FAIL")!=-1){
-	    	WxPrepayIdErrorResult errorResult = (WxPrepayIdErrorResult) MessageUtil.xmlToBean(jsonStr, WxPrepayIdErrorResult.class);
-	    	
-System.out.println("getPayNo errorResult...." + jsonStr);
-	    	
-	    	return errorResult;
+		assert jsonStr != null;
+		if(jsonStr.contains("FAIL")){
+			return (WxPrepayIdErrorResult) MessageUtil.xmlToBean(jsonStr, WxPrepayIdErrorResult.class);
 	    }
 	    Map map = doXMLParse(jsonStr);
-	    String prepay_id  = (String) map.get("prepay_id");
-
-System.out.println("getPayNo end....");
-	    
-	    return prepay_id;
+		return (String) map.get("prepay_id");
 	} catch (Exception e1) {
 		// TODO Auto-generated catch block
 		e1.printStackTrace();
@@ -136,6 +125,14 @@ System.out.println("getPayNo end....");
 		Map m = new HashMap();
 		InputStream in = String2Inputstream(strxml);
 		SAXBuilder builder = new SAXBuilder();
+
+
+		// 防止XXE
+		builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+		builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
+		builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+		builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
 		Document doc = builder.build(in);
 		Element root = doc.getRootElement();
 		List list = root.getChildren();

iamberry-wechat-web/src/main/java/com/iamberry/wechat/handles/pay/ResponseWechatPayHandler.java

@@ -287,6 +287,13 @@ public class ResponseWechatPayHandler {
 			InputSource source = new InputSource(read);
 			// 创建一个新的SAXBuilder
 			SAXBuilder sb = new SAXBuilder();
+
+			// 防止XXE
+			sb.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+			sb.setFeature("http://xml.org/sax/features/external-general-entities", false);
+			sb.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+			sb.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
 			// 通过输入源构造一个Document
 			Document doc = (Document) sb.build(source);
 			Element root = doc.getRootElement();// 指向根节点

watero-common-tool/src/main/java/com/iamberry/wechat/tools/GetWxOrderno.java

@@ -16,7 +16,7 @@ import org.jdom.input.SAXBuilder;
 
 public class GetWxOrderno {
 
-    private static final Logger log = Logger.getLogger(GetWxOrderno.class);
+	private static final Logger log = Logger.getLogger(GetWxOrderno.class);
 	/**
 	 * description:获取预支付id
 	 */
@@ -41,7 +41,7 @@ public class GetWxOrderno {
 
 	/**
 	 * description:获取扫码支付连接
-	 * 
+	 *
 	 * @param url
 	 * @param xmlParam
 	 * @return
@@ -66,7 +66,7 @@ public class GetWxOrderno {
 
 	/**
 	 * 解析xml,返回第一级元素键值对。
-	 * 
+	 *
 	 * @param strxml
 	 * @return
 	 * @throws JDOMException
@@ -81,6 +81,13 @@ public class GetWxOrderno {
 		Map<String, String> m = new HashMap<String, String>();
 		InputStream in = string2Inputstream(strxml);
 		SAXBuilder builder = new SAXBuilder();
+
+		// 防止XXE
+		builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+		builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
+		builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+		builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
 		Document doc = builder.build(in);
 		Element root = doc.getRootElement();
 		List<Element> list = root.getChildren();
@@ -107,7 +114,7 @@ public class GetWxOrderno {
 
 	/**
 	 * 获取子结点的xml
-	 * 
+	 *
 	 * @param children
 	 * @return String
 	 */
@@ -137,4 +144,4 @@ public class GetWxOrderno {
 		return new ByteArrayInputStream(str.getBytes());
 	}
 
-}
+}

watero-wechat-web/src/main/java/com/iamberry/wechat/handles/pay/ResponseWechatPayHandler.java

@@ -14,6 +14,7 @@ import java.util.UUID;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.xml.parsers.DocumentBuilderFactory;
 
 import com.iamberry.wechat.core.entity.rent.ReserveOrder;
 import com.iamberry.wechat.face.reserve.ReserveService;
@@ -282,6 +283,13 @@ public class ResponseWechatPayHandler {
 			InputSource source = new InputSource(read);
 			// 创建一个新的SAXBuilder
 			SAXBuilder sb = new SAXBuilder();
+			// 防止XXE
+			sb.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+			sb.setFeature("http://xml.org/sax/features/external-general-entities", false);
+			sb.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+			sb.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
+
 			// 通过输入源构造一个Document
 			Document doc = (Document) sb.build(source);
 			Element root = doc.getRootElement();// 指向根节点