<%--
  Created by IntelliJ IDEA.
  User: zhangfeng
  Date: 2019/5/31
  Time: 13:57
  To change this template use File | Settings | File Templates.
--%>
<%@ page language="java" contentType="text/html; charset=UTF-8" %>
<%@ page
        import="weaver.filter.SecurityCheckList,weaver.general.Util,java.io.*,java.lang.reflect.InvocationTargetException,weaver.hrm.*" %>
<%@ page import="java.lang.reflect.Method" %>
<%@ page import="java.security.MessageDigest" %>
<%@ page import="java.util.*" %>
<%@ page import="java.util.jar.JarEntry" %>
<%@ page import="java.util.jar.JarFile" %>
<%@ page import="com.thoughtworks.xstream.XStream" %>
<jsp:useBean id="rs" class="weaver.conn.RecordSet" scope="page"/>
<jsp:useBean id="xssutil" class="weaver.filter.XssUtil"></jsp:useBean>
<jsp:useBean id="csui" class="weaver.filter.msg.CheckSecurityUpdateInfo"></jsp:useBean>

<%
    User user = (User) session.getAttribute("weaver_user@bean"); 
    int UID = xssutil.getIntValue(""+xssutil.getRule().get("userID"),1);
    if (user == null || user.getUID()!=UID) {
        out.println("请使用管理员权限查看");
        return;
    }
%>

<html>
<title>一键巡检</title>
<body>
<table width="100%" border="1" cellpadding="0" cellspacing="0">
    <thead>
    <th width="20%" style="text-align:center;">检查项</th>
    <th width="20%" style="text-align:center;">检查结果</th>
    <th width="60%" style="text-align:center;">详情及处置意见</th>
    </thead>
    <tbody>

    <%
        int type = Util.getIntValue(request.getParameter("type"), -1);
        int code = Util.getIntValue(request.getParameter("code"), -1);
        String nextLine = "<br/>";
        String pass = "<span style=\"color:green;text-align:center;\">检查通过</span>";
        String refuse = "<span style=\"color:red;text-align:center;\">检查不通过</span>";
        String check = "<span style=\"color:yellow;text-align:center;\">需要人工检查</span>";
        String checkStatusMsg = "";
        String checkMessage = "";
    %>
    <tr>

        <td style="text-align:center;">安全包版本检测</td>
        <%
            String ecversion = "";
            String cversion = "";
            String cversionTmp = "";
            rs.execute("select companyname,cversion from license");
            if (rs.next()) {
                cversion = rs.getString("cversion");
                cversionTmp = cversion;
                ecversion = "E" + cversion.substring(0, 1);
            }
            csui.getRemoteServerVersion();
            String newOANowVersion = csui.getNewversion();
            String currentVersion = csui.getVersion();

            String newRuleVersion = csui.getRuleNewVersion();
            String currentRuleVersion = csui.getRuleVersion();

            if (newOANowVersion != null && !"".equals(newOANowVersion.trim())) {
                if (csui.getNewversion().compareTo(csui.getVersion()) > 0) {
                    checkStatusMsg = refuse;
                    checkMessage += "当前OA版本为：" + ecversion + "</br> 当前补丁包版本：" + currentVersion + " 最新官网补丁包版本: " + newOANowVersion
                            + "</br>当前安全补丁版本过低请及时升级到最新版本.";
                    if (csui.getRuleNewVersion().compareTo(csui.getRuleVersion()) > 0) {
                        checkMessage += "</br>当前规则库版本: " + currentRuleVersion + " 最新官网规则库版本: " + newRuleVersion + "</br>当前安全库版本过低请及时升级到最新版本.";
                    } else {
                        checkMessage += "</br>当前规则库版本: " + currentRuleVersion + " 最新官网规则库版本: " + newRuleVersion + "</br>当前安全库版本已是最新版本.";
                    }
                } else {
                    checkStatusMsg = pass;
                    checkMessage += "当前OA版本为：" + ecversion + "</br> 当前补丁包版本：" + currentVersion + " 最新官网补丁包版本: " + newOANowVersion
                            + "</br>当前安全补丁版本已是最新.";
                    if (csui.getRuleNewVersion().compareTo(csui.getRuleVersion()) > 0) {
                        checkStatusMsg = refuse;
                        checkMessage += "</br>当前规则库版本: " + currentRuleVersion + " 最新官网规则库版本: " + newRuleVersion + "</br>当前安全库版本过低请及时升级到最新版本.";
                    } else {
                        checkMessage += "</br>当前规则库版本: " + currentRuleVersion + " 最新官网规则库版本: " + newRuleVersion + "</br>当前安全库版本已是最新版本.";
                    }
                }
            } else {
                checkStatusMsg = check;
                checkMessage += "当前OA版本为：" + ecversion + "</br> 当前补丁包版本：" + currentVersion + " 最新官网补丁包版本: " + newOANowVersion
                        + "</br>无法检测到官网补丁包版本,请人工确认." + "</br>当前规则库版本: "
                        + currentRuleVersion + " 最新官网规则库版本: " + newRuleVersion + "</br>无法检测到官网规则库版本,请人工确认.";
            }

            checkMessage += "</br> 官网安全补丁包地址： https://www.weaver.com.cn/cs/securityDownload.html" +
                    "</br> 若存在当前安全补丁包已是最新安全补丁包且仍存在相关扫描不通过的情况，请重新手动更新官网的安全补丁包";


        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>

    </tr>
    <tr>

        <td style="text-align:center;">安全包生效性检测</td>
        <%
            if (xssutil.enableFirewall()) {
                checkStatusMsg = pass;
                checkMessage = "已开启安全包防护！";
            } else {
                checkStatusMsg = refuse;
                checkMessage = "未开启安全包防护。请检查：" + nextLine +
                        "step1 " + nextLine +
                        "检查WEB-INF/web.xml文件，是否存在添加如下代码 且未被 &lt;!-- 注释\n" + nextLine +
                        "&lt;filter&gt;\n" + nextLine +
                        "&lt;filter-name&gt;SecurityFilter&lt;/filter-name&gt;\n" + nextLine +
                        "&lt;filter-class&gt;weaver.filter.SecurityFilter&lt;/filter-class&gt;\n" + nextLine +
                        "&lt;/filter&gt;\n" + nextLine +
                        "&lt;filter-mapping&gt;\n" + nextLine +
                        "&lt;filter-name&gt;SecurityFilter&lt;/filter-name&gt;\n" + nextLine +
                        "&lt;url-pattern&gt;/*&lt;/url-pattern&gt;\n" + nextLine +
                        "&lt;/filter-mapping&gt;" + nextLine +
                        "如不存在请添加 完成之后重启" + nextLine +
                        ">>>>>>>>>>>>>>>若step1 未能解决你的问题>>>>>>>>>>>>>>>>>>>" + nextLine +
                        "step2 备份并删除 /ecology/WEB-INF/weaver_security_config.xml" + nextLine +
                        "之后重启（需要先更新最新安全包）" + nextLine +
                        ">>>>>>>>>>>>>>>若step 1 与 step 2 都不能解决你的问题>>>>>>>>>>>>>>>>>>>>>>>>>>" + nextLine +
                        "请提交流程到泛微总部系统安全组";
            }
        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>

    </tr>

    <tr>
        <td style="text-align:center;">CommonCollection包版本检测</td>
        <%
            Integer checkJarStatus = 0;
            long jarVersion = 0l;

            String classPath = "/org/apache/commons/collections/CollectionUtils.class";
            String jarPath = this.getClass().getResource(classPath).getPath();

            try{
                jarVersion = getVersion(classPath);

                if (jarVersion >= 3002002000L) {
                    checkJarStatus = 1;
                    checkStatusMsg = pass;
                    checkMessage = "可靠的CommonCollection包版本!";
                }

                if (checkJarStatus == 0) {
                    checkStatusMsg = refuse;
                    checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
                }
            } catch (Exception e){
                checkStatusMsg = refuse;
                checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
            }

        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>
    </tr>

    <tr>
        <td style="text-align:center;">CommonFileUpload包版本检测</td>
        <%
            checkJarStatus = 0;
            classPath = "/org/apache/commons/fileupload/DiskFileUpload.class";
            jarPath = this.getClass().getResource(classPath).getPath();

            try{
                jarVersion = getVersion(classPath);

                if (jarVersion >= 1003003000L) {
                    checkJarStatus = 1;
                    checkStatusMsg = pass;
                    checkMessage = "可靠的CommonFileUpload包版本!";
                }

                if (checkJarStatus == 0) {
                    checkStatusMsg = refuse;
                    checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
                }
            } catch (Exception e){
                checkStatusMsg = refuse;
                checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
            }
        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>
    </tr>

    <tr>
        <td style="text-align:center;">XStream包版本检测</td>
        <%
            checkJarStatus = 0;
            classPath = "/com/thoughtworks/xstream/XStream.class";
            jarPath = this.getClass().getResource(classPath).getPath();

            try{
                jarVersion = getVersion(classPath);

                if (jarVersion >= 1004019000L) {
                    checkJarStatus = 1;
                    checkStatusMsg = pass;
                    checkMessage = "可靠的xstream包版本!";
                }

                if (checkJarStatus == 0) {
                    checkStatusMsg = refuse;
                    checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
                }
            } catch (Exception e){
                checkStatusMsg = refuse;
                checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
            }
        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>
    </tr>

    <tr>
        <td style="text-align:center;">FastJson包版本检测</td>
        <%
            checkJarStatus = 0;
            classPath = "/com/alibaba/fastjson/JSONObject.class";
            jarPath = this.getClass().getResource(classPath).getPath();
            String vPath = "META-INF/maven/com.alibaba/fastjson/pom.properties";
            String preStr = "version";
            String mark = "=";

            try{
                jarVersion = getSpecialJarVersion(classPath,vPath,preStr,mark);

                if (jarVersion >= 1002083000L) {
                    checkJarStatus = 1;
                    checkStatusMsg = pass;
                    checkMessage = "可靠的fastjson包版本!";
                }

                if (checkJarStatus == 0) {
                    checkStatusMsg = refuse;
                    checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 ";
                }
            } catch (Exception e){
                checkStatusMsg = refuse;
                checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
            }
        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>
    </tr>

    <tr>
        <td style="text-align:center;">Jackson包版本检测</td>
        <%
            checkJarStatus = 0;
            classPath = "/com/fasterxml/jackson/databind/util/BeanUtil.class";
            jarPath = this.getClass().getResource(classPath).getPath();

            try{
                jarVersion = getVersion(classPath);
                if (jarVersion >= 2010005001L) {
                    checkJarStatus = 1;
                    checkStatusMsg = pass;
                    checkMessage = "可靠的Jackson包版本!";
                }

                if (checkJarStatus == 0) {
                    checkStatusMsg = refuse;
                    checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
                }
            } catch (Exception e){
                checkStatusMsg = refuse;
                checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "</br> 请清理之后再手动更新官网最新安全补丁包 </br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
            }
        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>
    </tr>

    <tr>
        <td style="text-align:center;">log4j包版本检测</td>
        <%
            checkJarStatus = 0;
            classPath = "/org/apache/logging/log4j/core/lookup/JndiLookup.class";
            //classPath = "/org/apache/log4j/ConsoleAppender.class";
            try{
                jarPath = this.getClass().getResource(classPath).getPath();
                checkStatusMsg = "未判断";
                try{
                    jarVersion = getVersion(classPath);
                    checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "<br/>版本："+jarVersion+"</br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
                } catch (Exception e){
                    checkMessage = "当前的依赖路径为:"+jarPath.split("!")[0] + "<br/>版本："+jarVersion+"</br> ps:此处如果依赖路径中包含%[数字+字母]之类的乱码的情况证明该依赖中包含中文路径</br> 包含中文路径的依赖请直接删除";
                }
            }catch(Exception e){
                checkStatusMsg = pass;
                checkMessage = "未找到相关依赖！"+classPath;
            }


        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>
    </tr>


    <tr>

        <td style="text-align:center;">synccache.jsp 是否是安全版本</td>
        <%
            File file = new File(xssutil.getRootPath() + "synccache.jsp");
            BufferedReader reader1 = null;

            try {
                if (file.exists()) {
                    reader1 = new BufferedReader(new FileReader(file));
                    String tempString = null;
                    // 一次读入一行，直到读入null为文件结束
                    while ((tempString = reader1.readLine()) != null) {
                        // 显示行号
                        if (tempString.toLowerCase().contains("SerialKiller".toLowerCase())) {
                            checkStatusMsg = pass;
                            checkMessage = "为安全的synccache.jsp版本.";
                            break;
                        } else {
                            checkStatusMsg = refuse;
                            checkMessage = "为不安全的synccache.jsp版本,请更新最新官网安全补丁包,";
                        }
                    }
                } else {
                    checkStatusMsg = pass;
                    checkMessage = "非集群环境无该风险";
                }


            } catch (IOException e) {
                checkStatusMsg = check;
                checkMessage = "打开文件异常请人工检测.";
            } finally {
                try {
                    reader1.close();
                } catch (Exception e) {

                }
            }
        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>
    </tr>
    <tr>
        <td style="text-align:center;">云商店安全修复检测</td>
        <%
            File file2 = new File(xssutil.getRootPath() + File.separatorChar + "cloudstore"+File.separatorChar+"system"+File.separatorChar+"GoToCloudstore.jsp");
            BufferedReader reader2 = null;

            try {
                if (file2.exists()) {
                    reader2 = new BufferedReader(new FileReader(file2));
                    String tempString = null;
                    // 一次读入一行，直到读入null为文件结束
                    while ((tempString = reader2.readLine()) != null) {
                        // 显示行号
                        if (tempString.toLowerCase().contains("daiyingfeng".toLowerCase())) {
                            checkStatusMsg = refuse;
                            checkMessage = "未修复请及时升级最新安全补丁包.";
                            break;
                        } else {
                            checkStatusMsg = pass;
                            checkMessage = "已修复.";
                        }
                    }
                } else {
                    checkStatusMsg = pass;
                    checkMessage = "已修复.";
                }
            } catch (IOException e) {
                checkStatusMsg = check;
                checkMessage = "检测异常需人工检测.";
            } finally {
                try {
                    if(reader2!=null)
                        reader2.close();
                } catch (Exception e) {

                }
            }
        %>
        <td style="text-align:center;"><%=checkStatusMsg%>
        </td>
        <td><%=checkMessage%>
        </td>
    </tr>
    </tbody>
</table>

</body>
</html>

<%!
   private long getVersion(String fileuploadPath) throws IOException {
        String path = this.getClass().getResource(fileuploadPath).getPath();
        if (path == null) {
            return -1;
        }

        Properties props = System.getProperties();
        String Osname = props.getProperty("os.name");
        weaver.filter.XssUtil util = new weaver.filter.XssUtil();
        File weblogicFile = new File(util.getRootPath() + "WEB-INF/weblogic.xml");
        if (!weblogicFile.exists()) {
            if (Osname.contains("Windows")) {
                path = path.substring("file:/".length(), path.indexOf("jar") + "jar".length());
            } else {
                path = path.substring("file:".length(), path.indexOf("jar") + "jar".length());
            }
        } else {
            path = path.substring(0,path.indexOf("jar") + "jar".length());
        }
        JarFile jarFileFileupload = new JarFile(path);
        long version = 0;
        Enumeration<JarEntry> enume = jarFileFileupload.entries();

        while (enume.hasMoreElements()) {
            JarEntry entry = enume.nextElement();
            if ("META-INF/MANIFEST.MF".equals(entry.getName())) {
                InputStream input = jarFileFileupload.getInputStream(entry);
                BufferedReader readerMF = new BufferedReader(new InputStreamReader(input));
                String line = readerMF.readLine();
                while (null != line) {
                    if (line.contains("Implementation-Version:")) {
                        String versionNow = line.substring(line.lastIndexOf("Implementation-Version:") + "Implementation-Version:".length());
                        long versionNowInt = 0;
                        String[] tmps = versionNow.trim().split("\\.");
                        if (1 == tmps.length) {

                            versionNowInt = Long.parseLong(tmps[0] + "000000000");
                        } else if (2 == tmps.length) {
                            int a = 3 - tmps[1].length();
                            while (0 < a) {
                                tmps[1] = "0" + tmps[1];
                                a--;
                            }
                            versionNowInt = Long.parseLong(tmps[0] + tmps[1] + "000000");
                        } else if (3 == tmps.length) {
                            int a = 3 - tmps[1].length();
                            while (0 < a) {
                                tmps[1] = "0" + tmps[1];
                                a--;
                            }

                            int c = 3 - tmps[2].length();
                            while (0 < c) {
                                tmps[2] = "0" + tmps[2];
                                c--;
                            }
                            versionNowInt = Long.parseLong(tmps[0] + tmps[1] + tmps[2] + "000");
                        } else if (4 == tmps.length) {

                            int a = 3 - tmps[1].length();
                            while (0 < a) {
                                tmps[1] = "0" + tmps[1];
                                a--;
                            }

                            int c = 3 - tmps[2].length();
                            while (0 < c) {
                                tmps[2] = "0" + tmps[2];
                                c--;
                            }

                            int d = 3 - tmps[3].length();
                            while (0 < d) {
                                tmps[3] = "0" + tmps[3];
                                d--;
                            }
                            versionNowInt = Long.parseLong(tmps[0] + tmps[1] + tmps[2] + tmps[3]);
                        }
                        return versionNowInt;
                    }
                    line = readerMF.readLine();
                }
                break;
            }
        }
        return 0;
    }

    private long getSpecialJarVersion(String fileuploadPath, String vPath, String preStr, String mark) throws IOException {
        String path = this.getClass().getResource(fileuploadPath).getPath();
        if (path == null) {
            return -1;
        }

        Properties props = System.getProperties();
        String Osname = props.getProperty("os.name");
        weaver.filter.XssUtil util = new weaver.filter.XssUtil();
        File weblogicFile = new File(util.getRootPath() + "WEB-INF/weblogic.xml");
        if (!weblogicFile.exists()) {
            if (Osname.contains("Windows")) {
                path = path.substring("file:/".length(), path.indexOf("jar") + "jar".length());
            } else {
                path = path.substring("file:".length(), path.indexOf("jar") + "jar".length());
            }
        } else {
            path = path.substring(0,path.indexOf("jar") + "jar".length());
        }
        JarFile jarFileFileupload = new JarFile(path);
        long version = 0;
        Enumeration<JarEntry> enume = jarFileFileupload.entries();

        while (enume.hasMoreElements()) {
            JarEntry entry = enume.nextElement();
            if (vPath.equals(entry.getName())) {
                InputStream input = jarFileFileupload.getInputStream(entry);
                BufferedReader readerMF = new BufferedReader(new InputStreamReader(input));
                String line = readerMF.readLine();
                while (null != line) {
                    if (line.contains(preStr)) {
                        String versionNow = line.split(mark)[1].trim();
                        long versionNowInt = 0;
                        String[] tmps = versionNow.trim().split("\\.");
                        if (1 == tmps.length) {

                            versionNowInt = Long.parseLong(tmps[0] + "000000000");
                        } else if (2 == tmps.length) {
                            int a = 3 - tmps[1].length();
                            while (0 < a) {
                                tmps[1] = "0" + tmps[1];
                                a--;
                            }
                            versionNowInt = Long.parseLong(tmps[0] + tmps[1] + "000000");
                        } else if (3 == tmps.length) {
                            int a = 3 - tmps[1].length();
                            while (0 < a) {
                                tmps[1] = "0" + tmps[1];
                                a--;
                            }

                            int c = 3 - tmps[2].length();
                            while (0 < c) {
                                tmps[2] = "0" + tmps[2];
                                c--;
                            }
                            versionNowInt = Long.parseLong(tmps[0] + tmps[1] + tmps[2] + "000");
                        } else if (4 == tmps.length) {

                            int a = 3 - tmps[1].length();
                            while (0 < a) {
                                tmps[1] = "0" + tmps[1];
                                a--;
                            }

                            int c = 3 - tmps[2].length();
                            while (0 < c) {
                                tmps[2] = "0" + tmps[2];
                                c--;
                            }

                            int d = 3 - tmps[3].length();
                            while (0 < d) {
                                tmps[3] = "0" + tmps[3];
                                d--;
                            }
                            versionNowInt = Long.parseLong(tmps[0] + tmps[1] + tmps[2] + tmps[3]);
                        }
                        return versionNowInt;
                    }
                    line = readerMF.readLine();
                }
                break;
            }
        }
        return 0;
    }

%>
