From f3fba4a2298c755a6552fb457ad16b769b02479f Mon Sep 17 00:00:00 2001
From: luoweijian <1329394916@qq.com>
Date: Fri, 7 Aug 2026 15:15:13 +0800
Subject: [PATCH] =?UTF-8?q?fix(dict):=20clear=20client-supplied=20audit=20?=
 =?UTF-8?q?fields=20in=20saveGroup/saveItem=20=E2=80=94=20prevent=20strict?=
 =?UTF-8?q?Fill=20bypass=20forgery?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

saveGroup/saveItem accepted entity params whose createTime/creatorId/updaterId
were not sanitized; MetaObjectFillHandler uses strictInsertFill/strictUpdateFill
which only fills null fields, so client-supplied audit values were retained.
Now: null out all audit fields on entry (framework refills), restore
createTime/creatorId from exist on edit.
---
 .../com/crm/dict/service/impl/DictGroupServiceImpl.java  | 9 +++++++++
 .../com/crm/dict/service/impl/DictItemServiceImpl.java   | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/crm-dict/src/main/java/com/crm/dict/service/impl/DictGroupServiceImpl.java b/crm-dict/src/main/java/com/crm/dict/service/impl/DictGroupServiceImpl.java
index e431842..8144740 100644
--- a/crm-dict/src/main/java/com/crm/dict/service/impl/DictGroupServiceImpl.java
+++ b/crm-dict/src/main/java/com/crm/dict/service/impl/DictGroupServiceImpl.java
@@ -69,6 +69,12 @@ public class DictGroupServiceImpl extends BaseServiceImpl<DictGroupMapper, DictG
         if (group == null) {
             throw new BusinessErrorException(DictConstants.CODE_DICT_INVALID, "请求参数缺失");
         }
+        // 审计字段由框架 strictInsertFill/strictUpdateFill 自动填充（仅 null 时填充），
+        // 客户端传入的审计值不可信且会被保留，统一清空防止伪造
+        group.setCreateTime(null);
+        group.setUpdateTime(null);
+        group.setCreatorId(null);
+        group.setUpdaterId(null);
         if (StrUtil.isBlank(group.getName())) {
             throw new BusinessErrorException(DictConstants.CODE_DICT_INVALID, "分组名称不能为空");
         }
@@ -100,6 +106,9 @@ public class DictGroupServiceImpl extends BaseServiceImpl<DictGroupMapper, DictG
             group.setStatus(exist.getStatus());
             group.setBuiltin(exist.getBuiltin());
             group.setDeleteKey(exist.getDeleteKey());
+            // 保留原始创建审计；updateTime/updaterId 保持 null 由 strictUpdateFill 填充
+            group.setCreateTime(exist.getCreateTime());
+            group.setCreatorId(exist.getCreatorId());
             this.updateById(group);
         }
     }
diff --git a/crm-dict/src/main/java/com/crm/dict/service/impl/DictItemServiceImpl.java b/crm-dict/src/main/java/com/crm/dict/service/impl/DictItemServiceImpl.java
index 7b11513..13e9a5a 100644
--- a/crm-dict/src/main/java/com/crm/dict/service/impl/DictItemServiceImpl.java
+++ b/crm-dict/src/main/java/com/crm/dict/service/impl/DictItemServiceImpl.java
@@ -79,6 +79,12 @@ public class DictItemServiceImpl extends BaseServiceImpl<DictItemMapper, DictIte
         if (item == null) {
             throw new BusinessErrorException(DictConstants.CODE_DICT_INVALID, "请求参数缺失");
         }
+        // 审计字段由框架 strictInsertFill/strictUpdateFill 自动填充（仅 null 时填充），
+        // 客户端传入的审计值不可信且会被保留，统一清空防止伪造
+        item.setCreateTime(null);
+        item.setUpdateTime(null);
+        item.setCreatorId(null);
+        item.setUpdaterId(null);
         if (item.getGroupId() == null) {
             if (item.getId() == null) {
                 throw new BusinessErrorException(DictConstants.CODE_DICT_INVALID, "请选择所属分组");
@@ -145,6 +151,9 @@ public class DictItemServiceImpl extends BaseServiceImpl<DictItemMapper, DictIte
             item.setBuiltin(exist.getBuiltin());
             item.setStatus(exist.getStatus());
             item.setDeleteKey(exist.getDeleteKey());
+            // 保留原始创建审计；updateTime/updaterId 保持 null 由 strictUpdateFill 填充
+            item.setCreateTime(exist.getCreateTime());
+            item.setCreatorId(exist.getCreatorId());
             checkValueMutable(exist, item.getValue());
             checkItemValueUnique(exist.getGroupId(), item.getValue(), exist.getId());
             this.updateById(item);