【问题】现docker镜像部署时，由于数据库文件surveyking.mv.db在根目录，无法挂载至宿主机 【方法】建议镜像内文件部署在surveyking子文件夹下，例如/surveyking/config，/surveyking/db，/surveyking/file，/surveyking/logs等，统一规范方便目录挂载

there is a Expression Language Injection risk.Expression Language (EL) Injection happens when attacker controlled data enters an EL interpreter. the code is: if (request.getSettingKey() != null) { // 实现单个设置的更新 ProjectSetting setting = getById(request.getId()).getSetting(); spelParser.parseExpression(request.getSettingKey()).setValue(setting, request.getSettingValue()); project.setSetting(setting); // 同步更新项目状态 if ("status".equals(request.getSettingKey())) { project.setStatus((Integer) request.getSettingValue()); }

以master更新到May 22, 2022的代码为准，在问卷配置为"需要登录"、“允许修改答案”时，修改答案不生效，排查代码发现两个问题 SurveyServiceImpl.java中

• 问题一

private String validateAndGetLatestAnswer(ProjectView project) {
		ProjectSetting setting = project.getSetting();
		boolean needGetLatest = false;
		...
		if (needGetLatest) {
			AnswerQuery answerQuery = new AnswerQuery();
			answerQuery.setProjectId(project.getId());
			answerQuery.setLatest(true);
			AnswerView latestAnswer = answerService.getAnswer(answerQuery);
			if (latestAnswer != null) {
				// @here 此处返回一直为null，是否应该调整为return latestAnswer.getId();
				return answerQuery.getId();
			}
		}
		return null;
	}

• 问题二

public PublicAnswerView saveAnswer(AnswerRequest answer, HttpServletRequest request) {
		...

		String answerId;
		if (isBlank(answer.getId())) {
			// @here 新增公开查询文档功能后，此处没有处理好，允许修改答案时answer.getId()有值，无法进入这里
			// 问卷允许修改答案开关修改答案
			answerId = validateAndGetLatestAnswer(project);
		}
		else {
			// 公开查询修改答案
			answerId = answer.getId();
			validateAndMergeAnswer(project, answer);
		}
		...
	}

Version：v0.2.0 First, log in to the background normally and send query requests. Pay attention to cookies

Then click the exit login button. At this time, the back-end code does not delete the user's session, but just jumps to the login page. You can see that the requested data can still be obtained normally with the previous cookie. Then the attacker can log in to the system again with the help of the browser cache when the user exits.

Repair suggestion: when exiting the login, delete the user's session first, and then jump to the login page.

there is a blind sql injection in api /api/repo/pick. Use sqlmap can find it.

sqlmap identified the following injection point(s) with a total of 21258 HTTP(s) requests:

Parameter: JSON #4* ((custom) POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: [{"id":"Axd_JDOJc_","repoId":"1585481117291630593","types":["Radio"],"tags":["简单') AND 7642=7642 AND ('TlAO'='TlAO"],"questionsNum":2,"examScore":1}]

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: [{"id":"Axd_JDOJc_","repoId":"1585481117291630593","types":["Radio"],"tags":["简单') AND (SELECT 8522 FROM (SELECT(SLEEP(5)))cRCX) AND ('AezM'='AezM"],"questionsNum":2,"examScore":1}]

the code is cn.surveyking.server.impl.ProjectServiceImpl#listProject

cPage<Project> page = pageByQuery(query, Wrappers.<Project>lambdaQuery() .like(isNotBlank(query.getName()), Project::getName, query.getName()) .eq(isNotBlank(query.getParentId()), Project::getParentId, query.getParentId()) // 父id为空或者为 0 表示一级目录 .and(isBlank(query.getParentId()), c -> c.isNull(Project::getParentId).or().eq(Project::getParentId, "0")) .eq(query.getMode() != null, Project::getMode, query.getMode()) .exists(String.format( "SELECT 1 FROM t_project_partner t WHERE t.type in (1, 2) AND t.user_id = '%s' AND t.project_id = t_project.id", SecurityContextUtils.getUserId())) .orderByAsc(Project::getPriority, Project::getCreateAt)); PaginationResponse<ProjectView> result = new PaginationResponse<>(page.getTotal(),