中危.4.API误用:不安全的框架绑定,缺陷32

whycxzp

2023-10-27 ab28b2ba992f95aa5461de48c1c94f70bd358ae6

 src/main/java/com/whyc/controller/UserController.java

@@ -135,11 +135,12 @@
    public Response checkUserPasswordOfREA(@RequestParam String pwd){
        UserInf userInf = ActionUtil.getUser();
        String passwordEncrypt = null;
        try {
        /*try {
            passwordEncrypt = URLDecoder.decode(pwd, "utf-8");
        }catch (UnsupportedEncodingException e){
            e.printStackTrace();
        }
        }*/
        passwordEncrypt = pwd;
        String password = RSAUtil.decryptFront(passwordEncrypt, RSAUtil.fontSeparator)[0];
        String passwordDB = RSAUtil.decrypt(userInf.getUpassword(),RSAUtil.getPrivateKey());
        if(passwordDB.equals(password)){