Skip to content

Commit 34c675a

Browse files
JeffreySuJeffreySu
committed
WebApi v0.2.5.7 提供禁止外部访问配置
1 parent c136aac commit 34c675a

File tree

7 files changed

+117
-12
lines changed

7 files changed

+117
-12
lines changed

‎src/Senparc.CO2NET.WebApi/ActionFilters/ForbiddenExternalAccessAsyncFilter.cs‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
using Microsoft.AspNetCore.Mvc.Filters;
2+
using Senparc.CO2NET.WebApi.Exceptions;
3+
using System;
4+
using System.Collections.Generic;
5+
using System.Text;
6+
using System.Threading.Tasks;
7+
using Microsoft.AspNetCore.Http;
8+
9+
namespace Senparc.CO2NET.WebApi.ActionFilters
10+
{
11+
/// <summary>
12+
/// 外部访问屏蔽特性
13+
/// </summary>
14+
public class ForbiddenExternalAccessAsyncFilter : IAsyncActionFilter
15+
{
16+
private readonly bool _forbiddenExternalAccess;
17+
18+
public ForbiddenExternalAccessAsyncFilter()
19+
{
20+
_forbiddenExternalAccess = Register.ForbiddenExternalAccess;
21+
}
22+
23+
public ForbiddenExternalAccessAsyncFilter(bool forbiddenExternalAccess)
24+
{
25+
this._forbiddenExternalAccess = forbiddenExternalAccess;
26+
}
27+
28+
public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
29+
{
30+
if (!_forbiddenExternalAccess && context.HttpContext.Request.IsLocal())
31+
{
32+
throw new ForbiddenExternalAccessException();
33+
}
34+
await next();
35+
}
36+
}
37+
38+
// 二选一
39+
40+
//public class ForbiddenExternalAccessFilter : IActionFilter
41+
//{
42+
// public void OnActionExecuted(ActionExecutedContext context)
43+
// {
44+
// if (!Register.ForbiddenExternalAccess && context.HttpContext.Request.IsLocal())
45+
// {
46+
// throw new ForbiddenExternalAccessException();
47+
// }
48+
// }
49+
50+
// public void OnActionExecuting(ActionExecutingContext context)
51+
// {
52+
// if (!Register.ForbiddenExternalAccess && context.HttpContext.Request.IsLocal())
53+
// {
54+
// throw new ForbiddenExternalAccessException();
55+
// }
56+
// }
57+
//}
58+
}

‎src/Senparc.CO2NET.WebApi/ActionFilters/ForbiddenExternalAccessFilter.cs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
using Microsoft.AspNetCore.Http;
2+
using Microsoft.AspNetCore.Mvc.Filters;
3+
using Senparc.CO2NET.WebApi.Exceptions;
4+
5+
namespace Senparc.CO2NET.WebApi.ActionFilters
6+
{
7+
8+
}

‎src/Senparc.CO2NET.WebApi/Exceptions/ForbiddenExternalAccessException.cs‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
using Senparc.CO2NET.Exceptions;
2+
using System;
3+
using System.Collections.Generic;
4+
using System.Text;
5+
6+
namespace Senparc.CO2NET.WebApi.Exceptions
7+
{
8+
/// <summary>
9+
/// 禁止外部访问
10+
/// </summary>
11+
public class ForbiddenExternalAccessException : BaseException
12+
{
13+
public ForbiddenExternalAccessException(string message = "WebApiEngine 已禁止外部访问", bool logged = false) : base(message, logged)
14+
{
15+
}
16+
17+
}
18+
}

‎src/Senparc.CO2NET.WebApi/Register.cs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,11 @@ public static class Register
4444
/// </summary>
4545
public static Dictionary<Type, string> AdditionalClasses = new Dictionary<Type, string>();
4646

47+
/// <summary>
48+
/// 是否禁止外部访问
49+
/// </summary>
50+
public static bool ForbiddenExternalAccess = false;
51+
4752
/// <summary>
4853
/// RegisterApiBind 执行锁
4954
/// </summary>

‎src/Senparc.CO2NET.WebApi/Senparc.CO2NET.WebApi.csproj‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
33
<TargetFrameworks>netcoreapp3.1;net5.0;net6.0</TargetFrameworks>
4-
<Version>0.2.5.6-preview3</Version>
4+
<Version>0.2.5.8-preview3</Version>
55
<LangVersion>latest</LangVersion>
66
<AssemblyName>Senparc.CO2NET.WebApi</AssemblyName>
77
<RootNamespace>Senparc.CO2NET.WebApi</RootNamespace>
@@ -27,6 +27,7 @@
2727
v0.2.3 完成 WebApiEngine 第二代核心版本，全面支持动态 API 集成和集成和对应 XML 生成
2828
v0.2.4 添加可额外注入的类或方法
2929
v0.2.5 优化异步线程执行
30+
v0.2.5.7 添加 ForbiddenExternalAccess 参数，设置是否允许外部访问
3031
</PackageReleaseNotes>
3132
</PropertyGroup>
3233
<PropertyGroup Condition=" '$(Configuration)' == 'Release' ">
@@ -56,6 +57,7 @@
5657
<PackageReference Include="Swashbuckle.AspNetCore.Annotations" Version="6.1.4" />
5758
</ItemGroup>
5859
<ItemGroup>
60+
<ProjectReference Include="..\Senparc.CO2NET.AspNet\Senparc.CO2NET.AspNet.csproj" />
5961
<ProjectReference Include="..\Senparc.CO2NET\Senparc.CO2NET.csproj" />
6062
</ItemGroup>
6163
</Project>

‎src/Senparc.CO2NET.WebApi/WebApiEngines/WebApiEngine.cs‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
----------------------------------------------------------------*/
1111

1212
using Microsoft.AspNetCore.Mvc;
13+
using Senparc.CO2NET.WebApi.ActionFilters;
1314
using Swashbuckle.AspNetCore.Annotations;
1415
using System;
1516
using System.Collections.Concurrent;
@@ -62,15 +63,17 @@ public partial class WebApiEngine
6263
/// <param name="showDetailApiLog"></param>
6364
/// <param name="copyCustomAttributes"></param>
6465
/// <param name="defaultAction">默认请求类型，如 Post，Get</param>
65-
public WebApiEngine(string docXmlPath, ApiRequestMethod defaultRequestMethod = ApiRequestMethod.Post, Type baseApiControllerType = null, bool copyCustomAttributes = true, int taskCount = 4, bool showDetailApiLog = false)
66+
/// <param name="forbiddenExternalAccess">是否允许外部访问，默认为 false，只允许本机访问相关 API</param>
67+
public WebApiEngine(string docXmlPath, ApiRequestMethod defaultRequestMethod = ApiRequestMethod.Post, Type baseApiControllerType = null, bool copyCustomAttributes = true, int taskCount = 4, bool showDetailApiLog = false, bool forbiddenExternalAccess = true)
6668
{
6769
_docXmlPath = docXmlPath;
6870
_findWeixinApiService = new Lazy<FindApiService>(new FindApiService());
6971
_defaultRequestMethod = defaultRequestMethod;
72+
_baseApiControllerType = baseApiControllerType ?? typeof(ControllerBase);
7073
_copyCustomAttributes = copyCustomAttributes;
7174
_taskCount = taskCount;
7275
_showDetailApiLog = showDetailApiLog;
73-
_baseApiControllerType = baseApiControllerType ?? typeof(ControllerBase);
76+
Register.ForbiddenExternalAccess = forbiddenExternalAccess;
7477
}
7578

7679
/// <summary>
@@ -587,6 +590,16 @@ IEnumerable<DropIndex> drop_indexes
587590
var t2 = typeof(RouteAttribute);
588591
tb.SetCustomAttribute(new CustomAttributeBuilder(t2.GetConstructor(new Type[] { typeof(string) }), new object[] { $"/api/{controllerKeyName}" }));
589592

593+
//TODO:Unit Test
594+
//[ForbiddenExternalAccess]
595+
if (Register.ForbiddenExternalAccess)
596+
{
597+
var forbiddenExternalAsyncAttr = typeof(ForbiddenExternalAccessAsyncFilter);
598+
tb.SetCustomAttribute(new CustomAttributeBuilder(forbiddenExternalAsyncAttr.GetConstructor(new Type[0]), new object[0] { }));//只需要一个，和ForbiddenExternalAccessFilter两者可互换
599+
//var forbiddenExternalAttr = typeof(ForbiddenExternalAccessFilter);
600+
//tb.SetCustomAttribute(new CustomAttributeBuilder(forbiddenExternalAttr.GetConstructor(new Type[0]), new object[0] { }));
601+
}
602+
590603
//添加Controller级别的分类（暂时无效果）
591604

592605
//TODO:外部注入

‎src/Senparc.CO2NET.WebApi/WebApiEngines/WebApiEngineExtensions.cs‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
using Microsoft.AspNetCore.Mvc;
2-
using Microsoft.Extensions.DependencyInjection;
1+
using Microsoft.Extensions.DependencyInjection;
32
using Senparc.CO2NET.ApiBind;
43
using Senparc.CO2NET.Trace;
54
using System;
@@ -8,7 +7,6 @@
87
using System.Linq;
98
using System.Reflection;
109
using System.Reflection.Emit;
11-
using System.Text;
1210
using System.Threading.Tasks;
1311

1412
namespace Senparc.CO2NET.WebApi.WebApiEngines
@@ -31,10 +29,11 @@ public static class WebApiEngineExtensions
3129
/// <param name="additionalAttributes"></param>
3230
/// <param name="buildXml">是否创建动态 API 对应的 XML 注释文件</param>
3331
/// <param name="additionalAttributeFunc">是否复制自定义特性（AppBindAttribute 除外）</param>
32+
/// <param name="forbiddenExternalAccess">是否允许外部访问，默认为 false，只允许本机访问相关 API</param>
3433
public static void AddAndInitDynamicApi(this IServiceCollection services, IMvcCoreBuilder builder,
35-
string docXmlPath, ApiRequestMethod defaultRequestMethod = ApiRequestMethod.Post, Type baseApiControllerType = null, int taskCount = 4, bool showDetailApiLog = false, bool copyCustomAttributes = true, Func<MethodInfo, IEnumerable<CustomAttributeBuilder>> additionalAttributeFunc = null)
34+
string docXmlPath, ApiRequestMethod defaultRequestMethod = ApiRequestMethod.Post, Type baseApiControllerType = null, int taskCount = 4, bool showDetailApiLog = false, bool copyCustomAttributes = true, Func<MethodInfo, IEnumerable<CustomAttributeBuilder>> additionalAttributeFunc = null, bool forbiddenExternalAccess = true)
3635
{
37-
AddAndInitDynamicApi(services, (builder, null), docXmlPath, defaultRequestMethod, baseApiControllerType, taskCount, showDetailApiLog, copyCustomAttributes, additionalAttributeFunc);
36+
AddAndInitDynamicApi(services, (builder, null), docXmlPath, defaultRequestMethod, baseApiControllerType, taskCount, showDetailApiLog, copyCustomAttributes, additionalAttributeFunc, forbiddenExternalAccess);
3837
}
3938

4039

@@ -50,10 +49,11 @@ public static void AddAndInitDynamicApi(this IServiceCollection services, IMvcCo
5049
/// <param name="taskCount"></param>
5150
/// <param name="additionalAttributes"></param>
5251
/// <param name="additionalAttributeFunc">是否复制自定义特性（AppBindAttribute 除外）</param>
52+
/// <param name="forbiddenExternalAccess">是否允许外部访问，默认为 false，只允许本机访问相关 API</param>
5353
public static void AddAndInitDynamicApi(this IServiceCollection services, IMvcBuilder builder,
54-
string docXmlPath, ApiRequestMethod defaultRequestMethod = ApiRequestMethod.Post, Type baseApiControllerType = null, int taskCount = 4, bool showDetailApiLog = false, bool copyCustomAttributes = true, Func<MethodInfo, IEnumerable<CustomAttributeBuilder>> additionalAttributeFunc = null)
54+
string docXmlPath, ApiRequestMethod defaultRequestMethod = ApiRequestMethod.Post, Type baseApiControllerType = null, int taskCount = 4, bool showDetailApiLog = false, bool copyCustomAttributes = true, Func<MethodInfo, IEnumerable<CustomAttributeBuilder>> additionalAttributeFunc = null, bool forbiddenExternalAccess = true)
5555
{
56-
AddAndInitDynamicApi(services, (null, builder), docXmlPath, defaultRequestMethod, baseApiControllerType, taskCount, showDetailApiLog, copyCustomAttributes, additionalAttributeFunc);
56+
AddAndInitDynamicApi(services, (null, builder), docXmlPath, defaultRequestMethod, baseApiControllerType, taskCount, showDetailApiLog, copyCustomAttributes, additionalAttributeFunc, forbiddenExternalAccess);
5757
}
5858

5959
/// <summary>
@@ -68,9 +68,10 @@ public static void AddAndInitDynamicApi(this IServiceCollection services, IMvcBu
6868
/// <param name="taskCount"></param>
6969
/// <param name="additionalAttributes"></param>
7070
/// <param name="additionalAttributeFunc">是否复制自定义特性（AppBindAttribute 除外）</param>
71+
/// <param name="forbiddenExternalAccess">是否允许外部访问，默认为 false，只允许本机访问相关 API</param>
7172
private static void AddAndInitDynamicApi(this IServiceCollection services, (IMvcCoreBuilder coreBuilder, IMvcBuilder builder) builder,
7273
string docXmlPath, ApiRequestMethod defaultRequestMethod = ApiRequestMethod.Post, Type baseApiControllerType = null,
73-
int taskCount = 4, bool showDetailApiLog = false, bool copyCustomAttributes = true, Func<MethodInfo, IEnumerable<CustomAttributeBuilder>> additionalAttributeFunc = null)
74+
int taskCount = 4, bool showDetailApiLog = false, bool copyCustomAttributes = true, Func<MethodInfo, IEnumerable<CustomAttributeBuilder>> additionalAttributeFunc = null, bool forbiddenExternalAccess = true)
7475
{
7576
_ = defaultRequestMethod != ApiRequestMethod.GlobalDefault ? true : throw new Exception($"{nameof(defaultRequestMethod)} 不能作为默认请求类型！");
7677

@@ -79,7 +80,7 @@ private static void AddAndInitDynamicApi(this IServiceCollection services, (IMvc
7980

8081
WebApiEngine.AdditionalAttributeFunc = additionalAttributeFunc;
8182

82-
var webApiEngine = new WebApiEngine(docXmlPath, defaultRequestMethod, baseApiControllerType, copyCustomAttributes, taskCount, showDetailApiLog);
83+
var webApiEngine = new WebApiEngine(docXmlPath, defaultRequestMethod, baseApiControllerType, copyCustomAttributes, taskCount, showDetailApiLog, forbiddenExternalAccess);
8384

8485
bool preLoad = true;
8586

0 commit comments

Comments
 (0)