zl
pushed to master at Mqy/Wisdom-Data
44371c5c81 docs: update CLAUDE.md with security, MQTT, and lock improvements
0fd6162ee1 refactor: CRITICAL/HIGH fixes — security, concurrency, resource leaks, input validation
Security:
- Remove hardcoded password fallbacks from application-druid.yml
- Add table name whitelist validation to SysFaultService & SysAlarmService
- Externalize VehicleSyncTask webhook URL to IotProperties config
Concurrency & Resource Management:
- Fix AbstractMqttConsumer reconnect/disconnect race (synchronized)
- Fix MqttClient resource leaks in disconnect() with separate try blocks
- Fix AbstractDynamicMqttConsumer broken-state MqttClient reuse
- Fix TDengineService stableColumnCache unbounded growth (MAX_CACHE_SIZE=1000)
Input Validation:
- Add null/empty checks to MqttGenericConsumer (controllerId, path, timestamp)
- Add null/empty checks to MqttFaultConsumer (controllerId, deviceId, type, desc)
- Guard against ArrayIndexOutOfBoundsException on topic path split
Tests:
- Update VehicleSyncTaskTest for new IotProperties constructor param
- All 79 tests pass, build succeeds
e6338b3ef4 refactor: P0-P1 complete — field injection, logging, hardcoded values, resource mgmt
P0 fixes:
- MqttFaultConsumer: array index bounds check, NPE guard on null coordinates
- MqttStatusConsumer: NPE guard on null required fields
- TDegnineAlarm: ResultSet try-with-resources, SQL injection whitelist
- AbstractMqttConsumer: brokerUrl parsing validation, mqttPassword null guard
P1 fixes:
- Field injection → constructor injection (7 files: MqttFaultConsumer,
MqttStatusConsumer, SysIndicatorsService, SysWorkorderService,
TDengineService, TDegnineAlarm, AbstractMqttConsumer)
- SLF4J {} placeholder logging (4 places in AbstractMqttConsumer)
- Extract hardcoded constants: alarm status, date format, company ID prefix,
webhook URL → IotProperties configuration
- TDengineService: dataSourceInitialized volatile, GZIP try-with-resources
Tests:
- Fix MqttStatusConsumerTest/MqttFaultConsumerTest/MqttGenericConsumerTest
for new constructors (remove @InjectMocks, manual instantiation)
- 65/67 tests passing (2 TDengine JNI env-dependent failures excluded)
28470869a3 test(P1): 新增3个测试类覆盖动态消费者基类与子类
- AbstractDynamicMqttConsumerTest: 4个测试覆盖 deepCopyMap(null/深拷贝/嵌套/List)
- MqttDynamicConsumerTest: 6个测试覆盖 fetchTopics + insertredis
- MqttChargeStationConsumerTest: 4个测试覆盖 fetchTopics(配置/null/空白/trim)
- 测试总数 65→79,JaCoCo覆盖率 18%→25%
5cbb11d169 chore(P2): 替换mysql驱动,移除emoji统一日志格式
- mysql-connector-java → mysql-connector-j 8.0.33
- TDengineService: 移除9处emoji(✅❌⚠️)
- 统一使用SLF4J {}占位符,无字符串拼接
- Compare 14 commits »
3 days ago