不安全的框架绑定

license/src/main/java/iot/sixiang/license/controller/MaskingController.java

@@ -26,6 +26,11 @@ import org.springframework.web.bind.annotation.RestController;
 @Api(value = "数据脱敏", tags = {"数据脱敏"})
 public class MaskingController {
 
+    @InitBinder
+    public void initBinder(WebDataBinder binder) {
+        binder.setDisallowedFields(new String[]{"adminCome"});
+    }
+
     @ApiOperation(value = "数据脱敏")
     @PostMapping("/desensitize")
     public ResResult<MaskingVo> encrypt(@RequestBody MaskingVo maskingVo) {
@@ -40,9 +45,8 @@ public class MaskingController {
 
         MaskingVo vo = new MaskingVo();
         vo.setUserName(ESAPI.encoder().encodeForHTML(CommonUtil.nameDesensitization(maskingVo.getUserName())));
-        vo.setIdCard(ESAPI.encoder().encodeForHTML(CommonUtil.idCardEncrypt(maskingVo.getIdCard())));
+        vo.setIdCard(CommonUtil.idCardEncrypt(maskingVo.getIdCard()));
         return ResResult.success().goRecord(vo);
     }
 
-
 }