From 03a691c770b255a336527217eb479a58a6d6a79e Mon Sep 17 00:00:00 2001 From: let5sne Date: Wed, 15 Jul 2026 01:45:57 +0800 Subject: [PATCH] fix(aihr): sanitize mobile review responses --- .../aihr/controller/AihrMobileController.java | 14 ++++++-------- .../dromara/aihr/service/AihrSensitiveText.java | 4 ++-- .../aihr/service/AihrSensitiveTextTest.java | 2 ++ docs/BRD_IMPLEMENTATION_AUDIT.md | 2 ++ scripts/demo-check.sh | 1 + 5 files changed, 13 insertions(+), 10 deletions(-) diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrMobileController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrMobileController.java index afda0f3f..bfe35adf 100644 --- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrMobileController.java +++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrMobileController.java @@ -26,6 +26,7 @@ import org.dromara.aihr.domain.vo.AihrMobileDto.HomeResponse; import org.dromara.aihr.domain.vo.AihrMobileDto.IdentityResponse; import org.dromara.aihr.service.AihrOrgSyncService; import org.dromara.aihr.service.AihrMobileSeedService; +import org.dromara.aihr.service.AihrSensitiveText; import org.dromara.common.core.domain.R; import org.dromara.common.core.domain.model.LoginUser; import org.dromara.common.core.enums.UserType; @@ -300,10 +301,10 @@ public class AihrMobileController { data.put("scene", detail.scene()); data.put("score", detail.score()); data.put("status", detail.status()); - data.put("summary", detail.summary()); - data.put("mentorRewrite", detail.mentorRewrite()); - data.put("aiComment", detail.aiComment()); - data.put("reviewAdvice", detail.reviewAdvice()); + data.put("summary", maskSensitiveText(detail.summary())); + data.put("mentorRewrite", maskSensitiveText(detail.mentorRewrite())); + data.put("aiComment", maskSensitiveText(detail.aiComment())); + data.put("reviewAdvice", maskSensitiveText(detail.reviewAdvice())); data.put("incentivePoint", detail.incentivePoint()); data.put("scoreItems", detail.scoreItems().stream().map(item -> Map.of( "label", item.label(), @@ -334,9 +335,6 @@ public class AihrMobileController { } private static String maskSensitiveText(String value) { - if (value == null || value.isBlank()) { - return value; - } - return value.replaceAll("(1\\d{2})\\d{4}(\\d{4})", "$1****$2"); + return AihrSensitiveText.forModel(value); } } diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSensitiveText.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSensitiveText.java index 86ced46f..61c483f9 100644 --- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSensitiveText.java +++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSensitiveText.java @@ -8,7 +8,7 @@ import java.util.regex.Pattern; *

这不是正式的数据分类引擎；它只负责拦截当前一期已知的手机号、邮箱、房号和带称谓姓名， * 避免“入库已脱敏、出境仍是原文”的边界漏洞。正式试点仍需配套供应商留存、审计和删除合同。

*/ -final class AihrSensitiveText { +public final class AihrSensitiveText { // 保持案例服务既有展示口径：手机号保留前 4 位和后 4 位，中间统一遮蔽。 private static final Pattern PHONE = Pattern.compile("(?