Merge pull request #551 from CC11001100/fix/multi-RequestMappingHandlerMapping

fix: spring mvc采集时兼容有多个RequestMappingHandlerMapping的情况

Author: lostsnow

dongtai-api-gather/dongtai-api-gather-spring-api/src/main/java/io/dongtai/iast/api/gather/spring/extractor/SpringMVCApiExtractor.java

@@ -7,7 +7,8 @@
 import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
 
 import java.lang.reflect.Method;
-import java.util.Map;
+import java.util.*;
+import java.util.stream.Collectors;
 
 /**
  * @author CC11001100
@@ -21,11 +22,26 @@ public class SpringMVCApiExtractor {
      * @param applicationContext
      * @return
      */
-    public static OpenApi run(Object applicationContext) {
+    public static List<OpenApi> run(Object applicationContext) {
         WebApplicationContext webApplicationContext = (WebApplicationContext) applicationContext;
         SpringMVCApiExtractor springApplicationContext = new SpringMVCApiExtractor();
-        RequestMappingHandlerMapping requestMappingHandlerMapping = springApplicationContext.findRequestMappingHandlerMapping(webApplicationContext);
-        return new RequestMappingHandlerMappingConvertor(webApplicationContext, requestMappingHandlerMapping).parse();
+        List<RequestMappingHandlerMapping> requestMappingHandlerMappingList = springApplicationContext.findRequestMappingHandlerMapping(webApplicationContext);
+        if (requestMappingHandlerMappingList == null || requestMappingHandlerMappingList.isEmpty()) {
+            DongTaiLog.debug("spring mvc can not find RequestMappingHandlerMapping beans");
+            return null;
+        }
+        return requestMappingHandlerMappingList
+                .stream()
+                .map(mapping -> {
+                    try {
+                        return new RequestMappingHandlerMappingConvertor(webApplicationContext, mapping).parse();
+                    } catch (Throwable e) {
+                        DongTaiLog.debug("spring mvc RequestMappingHandlerMappingConvertor parse error", e);
+                        return null;
+                    }
+                })
+                .filter(Objects::nonNull)
+                .collect(Collectors.toList());
     }
 
     /**
@@ -34,7 +50,7 @@ public static OpenApi run(Object applicationContext) {
      * @param applicationContext
      * @return
      */
-    private RequestMappingHandlerMapping findRequestMappingHandlerMapping(WebApplicationContext applicationContext) {
+    private List<RequestMappingHandlerMapping> findRequestMappingHandlerMapping(WebApplicationContext applicationContext) {
 
         if (applicationContext == null) {
             return null;
@@ -52,15 +68,23 @@ private RequestMappingHandlerMapping findRequestMappingHandlerMapping(WebApplica
                 Map<String, RequestMappingHandlerMapping> m = (Map<String, RequestMappingHandlerMapping>) invoke;
                 RequestMappingHandlerMapping requestMappingHandlerMapping = m.get("requestMappingHandlerMapping");
                 if (requestMappingHandlerMapping != null) {
-                    return requestMappingHandlerMapping;
+                    return Collections.singletonList(requestMappingHandlerMapping);
                 }
             }
         } catch (Throwable e) {
             DongTaiLog.debug("try use BeanFactoryUtils find RequestMappingHandlerMapping exception", e);
         }
 
         // 没有工具类，就只从自己里面找
-        return applicationContext.getBean(RequestMappingHandlerMapping.class);
+        // 2023-7-11 16:58:23 注意，此处可能会寻找到多个，寻找到多个的时候统统上报
+        // case:
+        //         <dependency>
+        //            <groupId>io.springfox</groupId>
+        //            <artifactId>springfox-swagger2</artifactId>
+        //            <version>2.7.0</version>
+        //        </dependency>
+        // 它会创建一个自己的 springfox.documentation.spring.web.PropertySourcedRequestMappingHandlerMapping 继承了 RequestMappingHandlerMapping
+        return new ArrayList<>(applicationContext.getBeansOfType(RequestMappingHandlerMapping.class).values());
     }
 
 }

dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/api/SpringGatherApiThread.java

@@ -9,6 +9,7 @@
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.net.URL;
+import java.util.List;
 
 /**
  * @author CC11001100
@@ -72,8 +73,12 @@ public void run() {
     private void runWithClassLoader(ClassLoader classLoader) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException, ClassNotFoundException {
         Class<?> proxyClass = classLoader.loadClass("io.dongtai.iast.api.gather.spring.extractor.SpringMVCApiExtractor");
         Method getAPI = proxyClass.getDeclaredMethod("run", Object.class);
-        Object openApi = getAPI.invoke(null, applicationContext);
-        report(openApi, FRAMEWORK_NAME);
+        Object openApiList = getAPI.invoke(null, applicationContext);
+        if (openApiList == null) {
+            return;
+        }
+        // 返回的是一个报告列表
+        ((List) openApiList).forEach(o -> report(o, FRAMEWORK_NAME));
     }
 
 }