wangziqi/ruoyi-vue-pro
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(education): fail closed on unsafe question data

Browse Source
This commit is contained in:
wangziqi
2026-07-30 14:30:04 +08:00
parent f7b3cc450f
commit 7ceb73d802
5 changed files with 26 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
yudao-module-education/src/main/java/cn/iocoder/yudao/module/education/service/catalog/provider/JavaCatalogProvider.java
View File

@@ -397,7 +397,7 @@ public class JavaCatalogProvider implements CatalogProvider, QuestionCatalogProv
@SuppressWarnings({"unchecked", "rawtypes"})
private List<CatalogQuestionDTO.QuestionOptionDTO> parseOptions(String optionsJson) {
if (optionsJson == null || optionsJson.isEmpty()) return Collections.emptyList();
if (optionsJson == null || optionsJson.isBlank()) return Collections.emptyList();
try {
com.fasterxml.jackson.databind.ObjectMapper mapper = new com.fasterxml.jackson.databind.ObjectMapper();
List<java.util.Map> rawList = mapper.readValue(optionsJson, List.class);
@@ -414,7 +414,7 @@ public class JavaCatalogProvider implements CatalogProvider, QuestionCatalogProv
}
return result;
} catch (Exception e) {
return Collections.emptyList();
throw exception(UNSAFE_PROVIDER_PAYLOAD);
}
}

7
yudao-module-education/src/main/java/cn/iocoder/yudao/module/education/service/practice/PracticeSessionServiceImpl.java
View File

@@ -579,8 +579,11 @@ public class PracticeSessionServiceImpl implements PracticeSessionService {
|| response.getDetails() == null
|| !Objects.equals(existing.getReportId(), response.getReportId())
|| !Objects.equals(existing.getSessionId(), response.getSessionId())) {
log.warn("Invalid submit replay payload: id={}, storedReportId={}, storedSessionId={}, response={}",
existing.getId(), existing.getReportId(), existing.getSessionId(), existing.getResponseJson());
log.warn("Invalid submit replay payload: id={}, storedReportId={}, storedSessionId={}, " +
"responseReportId={}, responseSessionId={}",
existing.getId(), existing.getReportId(), existing.getSessionId(),
response != null ? response.getReportId() : null,
response != null ? response.getSessionId() : null);
throw exception(SUBMIT_IDEMPOTENCY_REPLAY_INVALID);
}
return response;

4
yudao-module-education/src/main/java/cn/iocoder/yudao/module/education/service/question/QuestionContentSafety.java
View File

@@ -33,8 +33,8 @@ public final class QuestionContentSafety {
*/
public static void validateVisibleProviderQuestion(CatalogQuestionDTO question, ErrorCode visibilityError) {
if (question == null || question.getIsPublished() == null || !question.getIsPublished()
|| "hidden".equalsIgnoreCase(question.getStatus())
|| "inactive".equalsIgnoreCase(question.getStatus())) {
|| (question.getStatus() != null && !question.getStatus().isBlank()
&& !"published".equalsIgnoreCase(question.getStatus()))) {
throw exception(visibilityError);
}
}

6
yudao-module-education/src/test/java/cn/iocoder/yudao/module/education/service/question/QuestionCatalogServiceImplTest.java
View File

@@ -298,12 +298,12 @@ class QuestionCatalogServiceImplTest {
}
@Test
void shouldAllowAllPublishedAndActiveItems() {
// Mixed types but all published and status != hidden/inactive → all pass
void shouldAllowPublishedItemsWithPublishedOrAbsentStatus() {
// Providers may omit status, but any explicit student-visible status must be PUBLISHED.
CatalogQuestionDTO q1 = questionDto("q1", "Q1", "fill", "easy", true, null, null, null, null, null);
CatalogQuestionDTO q2 = CatalogQuestionDTO.builder()
.id("q2").stem("Q2").type("fill").difficulty("medium")
.isPublished(true).status("active").build();
.isPublished(true).status("PUBLISHED").build();
CatalogQuestionDTO q3 = CatalogQuestionDTO.builder()
.id("q3").stem("Q3").type("short_answer").difficulty("hard")
.isPublished(true).status(null).build();

14
yudao-module-education/src/test/java/cn/iocoder/yudao/module/education/service/question/QuestionContentSafetyTest.java
View File

@@ -14,6 +14,20 @@ import static org.junit.jupiter.api.Assertions.*;
class QuestionContentSafetyTest {
@Test
void shouldAllowOnlyPublishedProviderStatusWhenPresent() {
CatalogQuestionDTO published = CatalogQuestionDTO.builder().isPublished(true).status("PUBLISHED").build();
assertDoesNotThrow(() -> QuestionContentSafety.validateVisibleProviderQuestion(
published, UNSAFE_PROVIDER_PAYLOAD));
for (String status : List.of("DRAFT", "DISABLED", "UNKNOWN", "HIDDEN", "INACTIVE")) {
CatalogQuestionDTO unsafe = CatalogQuestionDTO.builder().isPublished(true).status(status).build();
ServiceException ex = assertThrows(ServiceException.class,
() -> QuestionContentSafety.validateVisibleProviderQuestion(unsafe, UNSAFE_PROVIDER_PAYLOAD));
assertEquals(UNSAFE_PROVIDER_PAYLOAD.getCode(), ex.getCode());
}
}
@Test
void shouldAcceptAndOrderValidOptionBackedQuestion() {
List<SafeOption> options = QuestionContentSafety.validateProviderOptions(" choice ", List.of(