feat: add bilingual support

Author: whgojp

src/main/java/top/whgojp/common/config/WebConfig.java

@@ -3,10 +3,18 @@
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.MessageSource;
+import org.springframework.context.support.ReloadableResourceBundleMessageSource;
+import org.springframework.web.servlet.LocaleResolver;
+import org.springframework.web.servlet.i18n.CookieLocaleResolver;
+import org.springframework.web.servlet.i18n.LocaleChangeInterceptor;
 import org.springframework.web.servlet.config.annotation.*;
 import top.whgojp.common.constant.SysConstant;
 
+import java.util.Locale;
+
 /**
  * @description 自定义静态资源的访问路径、文件映射
  * @author: whgojp
@@ -30,4 +38,34 @@ public void addResourceHandlers(ResourceHandlerRegistry registry) {
                 .addResourceLocations("classpath:/static/");
     }
 
+    @Bean
+    public MessageSource messageSource() {
+        ReloadableResourceBundleMessageSource messageSource = new ReloadableResourceBundleMessageSource();
+        messageSource.setBasename("classpath:i18n/messages");
+        messageSource.setDefaultEncoding("UTF-8");
+        messageSource.setFallbackToSystemLocale(false);
+        return messageSource;
+    }
+
+    @Bean
+    public LocaleResolver localeResolver() {
+        CookieLocaleResolver localeResolver = new CookieLocaleResolver();
+        localeResolver.setDefaultLocale(Locale.SIMPLIFIED_CHINESE);
+        localeResolver.setCookieName("JavaSecLab-Language");
+        localeResolver.setCookieMaxAge(30 * 24 * 60 * 60);
+        return localeResolver;
+    }
+
+    @Bean
+    public LocaleChangeInterceptor localeChangeInterceptor() {
+        LocaleChangeInterceptor interceptor = new LocaleChangeInterceptor();
+        interceptor.setParamName("lang");
+        return interceptor;
+    }
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(localeChangeInterceptor());
+    }
+
 }

src/main/java/top/whgojp/common/enums/LoginError.java

@@ -13,24 +13,24 @@
 public enum LoginError {
 
 
-    FAILURE(0, "登录失败！"),
+    FAILURE(0, "login.error.failure"),
 
-    BADCREDENTIALS(1, "用户名或密码错误!"),
+    BADCREDENTIALS(1, "login.error.badCredentials"),
 
-    LOCKED(2, "用户已被锁定，无法登录！"),
+    LOCKED(2, "login.error.locked"),
 
-    ACCOUNTEXPIRED(3, "用户已过时，无法登录！"),
+    ACCOUNTEXPIRED(3, "login.error.accountExpired"),
 
-    USERNAMENOTFOUND(4, "用户不存在！"),
+    USERNAMENOTFOUND(4, "login.error.usernameNotFound"),
 
-    CAPTCHANOTFOUND(5,"验证码不能为空！"),
-    CAPTCHAEXPIRED(6,"验证码已过期！"),
-    CAPTCHAERROR(7,"验证码错误！");
+    CAPTCHANOTFOUND(5,"login.error.captchaNotFound"),
+    CAPTCHAEXPIRED(6,"login.error.captchaExpired"),
+    CAPTCHAERROR(7,"login.error.captchaError");
 
 
     private Integer type;
 
-    private String message;
+    private String messageCode;
 
     private final static Map<Integer, LoginError> mappings = new HashMap<>();
 
@@ -50,15 +50,15 @@ public static LoginError resolve(Integer type) {
         return type != null ? mappings.get(type) : null;
     }
 
-    public static String getMessage(Integer type) {
+    public static String getMessageCode(Integer type) {
         LoginError loginError = resolve(type);
 
-        return loginError != null ? loginError.message : null;
+        return loginError != null ? loginError.messageCode : null;
     }
 
-    LoginError(Integer type, String message) {
+    LoginError(Integer type, String messageCode) {
         this.type = type;
-        this.message = message;
+        this.messageCode = messageCode;
     }
 
     public Integer getType() {
@@ -69,11 +69,11 @@ public void setType(Integer type) {
         this.type = type;
     }
 
-    public String getMessage() {
-        return message;
+    public String getMessageCode() {
+        return messageCode;
     }
 
-    public void setMessage(String message) {
-        this.message = message;
+    public void setMessageCode(String messageCode) {
+        this.messageCode = messageCode;
     }
-}
+}

src/main/java/top/whgojp/common/utils/UploadUtil.java

@@ -17,6 +17,11 @@ public class UploadUtil {
     private SysConstant sysConstant;
 
     public String uploadFile(MultipartFile file, String suffix, String path) throws IOException {
+        String fileUrl = uploadFileAndReturnUrl(file, suffix, path);
+        return "上传文件成功，文件路径：" + fileUrl;
+    }
+
+    public String uploadFileAndReturnUrl(MultipartFile file, String suffix, String path) throws IOException {
         // 从配置中获取上传目录
         String uploadFolderPath = sysConstant.getUploadFolder();
         try {
@@ -31,11 +36,11 @@ public String uploadFile(MultipartFile file, String suffix, String path) throws
             // 保存文件
             file.transferTo(new File(newFilePath));
             log.info("上传文件成功，文件路径：" + newFilePath);
-            return "上传文件成功，文件路径：" + path + fileName;
+            return path + fileName;
         } catch (IOException e) {
             log.error("文件上传失败：{}", e.getMessage(), e);
             throw e; // 重新抛出异常供上层处理
         }
     }
 
-}
+}

src/main/java/top/whgojp/modules/components/jackson/controller/JacksonController.java

@@ -5,6 +5,8 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import io.swagger.annotations.Api;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.context.MessageSource;
+import org.springframework.context.i18n.LocaleContextHolder;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.*;
 
@@ -23,6 +25,12 @@
 @CrossOrigin(origins = "*")
 @RequestMapping("/jackson")
 public class JacksonController {
+    private final MessageSource messageSource;
+
+    public JacksonController(MessageSource messageSource) {
+        this.messageSource = messageSource;
+    }
+
     @RequestMapping("")
     public String jackson() {
         return "vul/components/jackson";
@@ -40,10 +48,10 @@ public String vul(@RequestBody(required = false) String content) {
 
             // 反序列化接收的JSON数据，触发漏洞
             Object obj = mapper.readValue(content, Object.class);
-            return "[+]Jackson 反序列化: " + obj.toString();
+            return msg("component.jackson.result.vul", obj);
         } catch (Exception e) {
             e.printStackTrace();
-            return "[-]Jackson反序列化失败";
+            return msg("component.jackson.result.failed");
         }
     }
 
@@ -63,10 +71,14 @@ public String safeJackson(@RequestBody(required = false) String payload) {
             return mapper.writeValueAsString(safePayload);
         } catch (Exception e) {
             e.printStackTrace();
-            return "Jackson Safe Deserialization Error";
+            return msg("component.jackson.result.safeFailed");
         }
     }
 
+    private String msg(String key, Object... args) {
+        return messageSource.getMessage(key, args, LocaleContextHolder.getLocale());
+    }
+
 
     /**
      * CVE-2020-35728

src/main/java/top/whgojp/modules/components/log4j2/controller/Log4j2Controller.java

@@ -3,6 +3,8 @@
 import io.swagger.annotations.Api;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.springframework.context.MessageSource;
+import org.springframework.context.i18n.LocaleContextHolder;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.*;
 import org.apache.commons.text.StringEscapeUtils;
@@ -19,6 +21,12 @@
 @CrossOrigin(origins = "*")
 @RequestMapping("/log4j2")
 public class Log4j2Controller {
+    private final MessageSource messageSource;
+
+    public Log4j2Controller(MessageSource messageSource) {
+        this.messageSource = messageSource;
+    }
+
     @RequestMapping("")
     public String log4j2() {
         return "vul/components/log4j2";
@@ -31,7 +39,7 @@ public String log4j2() {
     public String vul(@RequestParam("payload") String payload) {
         System.out.println("[+]Log4j2反序列化："+payload);
         logger.error(payload);
-        return "[+]Log4j2反序列化："+payload;
+        return msg("component.log4j2.result.vul", payload);
     }
 
     @PostMapping("/safe")
@@ -41,9 +49,11 @@ public String safe(@RequestParam("payload") String payload) {
 
         System.out.println("[+]Log4j2反序列化："+payload);
         logger.error(payload);
-        return "[+]Log4j2反序列化："+payload;
+        return msg("component.log4j2.result.safe", payload);
     }
 
-
+    private String msg(String key, Object... args) {
+        return messageSource.getMessage(key, args, LocaleContextHolder.getLocale());
+    }
 
 }

src/main/java/top/whgojp/modules/components/shiro/controller/ShiroController.java

@@ -3,6 +3,8 @@
 import io.swagger.annotations.Api;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.shiro.web.mgt.CookieRememberMeManager;
+import org.springframework.context.MessageSource;
+import org.springframework.context.i18n.LocaleContextHolder;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -25,6 +27,12 @@
 @CrossOrigin(origins = "*")
 @RequestMapping("/shiro")
 public class ShiroController {
+    private final MessageSource messageSource;
+
+    public ShiroController(MessageSource messageSource) {
+        this.messageSource = messageSource;
+    }
+
     @RequestMapping("")
     public String shiro() {
         return "vul/components/shiro";
@@ -35,10 +43,14 @@ public String shiro() {
     public R getShiroKey(){
         try{
             byte[] key = new CookieRememberMeManager().getCipherKey();
-            return R.ok("Shiro AES密钥硬编码为："+new String(Base64.getEncoder().encode(key)));
+            return R.ok(msg("component.shiro.result.key", new String(Base64.getEncoder().encode(key))));
         }catch (Exception ignored){
-            return R.error("获取AES密钥失败！");
+            return R.error(msg("component.shiro.result.keyFailed"));
         }
     }
 
+    private String msg(String key, Object... args) {
+        return messageSource.getMessage(key, args, LocaleContextHolder.getLocale());
+    }
+
 }

src/main/java/top/whgojp/modules/components/xstream/controller/XstreamController.java

@@ -4,6 +4,8 @@
 import com.thoughtworks.xstream.security.*;
 import io.swagger.annotations.Api;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.context.MessageSource;
+import org.springframework.context.i18n.LocaleContextHolder;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -25,6 +27,12 @@
 @CrossOrigin(origins = "*")
 @RequestMapping("/xstream")
 public class XstreamController {
+    private final MessageSource messageSource;
+
+    public XstreamController(MessageSource messageSource) {
+        this.messageSource = messageSource;
+    }
+
     @RequestMapping("")
     public String xstream() {
         return "vul/components/xstream";
@@ -51,10 +59,10 @@ public String vul(@RequestBody(required = false) String content) {
             Object result = xs.fromXML(content);  // 反序列化得到的对象
 
             // 检查反序列化后的结果并返回相关信息
-            return "组件漏洞-Xstream Vul, 反序列化结果: \n" + result;
+            return msg("component.xstream.result.vul", result);
         } catch (Exception e) {
             log.error("XStream反序列化失败", e);
-            return "组件漏洞-Xstream Vul 执行失败：" + e.getMessage();
+            return msg("component.xstream.result.vulFailed", e.getMessage());
         }
     }
 
@@ -69,10 +77,10 @@ public String safe1(@RequestBody(required = false) String content) {
             // 黑名单示例：拒绝已知危险类型。
             xstream.denyPermission(new ExplicitTypePermission(new Class[]{ImageIO.class}));
             Object result = xstream.fromXML(content);
-            return "组件漏洞-Xstream Safe-BlackList, 解析结果：" + result;
+            return msg("component.xstream.result.blacklist", result);
         } catch (Exception e) {
             log.error("XStream黑名单场景解析失败", e);
-            return "组件漏洞-Xstream Safe-BlackList 执行失败：" + e.getMessage();
+            return msg("component.xstream.result.blacklistFailed", e.getMessage());
         }
     }
     @RequestMapping("/safe2")
@@ -92,13 +100,17 @@ public String safe2(@RequestBody(required = false) String content) {
             // 添加自定义的类列表
             xstream.addPermission(new ExplicitTypePermission(new Class[]{Date.class}));
             Object result = xstream.fromXML(content);
-            return "组件漏洞-Xstream Safe-WhiteList, 解析结果：" + result;
+            return msg("component.xstream.result.allowlist", result);
         } catch (Exception e) {
             log.error("XStream白名单场景解析失败", e);
-            return "组件漏洞-Xstream Safe-WhiteList 执行失败：" + e.getMessage();
+            return msg("component.xstream.result.allowlistFailed", e.getMessage());
         }
     }
 
+    private String msg(String key, Object... args) {
+        return messageSource.getMessage(key, args, LocaleContextHolder.getLocale());
+    }
+
     // CVE-2020-26259 任意文件删除示例
     public static void main(String[] args) {
         String xml_poc = "<map>\n" +