User Input Verification

Version

Application Scenario

The server accepts user input and incorporates it directly into the logic of the web application.

If the input contains malicious code, the server will accept and execute it, leading to issues such as information leakage and arbitrary code execution.

Function Description

The User Input Verification function is enabled by default, which verifies the user input in specific scenarios within FineDataLink, effectively filtering malicious code and ensuring system security.

If the user input contains illegal content, clicking OK or Save will prevent the entered content from being saved and trigger a pop-up message, as shown in the following figure.

Enabling/Disabling User Input Verification

You (the super admin) can enable/disable User Input Verification by modifying the following configuration item in the fine_conf_entity table.

Note:

The User Input Verification configuration item does not exist in the fine_conf_entity table. You need to manually add the field and restart FineDataLink to apply the change. For the addition method, see Modifying fine_conf_entity Manually.

Verification Content

After the User Input Verification function is enabled, it will verify the input content in specific input scenarios in FineDataLink. For details, see the "Verification Scenario" section.

If the input contains the following regular expressions, clicking OK or Save will prevent the entered content from being saved and trigger a pop-up message: "Illegal characters exist in the input: XXX."

Note:

When there are multiple illegal characters in the input, only the first illegal character detected will be displayed.

Verification Scenario

Module	Verification Scenario	Verification Content
User Management	User adding/editing	Username Note: User Input Verification is unavailable during importing users or synchronizing users.
	Department adding/editing	Department name
	Role editing/editing	Role name and remark
Appearance Configuration	Login page	Login title
	Platform style	Platform title
System Management	General > General Parameter	Servlet path name
	Mailbox > Sender Account Setting	Displayed sender name
Data Connection	Data connection creation in Data Connection Management	Data connection name
	Data connection renaming in Data Connection Management	Data connection name
	Dataset creation in Server Dataset	Server dataset name
	Dataset renaming in Server Dataset	Server dataset name