JDWA Green-U 系统安全机制与防护措施

@Configuration
@EnableWebSecurity
public class JDWASecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Autowired
    private JwtAuthenticationFilter jwtAuthFilter;
    
    @Autowired
    private UserDetailsServiceImpl userDetailsService;
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable()
            .authorizeRequests()
            .antMatchers("/auth/login", "/auth/register", "/api/public/**").permitAll()
            .antMatchers("/api/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
            .and()
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        
        // 添加安全响应头
        http.headers()
            .contentSecurityPolicy("default-src 'self'")
            .and()
            .referrerPolicy(ReferrerPolicyHeaderWriter.ReferrerPolicy.SAME_ORIGIN)
            .and()
            .frameOptions().deny()
            .and()
            .xssProtection().block(true);
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }
    
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }
}

// 权限注解使用示例
@RestController
@RequestMapping("/api/carbon")
public class CarbonRecordController {
    
    @PreAuthorize("hasAuthority('carbon:read')")
    @GetMapping("/records")
    public ResponseEntity<?> getCarbonRecords() {
        // 业务逻辑
    }
    
    @PreAuthorize("hasAuthority('carbon:create')")
    @PostMapping("/submit")
    public ResponseEntity<?> submitCarbonRecord(@RequestBody CarbonRecordDTO record) {
        // 业务逻辑
    }
    
    @PreAuthorize("hasAuthority('carbon:delete') and @securityService.isResourceOwner(#recordId)")
    @DeleteMapping("/records/{recordId}")
    public ResponseEntity<?> deleteCarbonRecord(@PathVariable Long recordId) {
        // 业务逻辑
    }
}

@RestController
@RequestMapping("/api")
public class RateLimitedController {
    
    @GetMapping("/public/data")
    @RateLimit(limit = 100, period = 60) // 60秒内最多100次请求
    public ResponseEntity<?> getPublicData() {
        // 业务逻辑
    }
    
    @PostMapping("/sensitive/operation")
    @RateLimit(limit = 10, period = 60) // 60秒内最多10次请求
    public ResponseEntity<?> sensitiveOperation() {
        // 业务逻辑
    }
}

@Configuration
public class TLSConfig {
    
    @Bean
    public TomcatServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                SecurityConstraint securityConstraint = new SecurityConstraint();
                securityConstraint.setUserConstraint("CONFIDENTIAL");
                SecurityCollection collection = new SecurityCollection();
                collection.addPattern("/*");
                securityConstraint.addCollection(collection);
                context.addConstraint(securityConstraint);
            }
        };
        tomcat.addAdditionalTomcatConnectors(redirectConnector());
        return tomcat;
    }
    
    private Connector redirectConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        connector.setPort(8080);
        connector.setSecure(false);
        connector.setRedirectPort(8443);
        return connector;
    }
}

@Component
public class SensitiveDataEncryptor {
    
    private static final String ALGORITHM = "AES/GCM/NoPadding";
    private final SecretKey secretKey;
    
    public SensitiveDataEncryptor(@Value("${app.security.encryption.key}") String encodedKey) {
        this.secretKey = new SecretKeySpec(Base64.getDecoder().decode(encodedKey), "AES");
    }
    
    public String encrypt(String data) throws Exception {
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        byte[] iv = new byte[12];
        new SecureRandom().nextBytes(iv);
        GCMParameterSpec parameterSpec = new GCMParameterSpec(128, iv);
        
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, parameterSpec);
        byte[] encryptedData = cipher.doFinal(data.getBytes(StandardCharsets.UTF_8));
        
        ByteBuffer byteBuffer = ByteBuffer.allocate(iv.length + encryptedData.length);
        byteBuffer.put(iv);
        byteBuffer.put(encryptedData);
        
        return Base64.getEncoder().encodeToString(byteBuffer.array());
    }
    
    public String decrypt(String encryptedData) throws Exception {
        byte[] decoded = Base64.getDecoder().decode(encryptedData);
        ByteBuffer byteBuffer = ByteBuffer.wrap(decoded);
        
        byte[] iv = new byte[12];
        byteBuffer.get(iv);
        
        byte[] cipherText = new byte[byteBuffer.remaining()];
        byteBuffer.get(cipherText);
        
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, secretKey, new GCMParameterSpec(128, iv));
        
        byte[] decryptedData = cipher.doFinal(cipherText);
        return new String(decryptedData, StandardCharsets.UTF_8);
    }
}

@Entity
@Table(name = "users")
public class User {
    
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(nullable = false, unique = true)
    private String username;
    
    @Column(nullable = false)
    @JsonIgnore
    private String password;
    
    @Convert(converter = EncryptedStringConverter.class)
    @Column(name = "id_card_number")
    private String idCardNumber;
    
    @Convert(converter = EncryptedStringConverter.class)
    @Column(name = "phone_number")
    private String phoneNumber;
    
    // 其他字段和方法
}

@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {
    
    @Autowired
    private SensitiveDataEncryptor encryptor;
    
    @Override
    public String convertToDatabaseColumn(String attribute) {
        try {
            return attribute != null ? encryptor.encrypt(attribute) : null;
        } catch (Exception e) {
            throw new RuntimeException("Error encrypting data", e);
        }
    }
    
    @Override
    public String convertToEntityAttribute(String dbData) {
        try {
            return dbData != null ? encryptor.decrypt(dbData) : null;
        } catch (Exception e) {
            throw new RuntimeException("Error decrypting data", e);
        }
    }
}

@JsonComponent
public class SensitiveDataSerializer extends JsonSerializer<String> {
    
    @Override
    public void serialize(String value, JsonGenerator gen, SerializerProvider serializers) throws IOException {
        if (value == null) {
            gen.writeNull();
            return;
        }
        
        // 根据字段名判断脱敏策略
        String fieldName = gen.getOutputContext().getCurrentName();
        switch (fieldName) {
            case "phoneNumber":
                gen.writeString(maskPhoneNumber(value));
                break;
            case "idCardNumber":
                gen.writeString(maskIdCard(value));
                break;
            case "email":
                gen.writeString(maskEmail(value));
                break;
            default:
                gen.writeString(value);
        }
    }
    
    private String maskPhoneNumber(String phone) {
        if (phone.length() < 8) return phone;
        return phone.substring(0, 3) + "****" + phone.substring(phone.length() - 4);
    }
    
    private String maskIdCard(String idCard) {
        if (idCard.length() < 10) return idCard;
        return idCard.substring(0, 6) + "********" + idCard.substring(idCard.length() - 4);
    }
    
    private String maskEmail(String email) {
        int atIndex = email.indexOf('@');
        if (atIndex <= 1) return email;
        String name = email.substring(0, atIndex);
        String domain = email.substring(atIndex);
        return name.substring(0, 1) + "***" + (name.length() > 4 ? name.substring(name.length() - 1) : "") + domain;
    }
}

@Repository
public class UserRepositoryImpl implements UserRepositoryCustom {
    
    @PersistenceContext
    private EntityManager entityManager;
    
    @Override
    public User findByUsername(String username) {
        String jpql = "SELECT u FROM User u WHERE u.username = :username";
        TypedQuery<User> query = entityManager.createQuery(jpql, User.class);
        query.setParameter("username", username);
        try {
            return query.getSingleResult();
        } catch (NoResultException e) {
            return null;
        }
    }
}

@Configuration
public class JpaConfig {
    
    @Bean
    public LocalContainerEntityManagerFactoryBean entityManagerFactory(DataSource dataSource) {
        LocalContainerEntityManagerFactoryBean em = new LocalContainerEntityManagerFactoryBean();
        em.setDataSource(dataSource);
        em.setPackagesToScan("com.jdwa.greenu.model");
        
        HibernateJpaVendorAdapter vendorAdapter = new HibernateJpaVendorAdapter();
        em.setJpaVendorAdapter(vendorAdapter);
        
        Properties properties = new Properties();
        // 禁用批量HQL操作中的动态SQL生成
        properties.setProperty("hibernate.jdbc.batch_versioned_data", "true");
        // 启用预编译语句缓存
        properties.setProperty("hibernate.jdbc.use_scrollable_resultset", "true");
        // 禁用HQL解析器中的自动猜测功能
        properties.setProperty("hibernate.query.substitutions", "true");
        
        em.setJpaProperties(properties);
        return em;
    }
}

@RestController
@RequestMapping("/api/users")
public class UserController {
    
    @PostMapping("/search")
    public ResponseEntity<?> searchUsers(@Valid @RequestBody UserSearchDTO searchDTO, BindingResult result) {
        if (result.hasErrors()) {
            List<String> errors = result.getAllErrors().stream()
                .map(DefaultMessageSourceResolvable::getDefaultMessage)
                .collect(Collectors.toList());
            return ResponseEntity.badRequest().body(new ErrorResponse(400, "输入验证失败", errors));
        }
        
        // 业务逻辑
    }
}

@Data
public class UserSearchDTO {
    
    @NotBlank(message = "关键词不能为空")
    @Pattern(regexp = "^[a-zA-Z0-9\\u4e00-\\u9fa5\\s]{1,50}$", message = "关键词只能包含字母、数字、中文和空格，最多50个字符")
    private String keyword;
    
    @Range(min = 1, max = 100, message = "页码必须在1-100之间")
    private int pageNum = 1;
    
    @Range(min = 5, max = 50, message = "每页记录数必须在5-50之间")
    private int pageSize = 10;
}

@Component
public class XSSFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        
        chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response);
    }
    
    private static class XSSRequestWrapper extends HttpServletRequestWrapper {
        
        public XSSRequestWrapper(HttpServletRequest request) {
            super(request);
        }
        
        @Override
        public String getParameter(String name) {
            String value = super.getParameter(name);
            return value != null ? sanitize(value) : null;
        }
        
        @Override
        public String[] getParameterValues(String name) {
            String[] values = super.getParameterValues(name);
            if (values == null) {
                return null;
            }
            
            String[] sanitizedValues = new String[values.length];
            for (int i = 0; i < values.length; i++) {
                sanitizedValues[i] = sanitize(values[i]);
            }
            return sanitizedValues;
        }
        
        private String sanitize(String value) {
            return HtmlUtils.htmlEscape(value);
        }
    }
}

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 其他配置...
            .headers()
                .contentSecurityPolicy("default-src 'self'; script-src 'self' https://trusted-cdn.com; " +
                                       "style-src 'self' https://trusted-cdn.com; " +
                                       "img-src 'self' data: https://trusted-cdn.com; " +
                                       "connect-src 'self' https://api.greenu.jdwa.com; " +
                                       "frame-ancestors 'none'; form-action 'self';")
                .and()
            .xssProtection().block(true)
            .and()
            .frameOptions().deny();
    }
}

@Configuration
public class CSRFConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 其他配置...
            .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                .ignoringAntMatchers("/auth/login", "/auth/refresh", "/api/public/**");
    }
}

@RestController
@RequestMapping("/api")
public class CSRFController {
    
    @GetMapping("/csrf-token")
    public ResponseEntity<?> getCsrfToken(HttpServletRequest request) {
        CsrfToken token = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
        return ResponseEntity.ok(Collections.singletonMap("token", token.getToken()));
    }
}

@Configuration
public class CookieConfig {
    
    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        serializer.setSameSite("Strict");
        serializer.setCookieName("JSESSIONID");
        serializer.setCookiePath("/");
        serializer.setCookieMaxAge(3600);
        serializer.setUseSecureCookie(true);
        return serializer;
    }
}

@Configuration
public class ClickjackingConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 其他配置...
            .headers()
                .frameOptions().deny();
    }
}

response.setHeader("Content-Security-Policy", "frame-ancestors 'none'");

@RestControllerAdvice
public class GlobalExceptionHandler {
    
    private static final Logger logger = LoggerFactory.getLogger(GlobalExceptionHandler.class);
    
    @ExceptionHandler(Exception.class)
    public ResponseEntity<ErrorResponse> handleException(Exception ex, WebRequest request) {
        // 记录完整错误信息到日志
        logger.error("Unhandled exception", ex);
        
        // 返回用户友好错误，不包含技术细节
        ErrorResponse errorResponse = new ErrorResponse(
            500,
            "系统内部错误，请稍后再试",
            Collections.singletonList("操作处理失败")
        );
        
        return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(errorResponse);
    }
    
    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ResponseEntity<ErrorResponse> handleValidationException(MethodArgumentNotValidException ex) {
        List<String> errors = ex.getBindingResult().getAllErrors().stream()
            .map(DefaultMessageSourceResolvable::getDefaultMessage)
            .collect(Collectors.toList());
        
        ErrorResponse errorResponse = new ErrorResponse(400, "输入验证失败", errors);
        return ResponseEntity.badRequest().body(errorResponse);
    }
    
    @ExceptionHandler(AccessDeniedException.class)
    public ResponseEntity<ErrorResponse> handleAccessDeniedException(AccessDeniedException ex) {
        ErrorResponse errorResponse = new ErrorResponse(403, "无权访问此资源", Collections.singletonList("权限不足"));
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body(errorResponse);
    }
    
    // 其他特定异常处理...
}

@Component
public class JwtTokenProvider {
    
    @Value("${app.security.jwt.secret}")
    private String jwtSecret;
    
    @Value("${app.security.jwt.expiration}")
    private long jwtExpiration;
    
    @Value("${app.security.jwt.refresh-expiration}")
    private long refreshExpiration;
    
    public String generateAccessToken(UserDetails userDetails) {
        Map<String, Object> claims = new HashMap<>();
        Collection<? extends GrantedAuthority> authorities = userDetails.getAuthorities();
        claims.put("roles", authorities.stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.toList()));
        
        // 生成随机令牌ID，防止令牌冲突
        String tokenId = UUID.randomUUID().toString();
        claims.put("jti", tokenId);
        
        return Jwts.builder()
                .setClaims(claims)
                .setSubject(userDetails.getUsername())
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + jwtExpiration))
                .signWith(SignatureAlgorithm.HS512, jwtSecret)
                .compact();
    }
    
    public String generateRefreshToken(UserDetails userDetails) {
        // 生成随机刷新令牌ID
        String tokenId = UUID.randomUUID().toString();
        
        return Jwts.builder()
                .setSubject(userDetails.getUsername())
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + refreshExpiration))
                .signWith(SignatureAlgorithm.HS512, jwtSecret)
                .claim("jti", tokenId)
                .claim("type", "refresh")
                .compact();
    }
    
    // 令牌验证方法...
}

@Service
public class FileUploadService {
    
    private static final Set<String> ALLOWED_EXTENSIONS = Set.of("jpg", "jpeg", "png", "pdf", "doc", "docx");
    private static final Map<String, String> MIME_TYPES = Map.of(
        "jpg", "image/jpeg",
        "jpeg", "image/jpeg",
        "png", "image/png",
        "pdf", "application/pdf",
        "doc", "application/msword",
        "docx", "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
    );
    
    public FileUploadResult uploadFile(MultipartFile file, String category) throws IOException {
        // 检查文件是否为空
        if (file.isEmpty()) {
            throw new IllegalArgumentException("文件不能为空");
        }
        
        // 获取原始文件名和扩展名
        String originalFilename = file.getOriginalFilename();
        String extension = getFileExtension(originalFilename);
        
        // 验证扩展名
        if (!ALLOWED_EXTENSIONS.contains(extension.toLowerCase())) {
            throw new IllegalArgumentException("不支持的文件类型");
        }
        
        // 验证MIME类型
        String expectedMimeType = MIME_TYPES.get(extension.toLowerCase());
        String actualMimeType = file.getContentType();
        if (expectedMimeType == null || !expectedMimeType.equals(actualMimeType)) {
            throw new IllegalArgumentException("文件类型不匹配");
        }
        
        // 文件内容验证（例如图片文件的魔数检查）
        byte[] bytes = file.getBytes();
        if (!validateFileContent(bytes, extension)) {
            throw new IllegalArgumentException("文件内容验证失败");
        }
        
        // 生成安全的文件名
        String safeFilename = UUID.randomUUID().toString() + "." + extension;
        
        // 存储文件...
        
        return new FileUploadResult(safeFilename, file.getSize());
    }
    
    private String getFileExtension(String filename) {
        if (filename == null) {
            return "";
        }
        int lastDotIndex = filename.lastIndexOf('.');
        if (lastDotIndex < 0) {
            return "";
        }
        return filename.substring(lastDotIndex + 1);
    }
    
    private boolean validateFileContent(byte[] content, String extension) {
        // 检查文件头（魔数）
        if (content.length < 8) {
            return false;
        }
        
        switch (extension.toLowerCase()) {
            case "jpg":
            case "jpeg":
                // JPEG文件以FF D8开头
                return content[0] == (byte) 0xFF && content[1] == (byte) 0xD8;
            case "png":
                // PNG文件以89 50 4E 47开头
                return content[0] == (byte) 0x89 && content[1] == (byte) 0x50 &&
                       content[2] == (byte) 0x4E && content[3] == (byte) 0x47;
            case "pdf":
                // PDF文件以25 50 44 46开头 (%PDF)
                return content[0] == (byte) 0x25 && content[1] == (byte) 0x50 &&
                       content[2] == (byte) 0x44 && content[3] == (byte) 0x46;
            // 其他文件类型检查...
            default:
                return true;
        }
    }
}

@Service
public class SecureFileUrlService {
    
    @Value("${app.file.secret}")
    private String urlSecret;
    
    @Value("${app.file.base-url}")
    private String baseUrl;
    
    /**
     * 生成带签名的临时URL访问文件
     */
    public String generateSignedUrl(String filename, String userId, long expirationSeconds) {
        long expirationTime = System.currentTimeMillis() + (expirationSeconds * 1000);
        String stringToSign = String.format("%s:%s:%d", filename, userId, expirationTime);
        
        try {
            Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
            SecretKeySpec secret_key = new SecretKeySpec(urlSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
            sha256_HMAC.init(secret_key);
            String signature = Base64.getUrlEncoder().encodeToString(
                    sha256_HMAC.doFinal(stringToSign.getBytes(StandardCharsets.UTF_8)));
            
            return String.format("%s/files/%s?user=%s&expires=%d&signature=%s",
                    baseUrl, filename, userId, expirationTime, signature);
        } catch (Exception e) {
            throw new RuntimeException("Failed to generate signed URL", e);
        }
    }
    
    /**
     * 验证文件访问URL签名
     */
    public boolean verifySignedUrl(String filename, String userId, long expirationTime, String signature) {
        if (System.currentTimeMillis() > expirationTime) {
            return false;
        }
        
        String stringToSign = String.format("%s:%s:%d", filename, userId, expirationTime);
        
        try {
            Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
            SecretKeySpec secret_key = new SecretKeySpec(urlSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
            sha256_HMAC.init(secret_key);
            String expectedSignature = Base64.getUrlEncoder().encodeToString(
                    sha256_HMAC.doFinal(stringToSign.getBytes(StandardCharsets.UTF_8)));
            
            return expectedSignature.equals(signature);
        } catch (Exception e) {
            return false;
        }
    }
}

@RestController
@RequestMapping("/api/internal/security")
public class SecurityIncidentController {
    
    @Autowired
    private SecurityIncidentService incidentService;
    
    @PostMapping("/incident/report")
    @PreAuthorize("hasAuthority('SECURITY_REPORT')")
    public ResponseEntity<?> reportIncident(@Valid @RequestBody IncidentReportDTO reportDTO) {
        SecurityIncident incident = incidentService.createIncident(
                reportDTO.getTitle(),
                reportDTO.getDescription(),
                reportDTO.getSeverityLevel(),
                reportDTO.getAffectedSystems(),
                reportDTO.getReportedBy()
        );
        
        return ResponseEntity.ok(new IncidentReportResponse(incident.getId(), incident.getStatus()));
    }
    
    // 其他端点...
}

@Service
public class VulnerabilityManagementService {
    
    @Autowired
    private VulnerabilityRepository vulnerabilityRepo;
    
    @Autowired
    private NotificationService notificationService;
    
    @Autowired
    private TeamService teamService;
    
    public Vulnerability reportVulnerability(VulnerabilityReportDTO reportDTO, String reporterEmail) {
        // 创建漏洞记录
        Vulnerability vulnerability = new Vulnerability();
        vulnerability.setTitle(reportDTO.getTitle());
        vulnerability.setDescription(reportDTO.getDescription());
        vulnerability.setAffectedComponent(reportDTO.getAffectedComponent());
        vulnerability.setAffectedVersions(reportDTO.getAffectedVersions());
        vulnerability.setReportedBy(reporterEmail);
        vulnerability.setReportDate(LocalDateTime.now());
        vulnerability.setStatus(VulnerabilityStatus.REPORTED);
        
        // 计算CVSS分数和风险等级
        double cvssScore = calculateCVSSScore(reportDTO.getCvssMetrics());
        vulnerability.setCvssScore(cvssScore);
        vulnerability.setRiskLevel(determineRiskLevel(cvssScore));
        
        // 保存漏洞记录
        vulnerability = vulnerabilityRepo.save(vulnerability);
        
        // 根据风险等级发送通知
        if (vulnerability.getRiskLevel() == RiskLevel.CRITICAL || vulnerability.getRiskLevel() == RiskLevel.HIGH) {
            notificationService.sendUrgentSecurityAlert(
                    "高风险漏洞报告: " + vulnerability.getTitle(),
                    "发现一个" + vulnerability.getRiskLevel() + "风险漏洞，影响组件: " + vulnerability.getAffectedComponent()
            );
            
            // 自动分配给安全团队
            assignVulnerabilityToTeam(vulnerability, "SECURITY_TEAM");
        } else {
            notificationService.sendSecurityAlert(
                    "新漏洞报告: " + vulnerability.getTitle(),
                    "发现一个" + vulnerability.getRiskLevel() + "风险漏洞，影响组件: " + vulnerability.getAffectedComponent()
            );
        }
        
        return vulnerability;
    }
    
    public void updateVulnerabilityStatus(Long vulnerabilityId, VulnerabilityStatus newStatus, String comment) {
        Vulnerability vulnerability = vulnerabilityRepo.findById(vulnerabilityId)
                .orElseThrow(() -> new ResourceNotFoundException("Vulnerability not found"));
        
        VulnerabilityStatusChange statusChange = new VulnerabilityStatusChange();
        statusChange.setVulnerability(vulnerability);
        statusChange.setOldStatus(vulnerability.getStatus());
        statusChange.setNewStatus(newStatus);
        statusChange.setChangedBy(getCurrentUsername());
        statusChange.setChangeTime(LocalDateTime.now());
        statusChange.setComment(comment);
        
        vulnerability.setStatus(newStatus);
        vulnerability.getStatusChanges().add(statusChange);
        
        if (newStatus == VulnerabilityStatus.FIXED) {
            vulnerability.setFixDate(LocalDateTime.now());
        }
        
        vulnerabilityRepo.save(vulnerability);
    }
    
    // 其他方法...
    
    private double calculateCVSSScore(CVSSMetrics metrics) {
        // 根据CVSS 3.1标准计算分数
        // ...
        return 7.5; // 示例分数
    }
    
    private RiskLevel determineRiskLevel(double cvssScore) {
        if (cvssScore >= 9.0) return RiskLevel.CRITICAL;
        if (cvssScore >= 7.0) return RiskLevel.HIGH;
        if (cvssScore >= 4.0) return RiskLevel.MEDIUM;
        if (cvssScore >= 0.1) return RiskLevel.LOW;
        return RiskLevel.NONE;
    }
}

@RestController
@RequestMapping("/api/user/privacy")
public class UserPrivacyController {
    
    @Autowired
    private UserPrivacyService privacyService;
    
    @GetMapping("/data")
    public ResponseEntity<?> getUserData(Principal principal) {
        UserDataExportDTO userData = privacyService.exportUserData(principal.getName());
        return ResponseEntity.ok(userData);
    }
    
    @PostMapping("/consent")
    public ResponseEntity<?> updateConsent(@Valid @RequestBody ConsentUpdateDTO consentDTO, Principal principal) {
        privacyService.updateUserConsent(principal.getName(), consentDTO);
        return ResponseEntity.ok(new ApiResponse(true, "隐私设置已更新"));
    }
    
    @PostMapping("/delete-request")
    public ResponseEntity<?> requestAccountDeletion(Principal principal) {
        privacyService.initiateAccountDeletion(principal.getName());
        return ResponseEntity.ok(new ApiResponse(true, "账号删除请求已提交，请查收邮件完成确认"));
    }
}