fix: 安全漏洞-社区版权限绕过 H2 RCE Bypass

core/core-backend/src/main/java/io/dataease/datasource/type/H2.java

@@ -3,16 +3,18 @@ package io.dataease.datasource.type;
 import io.dataease.exception.DEException;
 import io.dataease.extensions.datasource.vo.DatasourceConfiguration;
 import lombok.Data;
+import lombok.EqualsAndHashCode;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 
+@EqualsAndHashCode(callSuper = true)
 @Data
 @Component("h2")
 public class H2 extends DatasourceConfiguration {
     private String driver = "org.h2.Driver";
 
     public String getJdbc() {
-        if (jdbc.contains("INIT") || jdbc.contains("RUNSCRIPT")) {
+        if (StringUtils.containsAnyIgnoreCase(jdbc, "INIT", "RUNSCRIPT")) {
             DEException.throwException("Has illegal parameter: " + jdbc);
         }
         return jdbc;

sdk/common/src/main/java/io/dataease/auth/filter/CommunityTokenFilter.java

@@ -61,6 +61,7 @@ public class CommunityTokenFilter implements Filter {
                 String msg = URLEncoder.encode(e.getMessage(), StandardCharsets.UTF_8).replace("+", "%20");
                 headers.add(headName, msg);
                 sendResponseEntity(res, new ResponseEntity<>(e.getMessage(), headers, HttpStatus.UNAUTHORIZED));
+                return;
             }
         }