修复招聘会详情图片与展位数据契约

ruoyi-common/src/main/java/com/ruoyi/common/utils/RequestUrlUtils.java

@@ -1,5 +1,8 @@
 package com.ruoyi.common.utils;
 
+import java.net.URI;
+import java.net.URISyntaxException;
+
 import javax.servlet.http.HttpServletRequest;
 
 /**
@@ -63,6 +66,49 @@ public final class RequestUrlUtils
         return scheme + "://" + host + (contextPath == null ? "" : contextPath);
     }
 
+    /**
+     * 将历史数据中的回环地址改为当前请求的公开 origin，同时保留资源路径。
+     * 这样浏览器不会把 127.0.0.1/localhost 解释为访问者自己的电脑。
+     */
+    public static String normalizePublicUrl(HttpServletRequest request, String value)
+    {
+        if (isBlank(value) || request == null) {
+            return value;
+        }
+        try {
+            URI uri = new URI(value.trim());
+            String host = uri.getHost();
+            if (host == null || !isInternalHost(host)) {
+                return value;
+            }
+            URI base = new URI(buildBaseUrl(request));
+            String authority = base.getRawAuthority();
+            if (isBlank(authority)) {
+                return value;
+            }
+            return base.getScheme() + "://" + authority
+                    + (uri.getRawPath() == null ? "" : uri.getRawPath())
+                    + (uri.getRawQuery() == null ? "" : "?" + uri.getRawQuery())
+                    + (uri.getRawFragment() == null ? "" : "#" + uri.getRawFragment());
+        } catch (URISyntaxException e) {
+            return value;
+        }
+    }
+
+    /** 回环资源地址不能写入公开招聘会图片字段。相对路径不受此校验影响。 */
+    public static boolean isLoopbackUrl(String value)
+    {
+        if (isBlank(value)) {
+            return false;
+        }
+        try {
+            URI uri = new URI(value.trim());
+            return uri.getHost() != null && isInternalHost(uri.getHost());
+        } catch (URISyntaxException e) {
+            return false;
+        }
+    }
+
     private static boolean isInternalHost(String host)
     {
         if (isBlank(host)) {