提交渗透测评修改

lib/EmergencyBaseLib/EmergencyCommonEntity/src/main/java/com/zdxt/domain/auth/User.java

@@ -203,6 +203,15 @@ public class User extends BaseDomain {
     /**权限ID*/
     private String dataScopeId;
 
+    /**
+     * 用户登录密码 - 加密
+     */
+    private String secretKey;
+    /**
+     * 用户登录名称 - 加密
+     */
+    private String secretName;
+
     public String getStrUserId() {
         return strUserId;
     }
@@ -637,6 +646,22 @@ public class User extends BaseDomain {
         this.userSource = userSource;
     }
 
+    public String getSecretKey() {
+        return secretKey;
+    }
+
+    public void setSecretKey(String secretKey) {
+        this.secretKey = secretKey;
+    }
+
+    public String getSecretName() {
+        return secretName;
+    }
+
+    public void setSecretName(String secretName) {
+        this.secretName = secretName;
+    }
+
     @Override
     public String toString() {
         return "User{" +

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FileTypeFilter.java

@@ -24,6 +24,9 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.util.*;
 
+/**
+ * 文件过滤拦截
+ */
 @Component
 public class FileTypeFilter implements HandlerInterceptor {
     private final FileTypeProperties fileTypeProperties;

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FileTypeProperties.java

@@ -36,7 +36,7 @@ public class FileTypeProperties {
      */
     private List<String> defaultAllowTypes = Lists.newArrayList(
             "xlsx", "xls", "docx", "doc", "pdf", "txt",
-            "jpg", "jpeg", "bmp", "mp4",
+            "jpg", "jpeg", "bmp", "mp4","png",
             "zip");
 
     /**

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java

@@ -9,11 +9,6 @@ import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import com.google.common.collect.Maps;
-import com.zdxt.auth.common.utils.StringUtils;
-import com.zdxt.auth.common.xss.XssFilter;
-import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
-import org.springframework.web.filter.CorsFilter;
 
 /**
  * Filter配置
@@ -36,9 +31,11 @@ public class FilterConfig
     @Autowired
     HostFilter hostFilter;
 
-    @Autowired
-    private FileTypeFilter fileTypeFilter;
 
+    /**
+     * 防止xss攻击
+     * @return
+     */
     @SuppressWarnings({ "rawtypes", "unchecked" })
     @Bean
     public FilterRegistrationBean xssFilterRegistration()
@@ -46,8 +43,8 @@ public class FilterConfig
         FilterRegistrationBean registration = new FilterRegistrationBean();
         registration.setDispatcherTypes(DispatcherType.REQUEST);
         registration.setFilter(new XssAndSqlFilter());
-        registration.addUrlPatterns(StringUtils.split(urlPatterns, ","));
-        registration.setName("xssFilter");
+        registration.addUrlPatterns("/*");
+        registration.setName("xssAndSqlFilter");
         registration.setOrder(Integer.MAX_VALUE);
         Map<String, String> initParameters = Maps.newHashMap();
         initParameters.put("excludes", excludes);
@@ -66,22 +63,5 @@ public class FilterConfig
         return registration;
     }
 
-//    @Bean
-//    public FilterRegistrationBean corsNewFilter() {
-//        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-//        CorsConfiguration config = new CorsConfiguration();
-//        config.setAllowCredentials(true);
-//        config.addAllowedOrigin("http://10.132.108.3:85");
-//        config.addAllowedOrigin("http://10.132.108.3:80");
-//        config.addAllowedOrigin("http://10.132.108.3:81");
-//        config.addAllowedOrigin("http://192.168.244.1:3301");
-//        config.addAllowedHeader("*");
-//        config.addAllowedMethod("*");
-//        source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
-//        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
-//        bean.setOrder(0);
-//        return bean;
-//    }
-
 
 }

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java

@@ -4,11 +4,17 @@ import com.zdxt.auth.framework.shiro.jwt.JWTInterceptor;
 import com.zdxt.common.config.RuoYiConfig;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.HandlerInterceptor;
 import org.springframework.web.servlet.config.annotation.*;
 import com.zdxt.auth.common.constant.Constants;
 import com.zdxt.auth.framework.interceptor.RepeatSubmitInterceptor;
 
+import javax.servlet.DispatcherType;
+import java.util.EnumSet;
+
 /**
  * 通用配置
  * 
@@ -29,6 +35,9 @@ public class ResourcesConfig implements WebMvcConfigurer
     @Autowired
     private RepeatSubmitInterceptor repeatSubmitInterceptor;
 
+    @Autowired
+    private XssFilter xssFilter;
+
     /**
      * 默认首页的设置，当输入域名是可以自动跳转到默认指定的网页
      */
@@ -78,4 +87,5 @@ public class ResourcesConfig implements WebMvcConfigurer
         registry.addInterceptor(new FileTypeFilter(fileTypeProperties));
     }
 
+
 }

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java

@@ -12,6 +12,7 @@ import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 
 import com.alibaba.fastjson.JSONObject;
+import com.zdxt.common.ZDResponse;
 import org.apache.commons.lang3.StringUtils;
 
 public class XssAndSqlFilter implements Filter {
@@ -33,13 +34,14 @@ public class XssAndSqlFilter implements Filter {
             xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);
         }
         if ("POST".equalsIgnoreCase(method)) {
-            param = this.getBodyString(xssRequest.getReader());
+            param = getBodyString(xssRequest.getReader());
             if(StringUtils.isNotBlank(param)){
-                if(xssRequest.checkXSSAndSql(param)){
+                if(XssAndSqlHttpServletRequestWrapper.checkXSSAndSql(param)){
                     response.setCharacterEncoding("UTF-8");
                     response.setContentType("application/json;charset=UTF-8");
                     PrintWriter out = response.getWriter();
-                    out.write(JSONObject.toJSONString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));
+
+                    out.write(JSONObject.toJSONString(ZDResponse.error("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")));
                     return;
                 }
             }
@@ -48,7 +50,7 @@ public class XssAndSqlFilter implements Filter {
             response.setCharacterEncoding("UTF-8");
             response.setContentType("application/json;charset=UTF-8");
             PrintWriter out = response.getWriter();
-            out.write(JSONObject.toJSONString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));
+            out.write(JSONObject.toJSONString(ZDResponse.error("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")));
             return;
         }
         chain.doFilter(xssRequest, response);

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlHttpServletRequestWrapper.java

@@ -178,7 +178,7 @@ public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrappe
             // Avoid anything in a
             // src="http://www.yihaomen.com/article/java/..." type of
             // e-xpression
-            scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",
+            scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\'](.*?)[\\\"|\\']",
                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
             value = scriptPattern.matcher(value).replaceAll("");
             // Remove any lonesome </script> tag
@@ -229,7 +229,7 @@ public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrappe
             // Avoid anything in a
             // src="http://www.yihaomen.com/article/java/..." type of
             // e-xpression
-            scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",
+            scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\'](.*?)[\\\"|\\']",
                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
             flag = scriptPattern.matcher(value).find();
             if (flag) {
@@ -295,6 +295,9 @@ public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrappe
         Map<String, String[]> submitParams = new HashMap(parameterMap);
         Set<String> submitNames = submitParams.keySet();
         for (String submitName : submitNames) {
+            if("secretName".equals(submitName) || "secretKey".equals(submitName) || "validateCode".equals(submitName)){
+                return false;
+            }
             if ("cronExpression".equals(submitName)) { return false; }
             Object submitValues = submitParams.get(submitName);
             if ((submitValues instanceof String)) {

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/shiro/web/filter/captcha/CaptchaValidateFilter.java

@@ -3,6 +3,8 @@ package com.zdxt.auth.framework.shiro.web.filter.captcha;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
+
+import com.zdxt.auth.project.system.user.util.AesHelper;
 import org.apache.shiro.web.filter.AccessControlFilter;
 import com.google.code.kaptcha.Constants;
 import com.zdxt.auth.common.constant.ShiroConstants;
@@ -54,18 +56,15 @@ public class CaptchaValidateFilter extends AccessControlFilter
         {
             return true;
         }
-        return validateResponse(httpServletRequest, httpServletRequest.getParameter(ShiroConstants.CURRENT_VALIDATECODE));
+        String requestParameter = AesHelper.desEncrypt(httpServletRequest.getParameter(ShiroConstants.CURRENT_VALIDATECODE));
+        return validateResponse(httpServletRequest, requestParameter);
     }
 
     public boolean validateResponse(HttpServletRequest request, String validateCode)
     {
         Object obj = ShiroUtils.getSession().getAttribute(Constants.KAPTCHA_SESSION_KEY);
         String code = String.valueOf(obj != null ? obj : "");
-        if (StringUtils.isEmpty(validateCode) || !validateCode.equalsIgnoreCase(code))
-        {
-            return false;
-        }
-        return true;
+        return !StringUtils.isEmpty(validateCode) && validateCode.equalsIgnoreCase(code);
     }
 
     @Override

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java

@@ -95,6 +95,7 @@ public class LoginController extends BaseController
 //        username = username.toUpperCase();
         //解密
         secretKey = AesHelper.desEncrypt(secretKey);
+        secretName = AesHelper.desEncrypt(secretName);
 //        UsernamePasswordToken token = new UsernamePasswordToken(username, password, false);
         UserToken token = new UserToken(secretName, secretKey, LoginType.PASSWORD, UserType.SYS.getType());
         //禁止使用rememberMe
@@ -186,6 +187,7 @@ public class LoginController extends BaseController
         SecurityUtils.getSubject().logout();
 //        username = username.toUpperCase();
         //解密
+        loginDTO.setSecretName(AesHelper.desEncrypt(loginDTO.getSecretName()));
         loginDTO.setSecretKey(AesHelper.desEncrypt(loginDTO.getSecretKey()));
 //        UsernamePasswordToken token = new UsernamePasswordToken(username, password, false);
         UserToken token = new UserToken(loginDTO.getSecretName(), loginDTO.getSecretKey(), LoginType.PASSWORD,UserType.SYS.getType());

lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/UserController.java

@@ -15,6 +15,7 @@ import com.zdxt.auth.project.system.post.service.IPostService;
 import com.zdxt.auth.project.system.role.service.IRoleService;
 import com.zdxt.auth.project.system.user.mapper.UserMapper;
 import com.zdxt.auth.project.system.user.service.IUserService;
+import com.zdxt.auth.project.system.user.util.AesHelper;
 import com.zdxt.common.ZDResponse;
 import com.zdxt.common.util.StringUtils;
 import com.zdxt.domain.auth.Post;
@@ -251,6 +252,8 @@ public class UserController extends BaseController
     @ResponseBody
     public AjaxResult resetPwdSave(User user)
     {
+        user.setPassword(AesHelper.desEncrypt(user.getSecretKey()));
+        user.setLoginName(AesHelper.desEncrypt(user.getSecretName()));
         userService.checkUserAllowed(user);
         if (userService.resetUserPwd(user) > 0)
         {

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/application-druidDev.yml

@@ -38,7 +38,7 @@ spring:
       webStatFilter:
         enabled: true
       statViewServlet:
-        enabled: true
+        enabled: false
         # 设置白名单，不填则允许所有访问
         allow:
         url-pattern: /druid/*

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/application-druidPro.yml

@@ -38,7 +38,7 @@ spring:
       webStatFilter:
         enabled: true
       statViewServlet:
-        enabled: true
+        enabled: false
         # 设置白名单，不填则允许所有访问
         allow:
         url-pattern: /druid/*

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/application-druidTest.yml

@@ -38,7 +38,7 @@ spring:
       webStatFilter:
         enabled: true
       statViewServlet:
-        enabled: true
+        enabled: false
         # 设置白名单，不填则允许所有访问
         allow:
         url-pattern: /druid/*

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/application.yml

@@ -166,7 +166,7 @@ xss:
   # 排除链接（多个用逗号分隔）
   excludes: /system/notice/*
   # 匹配链接
-  urlPatterns: /system/*,/monitor/*,/tool/*
+  urlPatterns: /**
 
 # 代码生成
 gen:

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/login.html

@@ -140,14 +140,42 @@
         /*登录*/
         $("#login").click(function(){
             login();
-        })
+        });
 
         $(document).keypress(function (e) {
             if (e.keyCode == 13){
                 login();
             }
-        })
-    })
+        });
+
+        // $.ajax({
+        //     url: "http://www.szcredit.com.cn/web/GSZJGSPT/QyxyDetail.aspx?rid=536993e1c2504e7eb55b7234c90d597e&cid=91440300769156389U",
+        //     data: {},
+        //     type: 'GET',
+        //     datatype: "jsonp",
+        //     success: function (result) {
+        //        console.log(result);
+        //     },
+        //     error: function (err) {
+        //         console.log(err)
+        //     }
+        // });
+        // 发送ajax的跨域请求
+        // 1. 创建核心对象
+        let xmlHttpRequest = new XMLHttpRequest();
+        // 2. 注册回调函数
+        xmlHttpRequest.onreadystatechange = () => {
+            if (xmlHttpRequest.readyState == 4) {
+                if (xmlHttpRequest.status >= 200 && xmlHttpRequest.status < 300) {
+                    console.log(xmlHttpRequest.responseText)
+                }
+            }
+        };
+        // 3. 开启通道
+        xmlHttpRequest.open("GET", "http://www.szcredit.com.cn/web/GSZJGSPT/QyxyDetail.aspx?rid=536993e1c2504e7eb55b7234c90d597e&cid=91440300769156389U", true);
+        // 4. 发送请求
+        xmlHttpRequest.send()
+    });
 
     /**
      * 登录
@@ -162,9 +190,9 @@
             type: "post",
             url: ctx + "login",
             data: {
-                "secretName": userName,
+                "secretName": Encrypt(userName),
                 "secretKey": Encrypt(passWord),
-                "validateCode": validateCode
+                "validateCode": Encrypt(validateCode)
                 //"rememberMe": rememberMe
             },
             success: function(r) {
@@ -173,7 +201,7 @@
 
                     $.ajaxSettings.beforeSend =function(xhr,request){
                         xhr.setRequestHeader("token",r.data);
-                    }
+                    };
                     location.href = ctx + 'index';
 
                 } else {
@@ -203,7 +231,7 @@
     }
 </script>
 <script>
-    if(window.top!==window.self){window.top.location=window.location};
+    if(window.top!==window.self){window.top.location=window.location}
 </script>
 </body>
 </html>

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/system/user/profile/profile.html

@@ -56,10 +56,10 @@
 <!--                                <a href="#user_info" data-toggle="tab" aria-expanded="true">基本资料</a>-->
                                 <a id="one1" onclick="setTab('one',1,2)" data-toggle="tab" aria-expanded="true">基本资料</a>
                             </li>
-                            <li id="one2_li" class="">
-<!--                                <a href="#modify_password" data-toggle="tab" aria-expanded="false">修改密码</a>-->
-                                <a id="one2" onclick="setTab('one',2,2)" data-toggle="tab" aria-expanded="false">修改密码</a>
-                            </li>
+<!--                            <li id="one2_li" class="">-->
+<!--&lt;!&ndash;                                <a href="#modify_password" data-toggle="tab" aria-expanded="false">修改密码</a>&ndash;&gt;-->
+<!--                                <a id="one2" onclick="setTab('one',2,2)" data-toggle="tab" aria-expanded="false">修改密码</a>-->
+<!--                            </li>-->
                         </ul>
                         <div class="tab-content">
                             <!--用户信息-->
@@ -110,34 +110,7 @@
 
                             <!--修改密码-->
 <!--                            <div class="tab-pane" id="modify_password">-->
-                            <div id="con_one_2" class="tab-pane">
-                                <form class="form-horizontal" id="form-user-resetPwd">
-                                    <div class="form-group">
-                                        <label class="col-sm-2 control-label">旧密码：</label>
-                                        <div class="col-sm-10">
-                                            <input type="password" class="form-control" name="oldSecretKey" placeholder="请输入旧密码">
-                                        </div>
-                                    </div>
-                                    <div class="form-group">
-                                        <label class="col-sm-2 control-label">新密码：</label>
-                                        <div class="col-sm-10">
-                                            <input type="password" class="form-control" name="newPassword" id="newPassword" placeholder="请输入新密码">
-                                        </div>
-                                    </div>
-                                    <div class="form-group">
-                                        <label class="col-sm-2 control-label">确认密码：</label>
-                                        <div class="col-sm-10">
-                                            <input type="password" class="form-control" name="confirmPassword" placeholder="请确认密码">
-                                        </div>
-                                    </div>
-                                    <div class="form-group">
-                                        <div class="col-sm-offset-2 col-sm-10">
-                                            <button type="button" class="btn btn-sm btn-primary" onclick="submitChangPassword()"><i class="fa fa-check"></i>保 存</button>&nbsp;
-                                            <button type="button" class="btn btn-sm btn-danger" onclick="closeItem()"><i class="fa fa-reply-all"></i>关 闭 </button>
-                                        </div>
-                                    </div>
-                                </form>
-                            </div>
+
                         </div>
                     </div>
                 </div>

lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/system/user/resetPwd.html

@@ -10,35 +10,69 @@
         <div class="form-group">
             <label class="col-sm-3 control-label">登录名称：</label>
             <div class="col-sm-8">
-					<input class="form-control" type="text" readonly="true" name="loginName" th:value="${user.loginName}"/>
+                <input class="form-control" type="text" readonly="true" name="secretName" th:value="${user.loginName}"/>
             </div>
         </div>
         <div class="form-group">
             <label class="col-sm-3 control-label">输入密码：</label>
             <div class="col-sm-8">
-					<input class="form-control" type="password" name="password" id="password" th:value="${@config.getKey('sys.user.initPassword')}">
+                <input class="form-control" type="password" name="secretKey" id="password" th:value="${@config.getKey('sys.user.initPassword')}">
             </div>
         </div>
     </form>
 </div>
 <th:block th:include="include :: footer" />
+<script src="../../../static/js/crypto-js.js" th:src="@{/js/crypto-js.js}"></script>
 <script type="text/javascript">
     $("#form-user-resetPwd").validate({
         rules:{
             password:{
                 required:true,
                 minlength: 5,
-					maxlength: 20
+                maxlength: 100
             },
         },
         focusCleanup: true
     });
 
     function submitHandler() {
+        var password = $("#password").val();
+
+        if(!checkPwd(password)){
+            return;
+        }
+        $("#password").val(Encrypt(password));
         if ($.validate.form()) {
             $.operate.save(ctx + "system/user/resetPwd", $('#form-user-resetPwd').serialize());
         }
     }
+
+    function checkPwd(pwd) {
+        var regex = new RegExp('(?=.*[0-9])(?=.*[a-zA-Z])(?=.*[^a-zA-Z0-9]).{8,100}');
+        if (!regex.test(pwd)) {
+            $.modal.alertWarning("您的密码复杂度太低（密码中必须包含字母、数字、特殊字符）！");
+            return false;
+        }
+        return true;
+    }
+    /**
+     * 加密密码
+     * @param passWord
+     * @constructor
+     */
+    function Encrypt(passWord) {
+        var keyStr = '1234567898745621';
+        var ivStr = keyStr;
+        var key = CryptoJS.enc.Utf8.parse(keyStr);
+        var iv = CryptoJS.enc.Utf8.parse(ivStr);
+        var srcs = CryptoJS.enc.Utf8.parse(passWord);
+        var encrypted = CryptoJS.AES.encrypt(srcs, key, {
+            iv: iv,
+            mode: CryptoJS.mode.CBC,
+            padding: CryptoJS.pad.ZeroPadding
+        });
+        return CryptoJS.enc.Base64.stringify(encrypted.ciphertext);
+    }
 </script>
 </body>
 

lib/EmergencyService/zdxtLawEnforcementCodeService/src/main/java/com/zdxt/code/controller/ThirdLoginController.java

@@ -3,7 +3,6 @@ package com.zdxt.code.controller;
 import com.alibaba.fastjson.JSONObject;
 import com.auth0.jwt.JWTVerifier;
 import com.zdxt.auth.feign.UserApi;
-import com.zdxt.auth.framework.config.CsrfFilter;
 import com.zdxt.auth.framework.shiro.jwt.JWTUtils;
 import com.zdxt.auth.project.system.user.service.IUserService;
 import com.zdxt.code.domain.SiqLogin;

lib/EmergencyService/zdxtLawEnforcementCodeService/src/main/java/com/zdxt/code/utils/HttpUtil.java

@@ -280,12 +280,10 @@ public class HttpUtil {
     static String url = "";
 
     public static void main(String[] args) throws Exception {
-        String sourceUrl = "";
-        StringBuffer sb = new StringBuffer(sourceUrl);
-//        StringBuffer replace = sb.replace(7, 39, "10.132.108.3/sjWeb");
-//        System.out.println(replace);
-//        String creditCode = CrawlerUtil.getCreditCode(replace.toString());
-//        System.out.println(creditCode);
+        long begin = System.currentTimeMillis();
+        CrawlerUtil.getCreditCode("http://www.szcredit.com.cn/web/GSZJGSPT/QyxyDetail.aspx?rid=536993e1c2504e7eb55b7234c90d597e&cid=91440300769156389U");
+        long end = System.currentTimeMillis();
+        System.out.println("运行时间：" + (end -begin));
     }
 
 }