hy/yumi-java
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(withdrawal): validate callback boundaries

Browse Source
This commit is contained in:
hy001 2026-07-20 16:38:15 +08:00
parent c09787831c
commit 474daa7070
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
rc-service/rc-service-console/console-adapter/src/main/java/com/red/circle/console/adapter/integration/WithdrawalReviewIntegrationController.java
View File

@ -51,7 +51,10 @@ public class WithdrawalReviewIntegrationController {
ResponseAssert.isTrue(ResponseErrorCode.REQUEST_PARAMETER_ERROR, ResponseAssert.isTrue(ResponseErrorCode.REQUEST_PARAMETER_ERROR,
"withdrawal approval credential is required", "withdrawal approval credential is required",
!"PASS".equals(request.getDecision()) !"PASS".equals(request.getDecision())
|| (request.getCredentialUrls() != null && !request.getCredentialUrls().isEmpty())); || (request.getCredentialUrls() != null
&& !request.getCredentialUrls().isEmpty()
&& request.getCredentialUrls().stream()
.allMatch(url -> url != null && !url.isBlank())));
long sourceApplicationId; long sourceApplicationId;
try { try {
@ -62,6 +65,9 @@ public class WithdrawalReviewIntegrationController {
// failure 必然抛出 ResponseException；赋值只为满足 Java 的确定赋值检查。 // failure 必然抛出 ResponseException；赋值只为满足 Java 的确定赋值检查。
sourceApplicationId = 0L; sourceApplicationId = 0L;
} }
// 来源申请号来自跨系统字符串契约；数值可解析不等于合法主键，必须在拿锁和查库前拦截非正数。
ResponseAssert.isTrue(ResponseErrorCode.REQUEST_PARAMETER_ERROR,
"invalid source withdrawal application id", sourceApplicationId > 0L);
userBankBalanceBackService.approvalMoneyApply(new ApprovalMoneyApplyCmd() userBankBalanceBackService.approvalMoneyApply(new ApprovalMoneyApplyCmd()
.setId(sourceApplicationId) .setId(sourceApplicationId)
.setCredential(request.getCredentialUrls()) .setCredential(request.getCredentialUrls())